NSA/GCHQ Use Lolcats To Discuss What They Learn By Spying On All Of Our YouTube Views And Facebook Likes

from the squeaky-dolphins-and-lolcats dept

Just hours after the NY Times/the Guardian and Pro Publica released their stories about Snowden documents revealing the NSA and GCHQ spying on mobile apps, NBC News, working with Glenn Greenwald, revealed a different bunch of Snowden documents concerning how the NSA and GCHQ are collecting unencrypted data concerning YouTube views, Facebook likes and Twitter messages via the taps they have on various internet backbone cables. These are not from the companies themselves, but rather because the data travels unencrypted across the internet, which the NSA and GCHQ grab because they can: The NBC News report includes some sort of bizarre presentation (mostly images, without the associated text) concerning using this information to understand the psychology of folks on the internet. They even use Lolcats. Yes, in one of the strangest sights you may see, here's a "top secret" lolcat image used by the NSA. According to the report, GCHQ insists that when it's scooping up this kind of data, it's just using it in the aggregate to look up interesting data, connections and trends, rather than spying on anyone individually, but of course, once they have that data, if someone becomes "of interest", it's not difficult to go back and dig through it.

The reporters reached out to multiple tech companies, who note that they had nothing to do with this. That's true, as it seems clear that the information was gleaned from the taps placed on the backbone, with the help of the giant telcos, rather than the internet companies. However, at this point, it seems time for any company to recognize that if any bit of data is not being encrypted, the NSA/GCHQ is looking through it. Google, once again, seems particularly upset to discover this was going on, after it had pushed back on attempts by the UK to set up data retention rules for this kind of purpose -- when it's clear that GCHQ was already doing it anyway.

A source close to Google added that Google was “shocked” because the company had pushed back against British legislation that would have required Google to store its metadata and other information for U.K. government use. The legislation, introduced by Home Secretary Theresa May in 2012, was publicly repudiated by Deputy Prime Minister Nick Clegg in 2013 and has never become law. May hopes to reintroduce a modified version this spring.

“It’s extremely surprising,” said the source, “that while they were pushing for the data via the law, they might have simultaneously been using their capability to grab it anyway.”

While it may have been reasonable in the past to assume that if the government wasn't asking for this information via the front door, the info was safe, given both of the big stories of the day, it seems that every online company needs to get much more serious about encryption.

Filed Under: data, facebook likes, gchq, lolcats, nsa, privacy, surveillance, tapped cables, youtube views
Companies: facebook, google, twitter

Will Monsanto Become The NSA Of Agriculture?

from the big-ag,-big-data dept

Monsanto is best-known for its controversial use of genetically-modified organisms, and less well-known for being involved in the story of the defoliant Agent Orange (the company's long and involved story is well told in the book and film "The World According to Monsanto", by Marie-Monique Robin.) Its shadow also looms large over the current TPP talks: the USTR's Chief Agricultural Negotiator is Islam A. Siddiqui, a former lobbyist for Monsanto. But it would seem that the company is starting to explore new fields, so to speak; as Salon reports in a fascinating and important post, Monsanto is going digital:

Monsanto spent close to $1 billion to buy the Climate Corporation, a data analytics firm. Last year the chemical and seed company also bought Precision Planting, another high-tech firm, and also launched a venture capital arm geared to fund tech start-ups.

Here's the key shift that is behind that move:

Many farmers have been collecting digitized yield data on their operations since the 1990s, when high-tech farm tools first emerged. But that information would sit on a tractor or monitor until the farmer manually transferred it to his computer, or handed a USB stick to an agronomist to analyze. Now, however, smart devices can wirelessly transfer data straight to a corporation’s servers, sometimes without a farmer's knowledge.

Data that in isolation is of limited use suddenly becomes highly valuable when aggregated. Here, for example, are some of the ways that companies like Monsanto might use their new stores of knowledge:

details on the economic worth of a farm operation could empower Monsanto or DuPont to calculate the exact value the farm derives from its products. Monsanto already varies its prices by region, so that Illinois farmers with a bumper crop might be charged more for seeds than Texas farmers facing a drought. Bigger heaps of data would enable these companies to price discriminate more finely, not just among different geographic regions but between neighbors.

