'Smart' TVs Remain The Poster Child For Dismal Privacy, Transparency & Security Standards

from the watching-you-watching-me dept

The dumpster fire that passes for security and privacy standards in the internet of things space is by now pretty well understood. It's also pretty clear that in this sector, "smart TV" vendors have been among the laziest sectors around in terms of making sure private consumer data is adequately encrypted, and that consumers understand that their viewing habits and even some in-room conversations are being hoovered up and monetized, usually sloppily.

Recent studies have found that upwards of 90% of smart TVs can be compromised remotely, and leaked documents have made it clear that intelligence agencies have been having a field day with the lack of security in such sets, easily exploiting paper-mache grade protections in order to use TV microphones to monitor targets without anybody being the wiser.

Meanwhile, set vendors and viewing tracking firms continue to do a pretty dismal job clearly explaining to the end user what data is being collected and monetized. The New York Times, for example, recently did a profile piece on a company named SambaTV, whose viewer-tracking software is now collects viewing data from 13.5 million smart TVs in the United States. Owners of these sets will find Samba's Interactive TV software already installed, and are told that the software simply lets you receive handy recommendations and experience TV "in a whole new way":

"Interact with your favorite shows. Get recommendations based on the content you love. Connect your devices for exclusive content and special offers. By cleverly recognizing onscreen content, Samba Interactive TV lets you engage with your TV in a whole new way."

But at no point during set up does the company really make it obvious just how much data is being collected or how it's used:

"Once enabled, Samba TV can track nearly everything that appears on the TV on a second-by-second basis, essentially reading pixels to identify network shows and ads, as well as programs on HBO and even video games played on the TV. Samba TV has even offered advertisers the ability to base their targeting on whether people watch conservative or liberal media outlets and which party’s presidential debate they watched."

That's certainly something that would never be abused, right? Especially since we keep seeing story after story after story about how anonymized data isn't really "anonymous", such data isn't particularly well protected, and consumers don't actually have the faintest understanding of what's being collected and monetized in the first place. Consumer advocates say that transparency about what data is collected remains utterly lacking, as most users of this software have zero understanding it can potentially even track their political leanings:

“It’s still not intuitive that the box maker or the software embedded by the box maker is going to be doing this,” said Justin Brookman, director of consumer privacy and technology policy at the advocacy group Consumers Union and a former policy director at the Federal Trade Commission. “I’d like to see companies do a better job of making that clear and explaining the value proposition to consumers."

The FTC last year fined TV vendor Vizio $2.2 million for hoovering up the viewing data on 11 million consumer TVs without consumers’ knowledge or consent. But FTC enforcement is inconsistent, and is often slow to address how companies now use numerous devices in concert (your smart phone, your home assistant, and your TV) to deepen in-home surveillance capabilities further. The rabbit hole gets deeper still when you consider that your ISP is also cashing in on your IOT device usage without much transparency or oversight thanks to the recent attacks on privacy rules and FCC authority over ISPs.

Quite often, such data hoovering systems are actively misrepresented as being of ambiguous benefit to the end user. And because users can technically dig through Samba's 4,000 word privacy policy and 6,500 word terms of use to discover what's actually happening (something companies know users won't do and may not even understand if they did), they're technically adhering to the law. Eventually we'll get around to working together on modernizations of the law, but pretty clearly not before years and dozens of additional privacy and security scandals drive the point home.

Filed Under: privacy, security, smart tv, transparency
Companies: samba tv

DHS Tells Records Requester It Can't Find Documents It Posted To Its Own Website

from the weaponizing-your-tax-dollars dept

Government agencies large and small, federal and non-federal, are aggressive non-participants in the free flow of information. Laws enacted to force the government to be responsive to records requests have made it possible to obtain documents from agencies, but this can often take the form of long, expensive legal battles.

When not deterring public records requesters with insane fee demands or years of stonewalling, the government plays keepaway with documents by playing the role of insane, cackling villains, casting aside logic and goodwill in equal parts to assure the public remains ill-informed and well-screwed.

Here are just a few highlights from the government's non-goodwill tours:

• The CIA pretends information it handed on the sly to selected journalists has not been "made public"
• The FBI redacts a document that had already been made public by Senator Rand Paul
• A state agency pretends it doesn't know who requested documents in an attempt to deny standing in a records lawsuit
• The DOJ tells Techdirt it can't find a gag order it had already released to another requester
• The FBI tells Jason Leopold it can't release documents it had already released to Techdirt
• The FBI tells a records requester it can't find a document it had already released to another requester six months earlier
• The IRS turns over fully-redacted documents to a requester in the form of password-protected encrypted files... with no password included

It is in this spirit of non-cooperation that we bring you the following, via FOIA warrior Emma Best and MuckRock: if something is always in the last place you look, why not check your own website first?

