European Space Scientists Unwilling To Release High-Quality Images From Publicly-Funded Rosetta Mission

from the it's-good-to-share dept

One of the most exciting scientific explorations currently underway is the Rosetta space probe, which succeeded in placing a lander on the surface of the comet 67P, and which continues to send back some astonishing pictures. But according to an article on the BBC News site, those pictures come from Rosetta's navigation cameras, not from the main science cameras, which produce higher-quality images. Here's why that's happening:

These images are subject to a six-month embargo to allow the mission team to make discoveries without being scooped.

That's strange, since Rosetta comes from the publicly-funded European Space Agency (ESA), so there is obviously a good case for them being released immediately, especially given the high level of interest from many people. But as the BBC article explains, it's not ESA that is holding things back:

The agency procures the satellite platform, the launch rocket and runs day-to-day operations, but the instruments that gather the data are supplied -- and funded -- via national member states.

Esa may drive the truck, but it does not own the merchandise in the back.

Giving scientists on particular instruments a proprietary period has become standard practice.

It provides the researchers with a head start, enabling them to be first to announce major discoveries and to publish the details in the top journals.

The credit and citations that follow boost their ability to propose future programmes and win further funding. This process has become central to the way they work.

Maybe, but the approach is looking increasingly anachronistic. That's partly because of a new kind of real-time public engagement with science thanks to the Internet; but it's also to do with changes in the way raw scientific data is made available. As an example, the BBC report mentions the data policies for the Sentinel Earth-observation satellites that ESA is building and managing for the European Commission:

The first of these spacecraft, a radar platform called Sentinel-1a, became operational late last year.

All of its pictures are being given away free, with no priority access.

The view is that this will supercharge discovery and even create new businesses in Europe that can exploit the data.

Even though the Rosetta team is still clinging to the older model, there's plenty of evidence elsewhere in science that sharing results does indeed speed up discovery -- and boost the economic return. For example, researchers working on the Human Genome Project (HGP) decided as far back as 1996 that all data from publicly-funded projects should be released immediately. According to a 2013 study, the HGP created $966 billion in economic impact and $59 billion in federal tax revenue; not bad for an investment of $14.5 billion by the US government.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: hoarding, information, information sharing, photographs, rosetta, space

City Of Baltimore To Create Publicly-Accessible Police Brutality Lawsuit Database

from the and-all-it-took-was-an-outside-investigation dept

There's not much information symmetry when it comes to the public and their public servants. The public is routinely required to turn over all sorts of personal information, but their governments are rarely willing to return the favor. In particular, police departments tend to be very tight-lipped when it comes to details of officer misconduct or abuse. Most departments are more than willing to provide in-depth crime stats detailing wrongdoing by citizens, but when asked to turn the magnifying glass on themselves, the details provided are, at best, questionable.

We'll almost always know when police officers are shot at, but without issuing a deluge of FOIA requests, we'll never really know how often police officers shot at citizens. Nearly every police website contains a link to a memorial page dedicated to officers killed in the line of duty, but it takes crowdsourced, completely independent efforts to put together statistics on citizens killed by police officers.

The US Attorney's office is supposed to be gathering statistics on excessive force but, for the most part, it has completely washed its hands of this duty. It has allowed a mandatory requirement to become completely voluntary, with law enforcement agencies who do bother to participate providing incomplete and questionable statistics.

The cities that oversee these agencies aren't much better at demanding accountability -- even cities who spend millions of dollars every year paying settlements to citizens harmed by police misconduct and abuse. Worse, cities who do have plenty of evidence that points to a culture of abuse within their law enforcement agencies are willing to spend millions of tax dollars fighting to keep this documentation secret.

The city of Baltimore is looking to become the exception to the rule.

Baltimore officials will begin this month posting the outcomes of all civil lawsuits alleging police brutality and will reconsider their policy of requiring plaintiffs to keep silent after settlements are reached…

City Solicitor George Nilson, who enacted the new policy regarding police settlements and court judgments, said officials also would seek to provide increased training for officers who are most often cited in lawsuits.