Another possibility is the following:

Real-time data is highly valuable to investors and financial traders, who bet billions of dollars in wheat, soybean and corn futures. In a market where the slightest informational edge makes the difference between huge profits and even bigger losses, corporations that gather big data will have a ready customer base if they choose to sell their knowledge. Or they could just use it to speculate themselves.

Finally, there's this:

Another issue is how the value of this information will be determined, and the profits divided. The prescription services Monsanto and DuPont are offering will draw on the vast amounts of data they amass from thousands of individual farms. Farmers consider much of this information -- such as on soil fertility and crop yields -- confidential, and most view details about particular farming techniques as akin to personal "trade secrets." Even if the corporations agree not to disclose farm-specific information, some farmers worry that the information may end up being used against them in ways that dull their particular competitive edge.

The parallels with Facebook, Google and other online services that make money from collecting and analysing personal data, are clear. By pooling huge quantities of previously secret data, companies gain a privileged position with unique insights into what farmers are doing. As well as enabling them to track exactly what the latter are up to on a 24-by-7, field-by-field basis, it also allows these aggregators of agricultural data to see the bigger picture in terms of the relationships between different farms. In other words, the race seems to be on to become the NSA of agriculture, with Monsanto already emerging as the likely winner.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, farming, privacy, surveillance
Companies: monsanto

Microsoft Agrees To Hand Over Skype User Data To Russian Police

from the laying-down-for-its-users dept

Microsoft's defense of its very close relationship with national intelligence agencies has historically been that it "complies with applicable laws." However, its "compliance" in the past seemed to have exceeded the compliance of other companies, as it offered the NSA pre-encryption access to most of its popular services as well as "working closely" with the agency to allow it to grab both audio and video from Skype, which it acquired in 2011.

The company has taken a tougher stance in recent weeks, releasing statements that decry the agency's overreach and promise better protection of users' information and data. But given this recent development, it appears the tough talk was saber-rattling for the public's benefit. Microsoft is still very compliant when it comes to working with intelligence agencies.

Microsoft Corporation that owns the Internet call service Skype is ready to keep in store its Russian users’ negotiations, correspondence and data exchange during six months and share it with the Russian police, if necessary, Microsoft’s press office told Itar-Tass.
Microsoft thus confirmed its commitment to work in full compliance with the Russian law, the way it does in all countries of its operations. If any new law is adopted, the company will comply with it as well, the press office said.

Well, I suppose there are none of the usual constitutional concerns that might (theoretically) limit Microsoft's obliging attitude towards the Russian's counter-terrorism efforts. Every Russian Skype user will have their data stored for six months and handed over to the police whenever they ask for it. If the Russian agencies decide they need more data, or want to extend the length of time the data is stored, Microsoft has already agreed to honor any future law targeting its Skype users.

The pending legislation covers a whole lot of ground, data-wise.

According to the document, an individual or a legal entity that has organised users’ contacts on the Internet are to store information about the reception, transmission, delivery and processing of voice information, texts, images, sounds or any other actions in the process of information dissemination and/or data exchange, for six months following such actions and share the mentioned information with the state authorities, if requested.

Any service that has user accounts (which would be close to 100% of them) will be required to hold tons of user data and metadata for six months at the behest of Russian authorities. This isn't that much different than the NSA's data hauls, except that some of its programs don't specifically ask for permission before grabbing data and the collections are stored onsite by the agency.

Details are presumably still being hashed out, but Microsoft has already sworn its allegiance to the Russian law in whatever form it takes after being pushed through the legislative process. Not exactly a heartening indicator of Microsoft's new-found willingness to stand up to government overreach.

Filed Under: data, russia, skype
Companies: microsoft, skype

Ford VP Claims The Company Is Tracking Everyone's Driving Habits... Then Denies It

from the just-great dept

At a time when we're learning more and more about the vast level of surveillance by the NSA, Ford's global VP of marketing and sales, Jim Farley, made some monumentally stupid comments at CES recently, claiming that the company knows every driver who breaks the law, thanks to GPS devices in cars. After realizing how bad that looked, he insisted he only meant "hypothetically" in talking about the kinds of things that could be done in the future.