In late February 2017, the Trump Administration took some of its earliest steps towards implementing a new border wall policy with an executive order and several memos issued by the Department of Homeland Security’s leadership. In response to the policy, MuckRock filed a FOIA request for “memos relating to executive orders signed by Donald Trump,” including but not limited to memos described in a specific article.

Just under 17 months later, DHS responded with a letter saying that they were unable to find any such memos. Despite these claims, two of the memos which DHS said they were unable to find had already been posted to their website.

As Best points out, this isn't just an embarrassing failure by the DHS's FOIA response team. A couple of easily-avoidable errors is one thing. Ongoing antipathy that results in this sort of under-service is a symptom of a bigger problem.

While DHS’ failure to provide copies of already publicly available memos may appear to be an amusing annoyance, their response to the FOIA request highlights the agency’s general failing with FOIA. There’s no reason to believe that these were the only two DHS memos relating to Trump’s executive orders, since no policy can be fully implemented by just two memos. The DHS’ failure to find copies of already public documents brings their search process into question for both this particular FOIA request as well as FOIA requests in general.

This is being appealed, with Best making the understated suggestion the DHS's search attempt wasn't very thorough by pointing it to the two memos posted at its own website. But even if the DHS had found the memos under its nose, it's still stiffing requesters by pretending there's nothing else guiding its monumental shift in immigration enforcement priorities. This is bad faith by bad actors who apparently feel it's their duty to keep the public in the dark.

Filed Under: dhs, foia, transparency

Lobbyists Descend On California To Shape A Rushed New Privacy Law

from the if-at-first-you-don't-succeed dept

Last year, the GOP and Trump administration used the Congressional Review Act to dismantle FCC consumer broadband privacy protections before they could take effect last March. While AT&T and Comcast whined incessantly about the rules, the FCC's guidelines were relatively modest; they required that ISPs and mobile carriers be transparent about what data is being collected and sold, and get express consumer opt-in consent before ISPs can share more private financial or location data. Such rules could have gone a long way in protecting consumers in the wake of the recent Securus and Locationsmart location data scandals.

Following the ISP-funded attack on FCC authority and consumer protections, states have begun exploring their own privacy protections (mirroring what we're also seeing on the net neutrality front). For example, California last year considered passing a state-level copy of the FCC's gutted privacy rules. But those efforts hit a political brick wall thanks to the collective lobbying muscle of Comcast, Verizon, AT&T, Google and Facebook, which killed that effort by lying repeatedly about what the proposal actually did, including claims the proposal would "aid extremism."

Verizon and Facebook both pretended to back away from those attacks once their efforts gained press exposure, but those promises don't appear to be worth much.

In the wake of the successful attack on FCC privacy rules, California privacy advocates have been pushing a new ballot initiative, this time dubbed the California Consumer Privacy Act of 2018. The initiative would require that companies be fully transparent about what data is being collected and sold (and to whom), as well as mandating mandatory opt-out tools. The proposal goes further than the FCC's discarded rules, in that it would ban ISPs from trying to charge consumers more for privacy, something that has already been previously implemented by AT&T and considered by Comcast.

The new initiative is scheduled to appear on this November's ballot, and Google, Facebook, and large ISPs are once again working in concert to ensure that doesn't happen ahead of a looming Thursday afternoon deadline. They're collectively now pushing for quickly-hacked together "compromise legislation," AB 375, they're hoping will be significantly weaker than the looming November ballot initiative.

"In addition to Facebook, Google, AT&T, Microsoft, Amazon, Verizon, and the California New Car Dealers Association have each contributed six figure donations to the Chamber account set up to defeat CCPA. Uber, the Data & Marketing Association, Cox Communications, and the Interactive Advertising Bureau have each contributed $50,000 to the account, according to disclosures."

Recall, Facebook recently made a big show earlier this year about how it wouldn't be working to undermine such privacy proposals in the wake of the Cambridge scandal:

"The inclusion of a Facebook representative is notable, given the company’s well-publicized announcement earlier this year that it would end its opposition to the initiative. In February, the company provided $200,000 to an account set up by the California Chamber of Commerce designed to defeat the CCPA initiative. But in April, following revelations about the extent to which British consulting firm Cambridge Analytica provided the Donald Trump campaign with illicit access to Facebook user data, Facebook announced that it would withdraw its opposition to CCPA and not provide additional funding to the Chamber account."