This new openness appears to have been prompted by the Baltimore Sun's investigation of the city's police force.

Nilson said the moves were made in response to The Sun investigation, which showed the city has paid about $5.7 million since 2011 over lawsuits alleging police brutality and other misconduct.

While this is a good move on the city's part, the fact that it took an outside investigation to force this openness is still somewhat disheartening. That the city seemed unaware of how much it was spending to settle police-related lawsuits is disheartening as well. This doesn't say much for the city's financial oversight. Nor does it say much for police oversight, as the report notes that the PD's internal tracking of officers accused of misconduct and abuse is just as lax. Apparently, no one in either group had any idea how much was being spent or how many repeat offenders were involved until the Baltimore Sun pointed it out.

This new database, which will be publicly accessible, adds more transparency to the police department and the city itself.

And there's even more transparency on the way. The city council gave preliminary approval for outfitting police officers with body cameras. Baltimore's mayor, however, (Stephanie Rawlings-Blake) is fighting this bill, claiming it's "illegal" -- something that seems at odds with her general push for transparency elsewhere. On the bright side, she has approved the expansion of the PD's Internal Affairs division and given the police commissioner more power to "punish rogue officers." How this will actually play out remains to be seen (expanding power within police departments usually results in more efficient wagon-circling, rather than greater accountability), but these are all moves in the right direction.

Baltimore's move towards better police accountability is one more cities should emulate. And they should do it proactively, rather than waiting for the local media to force the issue. If police departments want to foster better relationships with the public, they need to be more willing to share the details on what they've done wrong. Knowing that every abuse of power may make its way into the public eye is a useful deterrent. And if the public knows who the repeat offenders are, those on the inside can no longer claim ignorance -- which leads to better accountability.

Filed Under: baltimore, database, information, police brutality

Why The FDA Ban On Providing Health Reports Based On Personal Genomes Won't Work

from the because-DNA-is-digital-data dept

When the first human genome was sequenced -- that is, when most of the 3 billion base-pairs that go to make up our DNA were elucidated -- as part of the Human Genome Project, around $3 billion was spent. Today, the cost of sequencing is falling even faster than Moore's Law, which means everyone could have their genome sequenced soon, if they wished (and maybe even if they don't....). By analyzing the DNA, and looking at the gene variants found there, it is possible to spot predispositions to certain diseases or medical conditions, potentially allowing lifestyle changes or treatment that reduce the risk. The well-known personal genomics company 23andMe was offering this kind of service, at least on a small scale. But that stopped at the end of last year, as the company explains:

We no longer offer our health-related genetic reports to new customers to comply with the U.S. Food and Drug Administration's directive to discontinue new consumer access during our regulatory review process.

At this time, we do not know the timeline as to which health reports might be available in the future or when they might be available.

According to an article in MIT Technology Review, here's what had happened:

in November 2013, the Food and Drug Administration had cracked down on 23andMe. The direct-to-consumer gene testing company's popular DNA health reports and slick TV ads were illegal, it said, since they'd never been cleared by the agency.

But as that same article goes on to explain in detail, users of 23andMe are having no difficulty in getting around that ban on obtaining health-related analyses of their genomes, using third-party sites like Promethease:

Promethease was created by a tiny, two-man company run as a side project by Greg Lennon, a geneticist based in Maryland, and Mike Cariaso, a computer programmer. It works by comparing a person's DNA data with entries in SNPedia, a sprawling public wiki on human genetics that the pair created eight years ago and run with the help of a few dozen volunteer editors. Lennon says Promethease is being used to build as many as 500 gene reports a day.

That kind of analysis is possible because, once sequenced, DNA is essentially just digital data: very easy to upload and compare against biomedical databases storing information as digital files. Even though they are not currently allowed to analyze it, companies like 23andMe still provide customers with access to the raw genomic data, which can then be sent to services like Promethease for a basic report drawing on its DNA database.