Of course, in between point A and point B, you have to imagine someone at the NSA rushed down to the FISA court seeking a Section 215 bulk "business records" order from every American car company for "mere metadata" on every driver in America, right? Just joking. Maybe.

Of course, even if Farley wasn't accurate in his initial statement, it's close enough to true anyway, since so many people carry mobile phones in their pockets, and those are easily tracked as well. In many cases, people are willing to get the benefits of location information, but we don't have nearly enough transparency or knowledge about what's being done with that information, or given the right to control or limit how that information is shared or used.

In an age where so much information is shared with companies, those companies need to move to solutions that involve much greater transparency and controls. Companies making use of your information need to start being upfront about the type of data they collect and how it's being used. The problem with the idea of Ford keeping track of which one of you has a lead foot isn't in that this is possible. Everyone knew it was already possible. It was just been the assumption that no one would actually do it. And that's the kind of thing that needs to change. Companies want to make use of our data, and sometimes it's for very useful purposes -- things that we're happy to get in exchange for the data. The problem is that too often, how the data is being used is hidden from us, and the "benefits" are not clearly laid out. Furthermore, once the data is gone... it's gone, and there are little to no controls about how it's used and shared.

Whether or not Ford in particular is tracking how fast you drive is barely the point. These days, someone is tracking how fast you drive, and as a driver, you should know who it is, and be able to limit how that information is used.

Filed Under: data, gps, information, jim farley, privacy, tracking, transparency

Getting Access To Your Own Data Sounds Like A Good Idea, But So Far It Hasn't Been Easy

from the trials-and-tribulations dept

Living in the age of data – whether big or small – certainly has its benefits for businesses and governments. Consumers, however, might be excused for feeling like they are being carried along without fully understanding what is happening to their information. Projects are already up and running to find the right formula to empower citizens without putting them at risk, but each has its own problems.

Companies can carry out detailed analyses of customer data to find new revenue streams while planners can look at how to reduce energy consumption in smart cities based on usage data.

But the individuals who generated the data in the first place are excluded from the equation when it is used. Several government schemes around the world – including the UK’s midata – are trying to change that. The aim is to empower consumers to take advantage of the wealth of data companies and governments harness about them by giving them access to it too. But feedback from early attempts to do this indicates that it might not be an easy endeavor.

Blue and Green buttons in the US

In 2011, the US government established the Smart Disclosure program which is driving the release of both public and private sector data in a standardized, machine readable format. According to President Barack Obama, this will help the public make better choices about all sorts of services such as healthcare, finance and energy.

One of the projects underway as part of Smart Disclosure is Green Button. This is an initiative that allows customers to download their personal energy data in a standard, electronic and portable format. They can then use apps to help them manage their energy consumption, and, ultimately, lower their bills. Currently, 27 million households in seventeen US states have access to their own energy information.

American consumers can also click on the Blue Button, a public-private initiative to give patients access to their health data electronically. Through the Blue Button, users can start compiling their personal medical history, check if the information is correct and have it ready in case of emergency, or when switching health insurance companies. They can also plug their own health information into apps and tools to help them set personalized health goals.

The Blue Button, however, is where the problems with Smart Disclosure come to light. It has been suggested that the Blue Button is essentially useless because the formatting of the data is often unreadable. With this in mind, the government is revamping the system and plans to relaunch the Blue Button in 2014.

The Green Button has also been criticized, with some users being perplexed with the amount of personal data on offer and how to use it. Ted Eytan, a blogger from Washington, DC, writes that he was baffled by the number of apps on offer and found that many were unfinished and others didn't work. He was also concerned that he had to provide information that he did not want to give just to review his energy data.

The success of the Blue and Green Button initiatives is crucial for the whole Smart Disclosure program as many more initiatives are planned under it. For example, MyData aims to provide students with access to their education and financial aid data so that they can create a personal learning profile and use tools to generate learning recommendations based on their past performance and future goals.

Other planned programs include both government data such as military training and experience records from the Department of Defense and historical financial history of citizens, such as earnings and income, from the Internal Revenue Service.

Thinking first in France

With its aim to “return personal data to individuals,” France has also joined the UK and US in a similar initiative called MesInfos.