As the GDPR clearly illustrates, there's some real peril in pushing through solutions before ironing out all of the potential pitfalls. Both the scotch-taped together AB 375 and the California Consumer Privacy Act (a pet side project of San Francisco real estate developer Alastair Mactaggart) have some notable problems that would have been aided by a longer, more transparent and inclusive discussion. Though the problems with AB 375 (which, again, if passed would eliminate the latter from contention) are notably worse, in large part because the bill was quickly cobbled together in just under a week behind closed doors:

"By tomorrow, the California legislature likely will pass a sweeping, lengthy, overly-complicated, and poorly-constructed privacy law that will have ripple effects throughout the world. While not quite as comprehensive as the GDPR, it copies some aspects of the GDPR and will squarely impact every Internet service in California (some of whom may be not currently be complying GDPR due to their US-only operations). The GDPR took 4 years to develop; in contrast, the California legislature will spend a grand total of 7 days working on this major bill."

Not only was AB 375 a rush job, the bill has been steadily eroded since introduction by this super group of telecom and Silicon Valley lobbying giants. AB 375 just passed out of the out of the Senate Judiciary Committee, meaning it's most likely going to be the California privacy proposal of choice. And the fact that it's a rush job is not apparently of much concern to the bill's backer:

"Assemblyman Ed Chau, an Arcadia Democrat and the chief bill author, said he doesn't like the rushed process forced by the ballot measure deadline, but he stressed that his bill gives Californians important privacy protections."

With that mindset, it's easy to wind up with a privacy law that sounds good ("look ma, I "fixed" privacy!") but doesn't actually do anything. And when you've got lobbyists from AT&T, Comcast, Verizon, Facebook, Google, Amazon and Microsoft disproportionally dictating the overall trajectory of the law, the chances that you're going to end up with weak-kneed "privacy rules" in name only is pretty monumental. Adding speed for speed's sake -- combined with an overall lack of transparency -- only adds to the potential that the rules you end up with are toothless or packed with unintended consequences.

That said, doing nothing isn't an option. This isn't a problem that magically fixes itself.

Modern consumer privacy oversight in the internet-era currently consists of little more than pinky swears and winks, a point driven home repeatedly by the Cambridge, LocationSmart and Securus scandals. We need to have a lengthy, transparent, adult conversation about what a potential solution might look like. The problem is that the larger companies dictating the conversation have an absolutely abysmal track record on these issues, so while they may have valuable insight on the complicated scope of a particular proposal's impact, they've managed, repeatedly, to shoot their credibility squarely in the foot on this subject.

And while ISPs and Silicon Valley giants like to go on at length about how they're "open to having a conversation" about more meaningful privacy guidelines, the reality is that most of these larger companies simply aren't. Any rules worth their salt will cost them money, since an informed, empowered consumer is more likely to opt-out of data monetization schemes, whatever they look like. As a result, you'll be hard-pressed to find many large ISPs or Silicon Valley giants willing to back truly tough consumer protections, especially rules than mandate express, opt-in consumer consent for things like location or financial data.

Eventually, after we've suffered through a few more hacks, breaches and major scandals, some of these companies may shift their thinking toward the idea that compliance with quality, even-handed rules is more profitable than chaos. But as the ham fisted repeal of the FCC privacy rules makes clear, we're nowhere near that point yet. Meanwhile, on the federal level, the Trump administration is rumored to be considering a broad new privacy plan. And if the administration's equally heavy-handed net neutrality repeal is any indication, objectivity, hard data and transparency aren't likely to have much of a seat at the table there, either.

Filed Under: california, gdpr, laws, lobbyists, privacy, rush, transparency
Companies: at&t, comcast, facebook, google

'Transparent' FCC Doesn't Want To Reveal Any Details About Ajit Pai's Stupid Reese's Mug

from the bringing-transparency-back dept

One of FCC Chair Ajit Pai's claims about how he's changed the FCC is that he's making it more transparent. And, to be fair, he did make one key change that his predecessors failed to do: which is releasing the details of rulemakings before they're voted on. That was good. But in so many other ways, Pai has been significantly less than transparent. And this goes all the way down to incredibly stupid things, like his silly stupid giant Reese's coffee mug. That mug is so famous, that even John Oliver mocked it in his story on net neutrality:

Taylor Amarel had some questions about the mug, and made a FOIA request using Muckrock, that might shed some details on the mug (and, perhaps, a few other things):

I would like to obtain all emails sent to, from, or copied to Deanne Erwin, Executive Assistant, containing any of the following non-case-sensitive key-strings: “reeses”, “ethics”, “mug”, “liberals”, or “Reese’s” from January 1, 2017 to present day.