This raises an interesting question: given that the information on SNPedia is drawn from public databases, can the FDA stop people using it to circumvent the ban on 23andMe? According to MIT Technology Review, the FDA believes the answers is "yes", but that just won't work in practice. Even if the FDA manages to shut down all the services like Promethease, it would be easy to write a program that searches the main public biomedical databases for exactly the same kind of information about particular gene variants found in somebody's genome. The software could be shared freely as open source, making it impossible to prevent people from obtaining the program and carrying out such searches independently on their own computers.

It's true that there are good reasons why the FDA might be concerned about members of the public being given medical analyses of their genome in inappropriate ways. For a start, the results are generally probabilistic, rather than definite predictions; that makes them hard for non-experts to interpret. And when it isn't about probabilities -- if it is certain that you will develop a disease, possibly a devastating one -- there's a strong argument that counselling needs to be made available when that information is given to the person affected.

Still, regardless of the extent to which the FDA's actions are understandable, trying to stop people comparing their DNA with publicly-available information is futile. As the copyright industry has learned the hard way, once data is digital, it is essentially uncontrollable. The best thing to do is to accept that fact and move on. In this case, that means the FDA should encourage companies offering analysis to do a good job, not block them completely.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: databases, dna, fda, information, innovation, public health
Companies: 23andme

Photographer (And Founder Of Copyright Enforcement Service) Angry That Online Service Won't Simply Hand Over User Info When He Demands It

from the i'm-ever-so-pissed dept

When you start viewing infringement as a personal offense against you and your creation(s), there's a good chance you'll start heading off the rails when attempting to do something about it. Techdirt reader Jorge sends in this impassioned, but clearly wrong, article at PetaPixel dealing with a photographer's attempt to track down the infringer behind an infringing product for sale at Etsy.

The title -- "Is Etsy the New Silk Road for Copyright Infringement?" -- clearly indicates the highly subjective and misguided statements contained therein. It also should be noted up front (rather than footnoted the way it is at PetaPixel) that the photographer writing the post is also the founder of PIXSY, a "service that helps photographers find and fight copyright infringement," by acting as a takedown service as well as an intermediary for the extraction of licensing fees. Photographer Daniel Foster opens the article with this:

While browsing through my image search results on PIXSY (a new service that finds and invoices image theft for you), I was surprised to see my picture for sale on Etsy (above). My immediate reaction:

1. What an ugly mousepad. I’d never print my photo like this.
2. The seller seems to be stealing thousands of photos. How could Etsy let this happen?
3. Who had the nerve to think they could do this?

The Etsy seller in question, Kharma Lu, apparently does nothing but print images on mousepads, cell phone/tablet covers and other flat surfaces. The sheer number of items for sale suggests infringement and Foster's experience definitely proves at least one product is. Foster obviously wants the product using his photo removed, and it is.

I sent both a DMCA takedown request (which Etsy complied with)...

That's hardly Silk Road-esque and the "story" should be over. But Foster wants more than compliance. This is where it's helpful to know up front that he is a founder of a service that helps photographers collect licensing fees. Foster isn't satisfied with the removal. He wants to find the seller.

...and a separate message to Etsy about the situation. I made sure to provide a copy of the photo source as well as a copyright registration certificate so that Etsy could be sure I am the rights owner. Maybe they would be able to identify the name and address of the seller?

(He states this with complete credulity, as though it were impossible for a non-copyright owner to attach a picture and a copyright registration to an email and start making demands...) Etsy won't reveal this information, not with a DMCA takedown request and not because someone demanded they do. After a couple of more discussions, Etsy points Foster at his legal options.

According to Danny, I would have to file a lawsuit and obtain a subpoena before Etsy would disclose Kharma Lu’s contact information. Yes, that’s right. In order to simply find out who is stealing my photo, I would have to a) hire an attorney, b) go to court and c) request a subpeona for Etsy. Assuming Etsy did not challenge the subpeona, it would cost at least $3,000- $5,000 just to get Kharma Lu’s address.