Created by the FING think tank, the project is embarking on a year-long pilot phase to determine how individuals will use their personal data and how they can benefit from it. During the so called “experimentation period”, a range of different datasets from the private sector will be made available to testers to explore the opportunities for new applications and services.

During this pilot, MesInfos will be looking at whether data transparency is worth the risks involved in sharing information in this way and what to do if “new opportunities for abuse emerge”. The plan is also to think about policy issues such as whether data handback should be mandatory and more fundamental questions like if individuals even want their data at all.

So far, they seem to. More than a million users have registered for the Blue Button to access and download their personal health data. There also seems to be interest from industry, with more than 30 utility and energy providers representing about a quarter of all US customers implementing or planning to implement the Green Button.

But it is ultimately consumers who will determine if such initiatives are going to be successful. Some users are wary of the privacy and security issues involved in initiatives such as midata in the UK, MesInfos in France and Smart Disclosure in the US. As one blogger puts it: “if disclosure is smart, not everything will be disclosed”.

Derek McAuley is Professor of Digital Economy at University of Nottingham. He receives funding from RCUK, and is CIO in residence at the Connected Digital Economy Catapult.

Georgi Kantchev is a PhD student at Oxford. He does not work for, consult to, own shares in or receive funding from any company or organization that would benefit from this article, and has no relevant affiliations.

This article was originally published at The Conversation. Read the original article.

Filed Under: access, blue button, data, energy, green button, health, health information, smart disclosures

So Much For NSA Chief's Offer To Store Data At A 'Neutral' Site: AT&T Receiving $10 Million/Yr From CIA For Phone Records

from the well,-that's-officially-everybody dept

More news has arrived on AT&T's willing accommodation of every government agency that asks for a peek at the numbers (or a never ending, rolling 3-month haul of all records). At least this time, it's getting something more in return than boilerplate court orders with that new ink pad smell. As the New York Times reports, the CIA wants in on the action, and it doesn't need court orders -- just a big stack of cash.

The C.I.A. is paying AT&T more than $10 million a year to assist with overseas counterterrorism investigations by exploiting the company's vast database of phone records, which includes Americans' international calls, according to government officials.

This is all purely voluntary ($10mil of greased palms/wheels notwithstanding), hence the lack of court orders or subpoenas. Oddly enough, this voluntary system actually protects the privacy of Americans much better than the "legal" Section 215 collections.

The C.I.A. supplies phone numbers of overseas terrorism suspects, and AT&T searches its database and provides records of calls that may help identify foreign associates, the officials said…

Because the C.I.A. is prohibited from spying on the domestic activities of Americans, the agency imposes privacy safeguards on the program, said the officials, speaking on the condition of anonymity because it is classified. Most of the call logs provided by AT&T involve foreign-to-foreign calls, but when the company produces records of international calls with one end in the United States, it does not disclose the identity of the Americans and “masks” several digits of their phone numbers, the officials said.

Of course, these "masked" records can be very simply unmasked by "tipping" them to other agencies, like the FBI, which then acquires a subpoena/court order to "unmask" the records. This just goes to show that these agencies can cooperate, as long as its in the interest of furthering domestic surveillance.

Ultimately though, this news isn't surprising. Phone companies have been collecting government paychecks in exchange for data for a very long time. True, the telcos don't want to appear as though they're selling Americans' data for cash, but that's exactly what's happening. The CIA's primary focus is foreign surveillance and, thanks to AT&T, there's some minimization in place to keep the agency focused on its purview.

More interesting, however, is how this news affects General Alexander's "generous" offer to store data at a "neutral site" in order to alleviate privacy concerns. As was noted back when he made this offer, American telcos are hardly "neutral sites" given their history of swiftly coughing up anything requested with a minimum of pushback.

So, AT&T (and Verizon, etc.) are not "neutral" in any true sense of the word, but at least storing the data there would put the NSA in the position of having to bring its selectors to a third party before accessing stored records, rather than just having them conveniently available (and exploitable) in its own storage for an indefinite period of time. This would trim down the "accidental" abuse that has been displayed by the agency in the past.