But the wonderfully "transparent" Ajit Pai... apparently didn't want that. The FCC's General Counsel sent back an oddly accusatory email to Amarel, demanding a ridiculous amount of completely unnecessary information -- claiming it needed that info to assess fees to respond to the FOIA request:

In our attempts to discern your fee categorization, we became aware that the name you provided, Taylor Amarel, is likely a pseudonym. In order to proceed with your request, please provide us with your name, your personal mailing address, and a phone number where you can be reached.... We ask that you provide this information by May 29, 2018. If we do not hear from you by then, we will assume you are unwilling to provide this information and will close your requests accordingly.

As Muckrock noted, there is no reason why anyone should need to prove that they are using their real name or to provide all this personal info to the FCC, and it feels like an intimidation technique. Muckrock does note that such info might be useful in determining if Amarel should be granted media status, which might help waive fees, but Amarel did not request to be covered under such status.

Amarel handed over the info... and was then told that it would cost $233 to get the emails related to Pai's Reese's mug. Using Muckrock's own crowdfunding platform, users chipped in to fund the money, so hopefully at some point the FCC will live up to its legally required transparency and tell us about that stupid mug.

Filed Under: ajit pai, fcc, foia, resse's mug, transparency

Apple's Latest Transparency Report Shows Gov't Still Not All That Interested In Seeking Warrants

from the an-NSL-a-day-keeps-the-oversight-away dept

Apple has released its latest transparency report. It shows the United States, by far, has the most interest in obtaining user content and data from the company.

New figures in the company's second biannual transparency report for 2017 show that Apple received 29,718 demands to access 309,362 devices in the second-half of the year.

Data was turned over in 79 percent of cases.

The number of demands are down slightly on the first half of the year, but the number devices that the government wanted access to rocketed.

What it doesn't show, however, is how much is being obtained using only subpoenas. Warrants are needed for content. That Apple's latest report [PDF] makes clear.

Any government agency seeking customer content from Apple must obtain a search warrant issued upon a showing of probable cause.

But in 90% of cases listed in the report, only a subpoena was delivered to Apple. What isn't made explicitly clear is whether or not content was sought using something other than a warrant. Apple says the government requested content 608 times using 270 warrants, which isn't necessarily a problem, considering more than one device/account may have been targeted. That still leaves more than 4,000 subpoenas Apple classifies as "Device Requests." Unfortunately, sussing this out more granularly is pretty much impossible because Apple's definition of "device requests" leaves a lot to be desired.

[D]evice-based requests received from a government agency [seek] customer data related to specific device identifiers, such as serial number or IMEI number. Device-based requests can be in various formats such as subpoenas, court orders or warrants.

Given Apple's public battle with the DOJ over encryption, it's very likely the company is demanding warrants when customer content is sought. But it could do better breaking down these requests into content and non-content demands.

That being said, there's a lot of detail in the report that isn't found in transparency reports by other tech companies. The whole thing is worth reading, if only to marvel at the massive amount of data demands being made by US law enforcement. And it appears the FBI (and other federal agencies) still prefer writing their own paperwork, rather than subject themselves to the minimal judicial scrutiny subpoenas require. National Security Letters are, by far, the most popular way for the government to seek subscriber/customer data. Apple received more than 16,000 NSLs targeting ~8,000 accounts in the last six months of 2017 alone.

While Apple has refused to publish the NSL behind a successfully challenged gag order, it appears ready to add yet another layer of transparency to future reports.

The company said beginning in the next transparency report -- expected later this year -- Apple will disclose the number of apps removed from its app stores.

This should make the next report an even more interesting read. It would be nice if Apple would set up a clearinghouse for government demands -- a la Lumen's database of takedown/removal requests -- but for now, any transparency is better than the opacity we dealt with prior to Ed Snowden outing multiple pervasive surveillance programs.