Foster gets the costs wrong (it's actually much cheaper, as he notes in an addendum posted towards the end) and also disingenuously declares in an email to Etsy that he assumes Etsy is "assuming the liability" for Kharma Lu's infringement by refusing to turn over the seller's information. Despite Foster's declaration that commerce "changes everything" and makes all seller information de facto public knowledge, Etsy is still under no obligation to turn over information it holds just because someone's sending angry emails. On top of that, doing so would likely violate Etsy's privacy policy. (Imagine Etsy passing this message along as part of Foster's Rules of Internet Commerce: "Hey, some angry guy said you were stealing his photos so we gave him your home address and phone number.")

He moves from severely dubious legal arguments to complaints about life not being fair.

LiilProducts’ shop is still active, even after I reported the copyright infringement to Etsy. Kharma Lu appears to have gotten away scot-free thanks to Etsy’s protection. This just isn’t right.

It may not be right, but neither is demanding service providers hand over customers' information without the proper legal authority. Sure, that may suck subjectively for Foster, but both the DMCA Safe Harbors and small legal barriers are there to deter abusive activity, not shelter infringers, no matter how victims of infringement spin it.

Foster sums things up with this ridiculous demand:

It’s time to clean up your act, Etsy. You can’t let your sellers steal from other artists and get away with it. At least have the decency to shut down seller accounts when the law is broken.

Foster doesn't actually attempt to verify whether the rest of the photos being used are infringing or not. He simply assumes that because his was, they all (or most of them) are. Etsy isn't willing to make the same mental leap and that makes him unhappy -- as a creator, but probably more importantly, as the founder of a service that's going to run into these built-in protections over and over again. His service markets itself as cost-effective and easy but the reality of the situation isn't quite so rosy. Once PIXSY starts telling users that they'll have to pay to file lawsuits and issue subpoenas in order to obtain infringers' info, they're not going to be any happier than Foster is.

Beyond all the palpable anger, there's a near-complete lack of effort on Foster's part. He did order one of his "own" mousepads in hopes of obtaining seller information but got nothing more than a shipping department address located in California.

Redditors commenting on his posted rant performed some ad hoc "due diligence," uncovering the home address linked to the registrant of the business listed at Etsy -- something Foster could have performed himself if he wasn't so obsessed with making Etsy do the highly subjective "right thing" in response to his complaints.

This lack of a thorough investigative effort also doesn't bode well for PIXSY. If its founder thinks the answer runs through third parties protected by safe harbors from the DMCA and Section 230, his service isn't actually of any use to photographers looking to police use of their photos. Actual infringers are the problem and they're harder to track down. It can be done, but you can't find them by banging your head repeatedly at the nearest corporate wall and demanding it bend to your will (and violate their own privacy policies).

Foster wants heaven and earth moved (seller info, account closed, etc.) because he can prove one product offered is infringing. That's what's actually ridiculous and infuriating -- not Etsy's policies.

Filed Under: copyright, daniel foster, dmca, information, privacy, takedowns
Companies: etsy, pixsy

Dutch IT Contractor Suggests Letting Police Have Direct Real-Time Access To All Of Your Devices... For Your Safety

from the Big-Brother-is-my-co-pilot dept

The premise seems like something right out a Phillip K. Dick novel (or a Doctorow) but the actual deployment is cheerily animated, as if it were selling something as innocuous as breakfast cereal or vehicle insurance. Dutch IT company PinkRoccade envisions a future where all of your everything can be accessed by local law enforcement… for safety!

Here's the not-actually-a-promo (more on that in a moment) video, helpfully subtitled by the nameless Techdirt reader who submitted the story.

The proposal is simple: all portable and wearable electronics can be given completely accessed (opt-in, apparently) by local law enforcement. The cheery figure who happens to be in the wrong place at the wrong time (an "unsafe area") is rescued from a certain mugging by local officers, and all he had to give up was biometric data and access to all of his devices.

Heart rate data and perspiration sensors send a distress signal. The local police note that the "distress signal" emanates from an area with a higher-than-normal crime rate. The police access the citizen's glasses (of the Google variety, presumably) and see what he sees: two approaching figures possibly harboring malicious intent. Police scan GPS signals to see if phones in the area belong to known criminals. The nearest cop car is scrambled to the scene and the citizen who is the police's eyes, ears and sweat glands Makes It Home Alive.