More recently, ODNI lawyer Robert Litt (along with the FBI's general counsel) suggested storing data with the originators would lead to less privacy. Given what we know about the CIA's paid data plans, he might be correct, even if his motives for making that claim were completely disingenuous.

It would introduce extra steps, but it appears as though there would be a way to "tip" domestic data to the NSA by simply using the process it uses with the FBI. Restrictions on both the NSA and CIA are meant to minimize the amount of unrelated domestic metadata they have access to. The CIA's restrictions are harsher than the NSA's, but the CIA can still grab and let the NSA wrangle the paperwork needed to unmask numbers. Or vice versa. The NSA can access its on-site metadata stores (with unmasked numbers) and tip domestic call data back to the CIA.

Both of these scenarios are unlikely, but storing the data at AT&T seems to offer very minimal privacy advantages over storing it in the NSA's data centers. At best, this creates some mild speed bumps for the agency to deal with in exchange for a small amount of "peace of mind" privacy-wise. Most telcos have seemed even less interested protecting Americans' privacy than the inquiring agencies themselves. As you'll recall, AT&T went out of its way to perform phone record queries for the FBI for agents armed with nothing more legally binding than a Post-It note.

The other thing to note is that this is another bit of evidence that undercuts the telcos' repeated assurance that they "value their customers' privacy." This sentence is usually followed directly by defensive wording about "complying" with "applicable laws" -- which actually means "complying with intelligence agencies." There's very little true concern on display and little to no evidence AT&T (and Verizon) have ever made any serious attempt to push back on government requests.

Filed Under: cia, data, metadata, nsa, phone calls, privacy, surveillance
Companies: at&t

Why Opening Up Clinical Trials Data Is Good For Pharma Companies Too

from the everybody-wins dept

Earlier this year we wrote about how AbbVie, the pharma company spun out of Abbott Laboratories, had gone to court to stop the European Medicines Agency (EMA) from releasing clinical trials information about one of its drugs. Despite what AbbVie claimed, this was not commercially sensitive in any way, but simply basic data about safety and efficacy.

It's often overlooked that this data is mostly obtained by testing new drugs on volunteer members of the public who take the medicines in order to establish their safety. By definition, these volunteers are putting themselves at risk. They selflessly offer to do that in order to advance medicine and confer benefits on society as a whole. That means the clinical data obtained from such tests belongs to the public that made them possible, at least from a moral viewpoint.

If a company seeks to prevent the free dissemination of that safety data, as AbbVie is doing in Europe, it is breaking the implicit compact it made with the people who agreed to try out its drugs. Those invited to take part in future trials of AbbVie's drugs might then begin to ask why they should endanger their health and even lives purely to boost one company's profits.

But even if AbbVie is resistant to the argument that it has a moral obligation to allow the clinical trials data to be released, and is not concerned that the public might think that it has something to hide, perhaps it will be won over by a recent article in The New England Journal of Medicine (NEJM), written by four people from the EMA. This puts forward a quite different argument, that releasing test data will directly benefit pharma companies themselves, and offers a number of reasons why.

First, access to the full data sets of completed studies will lead to improvements in the design and analysis of subsequent trials.

Basically, the more information that drug companies have about what works and what doesn't, the better they can design their future tests.

Second, lessons from past trials about the heterogeneity of treatment effects not only will streamline drug development but also may enhance a drug's value in the marketplace. Identification of a population with high unmet need in which a new treatment may be more cost-effective than other available treatments can aid sponsors during reimbursement negotiations.

Again, the more information companies have about how different groups of patients responded to a drug, the easier it will be to spot particular sub-groups in the population who derive particular benefit. Selling products for that sub-group will be both easier, more profitable and more ethical than simply trying to sell to everybody, since the drug may be ineffective or even inappropriate for many of the general population.

Third, since several possible treatments for one medical condition are often available, comparative-effectiveness information is important to patients, prescribers, and sponsors seeking to position their products.

For a given condition, there may be several possible treatments. Making clinical test data available allows them to be compared, and the best one selected for future drug development, instead of investing huge sums in what may well be a relatively ineffective approach.