Filed Under: law enforcement, subpoeanas, transparency, transparency reports, us government, warrants
Companies: apple

Following Facebook, Verizon Quietly Backs Off Opposition To Modest California Privacy Rules

from the sunlight-is-the-best-disinfectant dept

If you missed it, large ISPs like Verizon, with the help of the Trump administration and GOP, worked to quickly kill FCC privacy protections before they could take effect last year. Those rules were arguably modest by any measure, simply requiring that ISPs transparently disclose what data is being collected and who it's being sold to, while providing users working opt out tools (or opt in tools if dealing with sensitive consumer financial data). Those rules, you'll recall, were only proposed after ISPs repeatedly made it clear they were utterly unwilling and unable to self-regulate on the privacy front.

ISPs like Verizon, AT&T and Comcast were given ample leeway on privacy for years. Our reward was covert efforts to track users around the internet without telling them, and repeated efforts to charge users more if they wanted to protect their own privacy. Large ISPs had every opportunity to avoid regulation and self-regulate. They showed us repeatedly this was beyond their capabilities. Limited broadband competition routinely protected them from any repercussions, and revolving-door regulators have now completed the circle of dysfunction.

Much like we're seeing on net neutrality, this hostility to real consumer privacy protections on the federal level resulted in multiple states devising their own consumer protections. Like in California, where lawmakers attempted to push a privacy law that largely mirrored the FCC's effort. And while Google, Facebook, Comcast, AT&T and Verizon will all breathlessly tell you they support meaningful privacy reform, the EFF documented in great detail how they worked together last year to quietly scuttle the initiative. Largely by lying about what it actually did:

"One of the most offensive aspects of the misinformation campaign was the claim that pretending to restore our privacy rights, which have been on the books for communications providers for years, would help extremism...In materials like this advertisement, the opposition lobby claimed that A.B. 375 would result in a deluge of pop-ups that consumers would have to click through, and that in turn this inundation would create a sort of privacy fatigue. Consumers would stop caring, and cybersecurity would suffer.

Comcast, Facebook, Verizon and Google all donated $200,000 each to help hamstring the effort. And while successful, they're now facing another push for a new, very similar initiative that should show up on California voter ballots this November. Again, despite industry face-fanning and pearl clutching there's not much that's controversial about it (you can read more about the act here), with the primary goal being transparency and ensuring consumers have the ability to opt out.

But when the Cambridge Analytica story broke, and actually caring about privacy became en vogue for a brief moment, the public spotlight forced Facebook to quietly slink away away from its opposition to the effort in California. Now Verizon, who is trying to make inroads in marketing via its Oath subsidiary (the combination of AOL and Yahoo), has also been forced to quietly back off opposition in the wake of media attention. A Verizon spokesperson makes it clear that, much like the net neutrality fight, the company's goal is to lobby for weak federal protections that pre-empt tougher state ones:

"Verizon has decided not to continue with the coalition so that we can focus our efforts on creating a national framework for privacy and related issues -- and not a state-by-state approach," a spokesman says."

Again, all of these giant companies will breathlessly tell you they support meaningful privacy protections for consumers. But the reality is that any effort to empower and inform consumers erodes revenues, since it will increase the chance that users opt out of data collection and monetization efforts. That's why no matter how frequently you'll see companies like Verizon and Facebook insist they're interested in "solutions" to the wild west that is currently consumer privacy, it remains routinely difficult to take them seriously in any meaningful capacity.

Filed Under: california, fcc, ftc, isps, privacy, transparency
Companies: facebook, verizon

Facebook And Google Finally Take First Steps On Road To Transparency About Content Moderation

from the but-more-work-is-needed dept

As internet platforms are aggressively expanding their “moderation” of problematic content in response to increased pressure from policymakers and the public, how can we best hold them accountable and make sure that these private censorship regimes are fair, proportionate, accurate and unbiased?

As we wrote in our last piece for Techdirt at the beginning of the year, right before the first Content Moderation and Removal at Scale Conference in Santa Clara, there is a dire need for meaningful transparency and accountability around content moderation efforts in order to ensure that the new rulers of our virtual public squares–practically governments in their own right, with billions of citizens–are using their power to moderate speech responsibly. This need has only grown as the pressure on Facebookistan and Googledom to deal with the extremists, white supremacists, and fake news operations on their platforms has also grown, and as questions about whether they are abusing their power by not taking down enough content–or by taking down too much–have proliferated.