The reaction in the Netherlands has been fierce. Here's the headline of one response, automatically translated:

Holy fuck video: PinkRoccade fucks the privacy.

Even in the untranslated version, one can pick up various iterations of WTF scattered through the native Dutch. The author of this post points out how this supposed public safety tool could be abused, or just applied badly with horrific results.

"The GPS in your smart glasses indicates that you are next to an elementary school and the implanted chip in your testicle gives a slight state of excitement… [t]he vice squad is now underway."

Another Dutch news outlet decided to ask PinkRoccade whether this video was actually, you know, REAL, rather than the misguided attempt at satire it really should be? The answer it received only makes it worse.

Roughly translated, PinkRoccade said that even though the video had been posted to YouTube by the company, it was meant for company personnel and law enforcement only. The general gist of the response is that the public is too stupid to understand this tech proposal and is only mocking it because it's viewing the video without the proper expertise or context.

The company says that all data sharing is purely voluntary, but doesn't address what happens when someone rescinds their permission. How can anyone be assured that the Big Brother they invited into their wearables will actually pack up and leave when asked to? Beyond that, there's the thousands of implications of allowing law enforcement to surveill and respond as it sees fit based on unreliable input like heart rates and perspiration.

It doesn't surprise me that an IT contractor would promo such a product and sadly even less surprising that it would generate interested responses from law enforcement agencies, who have often approached safety (both officer and public) as an area where no rules should apply. But neither of these entities should ever consider following through, even with consent. The potential for abuse and a long list of unintended consequences should warn anyone away. But PinkRoccade deserves most of the blame: for dreaming up this genocidal attack on privacy and for brushing off criticism by telling the public it's simply not smart enough to understand what it's proposing.

Filed Under: devices, information, law enforcement, privacy, real time access, surveillance
Companies: pinkroccade

PhRMA Wants US To Use TAFTA/TTIP To Stop EU Releasing Basic Drug Safety Information

from the it's-the-law dept

Back in February, we reported that PhRMA, the Pharmaceutical Research and Manufacturers of America, was pushing to have the EU put on the US's 'Priority Watch List' for its plans to disclose basic safety information about drugs. Now a letter from PhRMA obtained by the German newsapaper Der Tagesspiegel shows that US pharmaceutical companies are trying to use TAFTA/TTIP to undermine the new EU rules on making clinical trial data available (original in German):

A letter from the U.S. pharmaceutical association (PhRMA) to the TTIP chief negotiator for the United States, Douglas Bell, states: "The disclosure of confidential data from clinical and pre-clinical study files and patient data puts at risk the health system and the well-being of patients." Why more transparency should harm the health systems, the lobby group doesn't explain, but it makes clear to the negotiator how he should conduct the negotiations with the EU: the publication of commercially-sensitive data from a market authorization, the PhRMA letter said threateningly, is not only contrary to the rules of the American FDA, but also to the internationally-accepted intellectual property rights of the World Trade Organization, the so-called TRIPS Agreement. "PhRMA and its members call on the U.S. government to influence the EU at all levels in order to eliminate this problem."

It's hard to see how the problem can be "eliminated." Back in April, the European Parliament adopted the Clinical Trials Regulation by a huge majority. Effective from 2016, it states that information from clinical study files "should not generally be considered commercially confidential" and must be made publicly available -- exactly what PhRMA is lobbying against.

What's worrying is that there's already been one attempt to water down these requirements. Der Tagesspiegel suggests this may have been as a result of pressure from the European Commission, concerned about US reaction to them. It will be interesting to see how the Commission reconciles any US demands during the TAFTA/TTIP negotiations to remove the requirement to publish drug safety information with the new EU regulation that requires it.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: drug safety, eu, information, phrma, tafta, ttip
Companies: phrma

FDA Drives Medical Innovation Overseas As 23andme Looks Elsewhere To Help People

from the fda-failures dept

Last fall, we noted that the FDA had come down hard on 23andme for offering its inexpensive and easy to use genetic testing without first getting detailed FDA approval. As we noted at the time, this seemed to be a typical FDA overreaction. People aren't using 23andme as the final word on something, but rather as a useful indicator to explore more deeply with medical professionals if they needed to be aware of something, change lifestyles, etc. Furthermore, we noted how stopping 23andme and similar offerings would only delay important innovations that the medical world really needs today.