Finally, one of the inherent inefficiencies of data secrecy is the repetition of trials and projects that are doomed from the outset; drug developers may continue to pursue a given target even though clinical trials conducted by others have demonstrated the effort's futility.

In many ways this is the most important reason. If the results of clinical trials are kept secret, companies run the risk of repeating the mistakes already made by others. Not only is that a waste of time and money that could be better spent on more fruitful avenues, it is putting test subjects at risk unnecessarily. As the NEJM points out:

In at least one documented case, the availability of data from completed trials could have spared trial subjects a potential health risk and saved millions of research dollars.

The article concludes:

A managed-release environment that allows sharing of patient-level data while ensuring patient privacy would create a level playing field for all stakeholders. What is sometimes labeled as "free riding" may ultimately pay dividends for innovative companies and for public health. It is ironic that the organizations that most resist wider access to data are the ones that stand to benefit so much from greater transparency.

In fact, this is no mere theoretical possibility. We know this approach works, because it is precisely what we see in the field of open source. Sharing the code freely creates a level playing-field that allows companies to innovate faster because they can build on the work of others. The rise of a multi-billion dollar software industry based around such sharing, and the unprecedented rate of innovation this drives, are yet more reasons that companies like AbbVie should be striving to promote, not prevent, the release and dissemination of clinical trials information as open data.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: clinical trials, data, innovation, openness, pharma
Companies: abbvie

Gen. Alexander Offers To Store Phone Metadata At A 'Neutral Site' To Alleviate Concerns About The NSA's Spying

from the as-if-that-would-change-anything dept

Good news, privacy warriors and transparency advocates! NSA head General Alexander has just suggested a fix that should finally put the national debate about security vs. privacy behind us and allow us to move forward, together, to keep this country safe from all the terrorists the NSA's programs haven't prevented from attacking us.

The National Security Agency’s director said Tuesday he is open to storing telephone records in a neutral “repository” to alleviate concerns about government snooping.

General Keith Alexander, speaking about the controversy over bulk collection of phone “metadata” said his personal view is that more transparency would help restore public trust in the secret intelligence service.

“I believe it is in our nation’s best interest to put all this phone data into a repository where you the American people know what we are doing with it,” Alexander told a cybersecurity forum sponsored by the news organization Politico.

“I’m open for greater transparency. I’m open for where we put the data.”

Well, that would be all well and good except for the fact that the data itself comes from "neutral" sites, or at least sites that were neutral before they were approached by the government. It was already stored at neutral sites. If the NSA would just stop collecting the data, it would remain at neutral sites.

Storing the collection at a neutral site is meaningless unless there's complete transparency about the NSA's access. To date, the NSA hasn't been interested in sharing those details. It prevents the companies it taps into from providing any details to the public about the collections.

No abuse can be prevented and no concerns "alleviated" if the entity handling the neutral storage can't openly discuss what sort of inquiries are taking place. Let's not forget the FBI so thoroughly abused the system that its inquiries devolved from requiring warrants to the issuance of an unlimited amount of National Security Letters and "exigent circumstances" claims to Post-It notes to simply copying down info while staring over the shoulder of a telco employee running searches for it.

With nothing in place to prevent the neutral site from being abused in the same fashion as every neutral site the NSA harvests data from, the slight nod towards transparency is worthless. Keeping the phone metadata away from the NSA's fire-prone servers probably sounds like a huge concession to Gen. "Collect all the data!" Alexander, but to anyone outside the system, it just sounds like off-site storage -- storage that will be accessed with the same frequency and same lack of oversight as the NSA's proprietary data banks.

This is what the NSA feels is a "concession" and the only reason it's being offered is because there's a chance that its bulk records collections may actually be cut off. Alexander points out that the NSA will still need to have access to "deal with any terrorist threat from overseas." This would presumably be on-demand whenever the agency feels the collection might contain "relevant" data. In other words, nothing changes but the address.

I can't even offer Alexander an E for effort here. Changing the venue to a "neutral site" (like, say, AT&T? Or a Redmond address?) does nothing for transparency or privacy. As long as the whole process is subject to gag orders and layers of secrecy, the NSA can continue to perform its spying efforts completely unimpeded.

Filed Under: data, keith alexander, neutral site, nsa, nsa surveillance