This trend was most evident in the recent Congressional hearings prompted by the Cambridge Analytica scandal, where some lawmakers rebuked Facebook CEO Mark Zuckerberg for not doing enough to keep certain content off the platform, while others raised concerns that Facebook had demonstrated political bias against the right when determining what content to take down. Similar concerns were voiced by Republicans at today’s hearing in the House Judiciary Committee focused on examining major internet platforms’ content moderation practices (despite the fact that claims of anti-conservative bias having been thoroughly debunked). Such concerns are not limited to the right wing, though–charges of racially-biased censorship have also been levelled from the left.

In response to these growing pressures–and in no small part thanks to years of consistent demands from free expression advocates–Google and Facebook this week both took major strides towards “doing the right thing” and promoting greater transparency around their content moderation practices, in ways that mirror what we were advocating for in our previous article.

First, on Monday afternoon, Google released the industry’s first detailed transparency report focused on content moderation, giving statistics about YouTube content removals based on violation of the service’s Community Guidelines. Among other things, the report highlights the total number of videos removed in the last quarter of 2017 (a staggering 8,284,039 videos), the percentage of videos flagged by human users versus YouTube’s automated flagging systems (the robots flagged four times as many videos as the humans), and a percentage breakdown of the different reasons human flaggers had flagged content (whether it was spam, sexual content, hate speech, terrorist content, etc.) This is the first time any company has published this sort of data at this level of detail–and now that YouTube has taken the first step, it certainly won’t be the last.

Soon after YouTube’s trailblazing transparency report, on Tuesday morning, Facebook made a trailblazing announcement of its own. The company published a much more comprehensive version of its Community Standards, including the detailed internal guidelines the company uses to make moderation decisions, and highlighting the “spirit” of their content policies in order to generate greater understanding about why and how the company removes content. In addition, for the first time, the company is giving users the ability to appeal takedown decisions made on individual posts. Posts that are appealed will be reviewed by a human moderator on the company’s appeals team within 24 hours. Prior to this announcement, users could appeal the removal of pages and groups, but the introduction of this process for individual posts is a valuable step towards providing users with greater agency over their content and more engagement in the moderation process.

Taken together, these moves have sharply increased both the quantitative transparency (Google’s numbers) and the qualitative transparency (Facebook’s explanations) around content takedowns, while also improving due process around those takedowns (Facebook’s new appeals). These are both critical first steps, but there is definitely more to be done. For example, although YouTube published a significant amount of data related to the types of objectionable content removed as a result of human flaggers, it does not produce similar data for content flagged by automated flagging systems, which is especially concerning since automated systems flagged the vast majority of objectionable content. Meanwhile, although Facebook’s introduction of an appeals process is a valuable step towards providing users with stronger due process, it currently only applies to hate speech, graphic violence, and nudity/sexual activity, which have been the most controversial categories of objectionable content. In order for this process to be truly impactful, it needs to apply to all forms of content that are being taken down–and the process needs to give impacted users a way to argue their case for why their content should stay up.

Going forward, Facebook and Google also need to take a page out of each other’s books. Like Google, Facebook needs to start reporting quantitative data on its takedowns and how they have impacted different categories of objectionable content, not only for itself but for its other products like Whatsapp and Instagram. Similarly, Google needs to provide users with greater qualitative insight into the guidelines that impact content takedowns, just as Facebook has. They should also expand their takedown reporting to include other Google products and services such as Google+ and the Google Play store. Doing so could help pressure Apple to similarly report on takedowns in the Apple Store, therefore further expanding transparency reporting in this space.

And that’s the real value of these new steps, beyond the transparency itself: Google and Facebook’s new efforts will hopefully push the rest of the industry to compete with them on transparency. Google’s first innovations around transparency reporting on government surveillance demands nearly a decade ago helped set the stage for a domino effect of widespread adoption once the Snowden surveillance scandal broke, as detailed in this timeline and case study on the spread of that reporting practice. In this political moment of “techlash” that has now been turbo-charged by the Cambridge Analytica scandal, the adoption of strong content moderation transparency practices may happen even faster–but only if policymakers and advocates keep demanding it. That includes voices that have been pressing on this issue for years such as the ACLU of Northern California, the Electronic Frontier Foundation, our own organization the Open Technology Institute, and the Ranking Digital Rights project (which just yesterday released its third annual ranking of how well tech companies’ are protecting users’ human rights. Spoiler alert: they’re not doing so great). And since we’re catching this practice at its beginning, perhaps with the right pressure we can not only get all the companies to issue reports but also get them to standardize their reporting formats. Otherwise we may end up with the same crazy quilt of formats that we have in other areas of transparency reporting, which makes it that much harder to meaningfully compare and combine data.