And, now it appears that all the FDA has really succeeded in doing is driving that innovation overseas, as 23andme focuses on expanding in various countries abroad, rather than the US.

While it awaits the agency's approval, a process that could take years, 23andMe aims to offer partial or full genetic-testing services in one or more countries outside of the United States by the end of the year, with likely contenders including Canada, Australia and the United Kingdom, the source said.

A big part of the problem is that the FDA is simply not designed to actually deal with innovative healthcare products. It was built to handle one thing and one thing only: approving pharmaceuticals. And it has a very hammer-and-nail approach to everything it does. Nearly a decade ago, we wrote about Andy Kessler's book The End of Medicine. While that book is now a little outdated, one thing that was quite clear in that book is how ill-prepared (and ill-interested in ever becoming prepared) the FDA is for technological innovations in the healthcare space. The FDA understands clinical testing for drugs, and has trouble understanding anything that doesn't fit into that paradigm.

Providing more useful information to people about their own genes and makeup is a very useful tool. Yes, there can be false positives, but is it better to keep people totally ignorant, or to better inform them across the board? Sure, perhaps it makes sense to do thorough testing of drugs to make sure they're safe (though, even with that there are plenty of compelling arguments for why the FDA does that wrong too), but when it comes to a service that is about providing more information to people, allowing them to be better informed and do more research to be healthier, you'd hope that the FDA would learn how to enable more innovation, rather than shutting it down... and sending the innovation overseas.

Filed Under: fda, genetics, information, overseas, personal genetics, regulations
Companies: 23andme

UK Court Says Information Stored Electronically Is Not 'Property'

from the for-intellectual-property-read-intellectual-monopoly dept

More and more of our activities take place in the digital rather than analog realm. But what exactly is the legal status of that digital stuff as it flows around the Internet, or sits inside databases? A recent judgment in the UK provides important guidance:

Information stored electronically does not constitute property which someone can exercise possession of, judges in the UK have ruled.

The Court of Appeal rejected arguments to the contrary and refused to interpret existing laws in a manner which would, it admitted, "have the beneficial effect of extending the protection of property rights in a way that would take account of recent technological developments".

The judges said that whilst it is possible to exert control over electronic information it is not possible to gain possession of it. The distinction was drawn in a case concerning a dispute between a publisher and an IT supplier.

The details of that case can be read in the useful post on Out-law.com quoted above. The basic facts are as follows. The publisher Datateam Business Media Limited wanted to outsource the management of its subscriber database. The company Your Response Ltd took on the job, but the publisher became dissatisfied with its services, and sought to terminate the contract. In the following dispute over the payment of fees, Your Response Ltd claimed possession of the database -- hence the court case. The analysis of one of the judges is interesting:

"An electronic database consists of structured information," Lord Justice Floyd said. "Although information may give rise to intellectual property rights, such as database right and copyright, the law has been reluctant to treat information itself as property. When information is created and recorded there are sharp distinctions between the information itself, the physical medium on which the information is recorded and the rights to which the information gives rise. Whilst the physical medium and the rights are treated as property, the information itself has never been."

That's an important statement that touches on many aspects of the online world, not least digital copyright. It confirms that the property of "intellectual property" is of monopoly rights, not of the information in the creative work. And since that information cannot be possessed, it therefore cannot be stolen, despite what copyright maximalists would have us believe.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: digital, information, property, uk

Ford VP Claims The Company Is Tracking Everyone's Driving Habits... Then Denies It

from the just-great dept

At a time when we're learning more and more about the vast level of surveillance by the NSA, Ford's global VP of marketing and sales, Jim Farley, made some monumentally stupid comments at CES recently, claiming that the company knows every driver who breaks the law, thanks to GPS devices in cars. After realizing how bad that looked, he insisted he only meant "hypothetically" in talking about the kinds of things that could be done in the future.

Of course, in between point A and point B, you have to imagine someone at the NSA rushed down to the FISA court seeking a Section 215 bulk "business records" order from every American car company for "mere metadata" on every driver in America, right? Just joking. Maybe.

Of course, even if Farley wasn't accurate in his initial statement, it's close enough to true anyway, since so many people carry mobile phones in their pockets, and those are easily tracked as well. In many cases, people are willing to get the benefits of location information, but we don't have nearly enough transparency or knowledge about what's being done with that information, or given the right to control or limit how that information is shared or used.

In an age where so much information is shared with companies, those companies need to move to solutions that involve much greater transparency and controls. Companies making use of your information need to start being upfront about the type of data they collect and how it's being used. The problem with the idea of Ford keeping track of which one of you has a lead foot isn't in that this is possible. Everyone knew it was already possible. It was just been the assumption that no one would actually do it. And that's the kind of thing that needs to change. Companies want to make use of our data, and sometimes it's for very useful purposes -- things that we're happy to get in exchange for the data. The problem is that too often, how the data is being used is hidden from us, and the "benefits" are not clearly laid out. Furthermore, once the data is gone... it's gone, and there are little to no controls about how it's used and shared.

Whether or not Ford in particular is tracking how fast you drive is barely the point. These days, someone is tracking how fast you drive, and as a driver, you should know who it is, and be able to limit how that information is used.

Filed Under: data, gps, information, jim farley, privacy, tracking, transparency

NSA Collects Email Contact Lists, Instant Messaging Chat Buddy Lists From Overseas With No Oversight At All

from the well,-there's-that dept

The Washington Post is out with the latest revelations from the Snowden leaks and it shows that the NSA relies on foreign telcos and "allied" intelligence agencies to scoop up data on email contact lists and instant messaging buddy lists to help build its giant database of connections. Remember a few weeks ago how it was reported that the NSA was basically building a secret shadow social network? It seems like this might be one of the ways it's able to tell who your friends are.

There are a variety of important points here. First off, this information is not coming directly from the tech companies (which, again, suggests that earlier claims that the NSA had direct access to all their servers was mistaken). Rather they're picking this information up off the backbone connections in foreign countries. It also explains why they get so much data from Yahoo -- because, for no good reason at all, Yahoo hasn't forced encryption on its webmail users until... the news of this started to come out.

And here's the big problem: because all of this information is collected overseas, rather than at home, it's not subject to "oversight" (and I use that term loosely) by the FISA court or Congress. Those two only cover oversight for domestic intelligence. The fact that the NSA can scoop up all this data overseas is just a bonus.

Also, while the program is ostensibly targeted at "metadata" concerning connections between individuals, the fact that it collects "inboxes" and "buddy lists" appears to reveal content at times. With buddy lists, it can often collect content that was sent while one participant was offline (where a server holds the message until the recipient is back online), and with inboxes, they often display the beginning of messages, which the NSA collects. Separately, because this is allowing them to gather so much data, it apparently overwhelmed the NSA's datacenters. At times, this is because they get inundated with... spam. For example, one of the documents revealed show that a target they had been following in Iran had his Yahoo email address hacked for spamming, and that presented a problem:

In fall 2011, according to an NSA presentation, the Yahoo account of an Iranian target was “hacked by an unknown actor,” who used it to send spam. The Iranian had “a number of Yahoo groups in his/her contact list, some with many hundreds or thousands of members.”

The cascading effects of repeated spam messages, compounded by the automatic addition of the Iranian’s contacts to other people’s address books, led to a massive spike in the volume of traffic collected by the Australian intelligence service on the NSA’s behalf.

After nine days of data-bombing, the Iranian’s contact book and contact books for several people within it were “emergency detasked.”

Because of this mess, the NSA has tried to stop collecting certain types of information, doing "emergency detasks" of certain collections. This, yet again, shows how ridiculous Keith Alexander's "collect it all" mantra is. When you collect it all, you get inundated with a ton of bogus data, and the information presented here seems to support that.

Filed Under: buddy lists, chat, contacts, email, information, nsa, nsa spying, nsa surveillance, telcos