More than pressure, though, we’ll also need continued dialogue with the companies, to better understand how their content moderation and reporting processes do and don’t work, what their biggest challenges are when moderating at scale, and where they think the technology and practice of content moderation and reporting is heading. That’s why our organization along with many others is co-hosting the second Content Moderation at Scale Conference in Washington, DC on May 7, where representatives from a wide range of tech companies both big and small will be talking in detail and on the record about their internal content moderation processes (the conference will be livestreamed and Techdirt's Mike Masnick will be co-running a session on some of the challenges of content moderation).

We may see even more dominoes fall at that conference, with fresh new announcements about increased transparency and due process around content moderation on even more platforms. Let’s hope so, because internet users deserve to know more about exactly when and how their online expression is censored.

Filed Under: appeals process, content moderation, due process, takedowns, transparency

It's Thanks To The Pirate Community That Amazon's Attempt To Degrade Its Streaming Service Is Now Public

from the honor-among-thieves dept

It's said that there is no honor among thieves, but it should be obvious that such a blanket axiom is bound to be at least partially bullshit. Still, this mantra gets applied to the pirating community by its enemies, with those that rip and/or view pirated content labeled as ungrateful kid-slobs, simply looking for any content they can gobble up without any payment whatsoever. Any value or benefit derived from this community is denied or ignored, with the spotlight being only on the inflated injury this same community inflicts on unimaginably wealthy companies and studios.

Again, it should be obvious that this is all bound to be bullshit.

In fact, we've discussed the potential benefits to be found within these communities often in the past. Pirate communities can be viewed as a sort of market study companies get for free, serve as a spotlight on under-served potential customers, and not to mention that this community often buys more content then does their non-pirating cousins. None of this is to excuse copyright infringement, of course, but rather serves to remind us that the world is not black and white, and is instead muddled, complicated, and mushy.

Much like Amazon's streaming service the past few weeks, actually. A fact we only really know about due to this same pirating community doing the investigative work for free.

This week there’s been a sustained chorus of disapproval over the quality of pirate video releases sourced from Amazon Prime. The anger is usually directed at piracy groups who fail to capture content in the correct manner but according to a number of observers, the problem is actually at Amazon’s end.

Discussions on Reddit, for example, report that episodes in a single TV series have been declining in filesize and bitrate, from 1.56 GB in 720p at a 3073 kb/s video bitrate for episode 1, down to 907 MB in 720p at just 1514 kb/s video bitrate for episode 10. Numerous theories as to why this may be the case are being floated around, including that Amazon is trying to save on bandwidth expenses. While this is a possibility, the company hasn’t made any announcements to that end.

Reports suggest the drop in quality is no small thing. Further investigation has shown that the streaming quality via Amazon Prime has had something like a 50% drop. Given how clear it is that the quality of legitimate services has a direct impact on the public's willingness to engage in piracy, we can only speculate on why Amazon thought that downgrading its streaming quality was a good idea. What doesn't seem to be in question, however, is that it did so on purpose.

With Amazon distancing itself from the issues, piracy groups have already begun to dig in the knife. Release group DEFLATE has been particularly critical.

“Amazon, in their infinite wisdom, have decided to start fucking with the quality of their encodes. They’re now reaching Netflix’s subpar 1080p.H264 levels, and their H265 encodes aren’t even close to what Netflix produces,” the group said in a file attached to S02E07 of The Good Fight released on Sunday. “Netflix is able to produce drastic visual improvements with their H265 encodes compared to H264 across every original. In comparison, Amazon can’t decide whether H265 or H264 is going to produce better results, and as a result we suffer for it.”

An expert in video encoding that TorrentFreak spoke with took things further into the technical realm, but the upshot is that the stream quality has been cut in half in a way that looks to be an attempt to serve videos at reduced bandwidth. We still can only guess, because Amazon isn't talking. Unlike the pirate community, however.

With the situation failing to improve during the week, by the time piracy group DEFLATE released S03E14 of Supergirl on Tuesday their original criticism had transformed into flat-out insults.

“These are only being done in H265 because Amazon have shit the bed, and it’s a choice between a turd sandwich and a giant douche,” they wrote, offering these images as illustrative of the problem and these indicating what should be achievable.

With DEFLATE advising customers to start complaining to Amazon, the memes have already begun, with unfavorable references to now-defunct group YIFY (which was often chastized for its low quality rips) and even a spin on one of the most well known anti-piracy campaigns.

As of the past few days, it seems that Amazon has made changes on its end, restoring the original quality of Prime's streams. The company is still refusing to provide any kind of explanation as to why any of this happened to begin with, but it seems quite clear that without the pirating community calling them out, Amazon's customer service claims that all issues were at the end-user and not with the stream itself would have been accepted for much longer, if not indefinitely. Without the pirate hobbyists, they would have gotten away with it.

Filed Under: piracy, transparency, video quality
Companies: amazon

19-Year-Old Canadian Facing Criminal Charges For Downloading Publicly-Accessible Documents

from the making-citizens-pay-for-the-government's-sins dept

A 19-year-old Canadian is being criminally-charged for accessing a website. The Nova Scotian government's Freedom of Information portal (FOIPOP) served up documents it shouldn't have and now prosecutors are thinking about adding charges on top of the ten-year sentence the teen could already be facing. (via Databreaches.net)

Journalists first spotted the problem April 5th, when the FOI portal was taken offline. The Internal Services Minister, Patricia Arab, refused to provide details about the portal's sudden unavailability. It wasn't until the following week that the press was given more information and those affected notified.

Even once the government learned of the breach, it waited until Wednesday to begin notifying affected people. Arab said they held off notifying people was because police suggested it would help them in their investigation.

Seems logical, except…

But [Halifax Police Superintendent Jim] Perrin told reporters police did not make that request. He could not say if advising people would have compromised the investigation. The province's protocols for a privacy breach state it is supposed to inform people as soon as possible, unless otherwise instructed by law enforcement.

The suspect obtained 7,000 documents from the Freedom of Information portal. Apparently around 250 of those contained unredacted personal information. Here's how the government portrayed the supposed hacking:

Government officials said someone got in by "exploiting a vulnerability in the system." The person wrote a script allowing them to alter the website's URL, which then granted access to the personal information.

Internal Services found more than 7,000 PDF documents had been downloaded by a "non-authorized user" in early March. They filed a complaint with police on Saturday.

A script made it easier, but a script wasn't required. The URLs for FOI documents are incremental. As software engineer Evan D'Entremont points out, anyone could have done what the supposed "hacker" did.

The way the documents are stored is simple. They’re available at a specific URL, which David Fraser, a Halifax-based privacy lawyer, was happy to provide:

https://foipop.novascotia.ca/foia/views/_AttachmentDownload.jsp?attachmentRSN=1234

Document number 1235 is stored at https://foipop.novascotia.ca/foia/views/_AttachmentDownload.jsp?attachmentRSN=1235.

Guess where document 1236 is stored? This is not a new problem. In fact, it was recognized over a decade ago as one of the top ten issues affecting web application security. All [the "hacker'] had to do is add.

All this "hacker" did was automate the retrieval of published documents from the government's FOI portal. That's it. This wasn't an attempt to access personal info. That problem lies with the government, which did not properly secure documents it hadn't redacted yet. As D'Etremont points out, plenty of other government websites use the same software for document access. (Searching "inurl:attachmentRSN"will bring up a handful of government websites, including Nova Scotia's temporarily disabled FOI portal).

But other sites have taken care to wall off publicly-available documents from others they're not prepared to make public by using a PublicPortal subfolder. Nova Scotia's site apparently did not, hence the teen's ability to access unredacted documents. This isn't evidence of fraudulent access or malicious hacking. This is evidence of government carelessness.

The question remains, was the access fraudulent?

Remember what I said about the other installations being called “PublicPortal”? And how 6750 of the 7000 records were public anyways, and how this system is literally designed for facilitating “access to information?” Looking at it further, there are no authentication mechanisms, no password protection, no access restrictions. It’s very clear that the software is intended to serve as a public repository of documents.

It’s also very clear that there at least 250 documents improperly stored there by the province. Documents that the province had a responsibility to protect, and failed.

This wasn't a criminal act. This was simply efficient harvesting of publicly-available documents. If some documents weren't supposed to be publicly-available, the blame lies with the government for failing to secure them. The fact that the government decided to get police involved gives this the ugly appearance of scapegoating. This is an embarrassed government body trying to turn its mistake into the malicious works of teen hacker.

It would be very surprising to see these charges stick. The URLs -- and the documents they held -- were publicly-accessible. But if they do stick -- and the Halifax PD has stated it may add more charges -- it will be due to the Nova Scotia government's unwillingness to take responsibility for its own carelessness.

Filed Under: canada, criminal charges, downloading, foia, foipop, nova scotia, transparency