Big Telecom's Quest To Use The First Amendment To Scuttle Privacy Laws Won't Go Well, Experts Predict

from the we-have-the-Constitutional-right-to-do-whatever-we-want dept

For a few years now, US telecom mono/duopolies like Comcast and AT&T have been trying to claim that absolutely any government attempt to hold them accountable violates their First Amendment rights. When their lobbyists were pushing to kill FCC net neutrality rules (and FCC oversight of telecom in general), they repeatedly tried to claim the rules violated their right to free speech, despite the fact that as simple conduits they don't engage in "editorial" decisions, making the argument both flimsy and silly.

That hasn't stopped them from aggressively abusing the 1A argument constantly to see if it sticks anyway. Verizon has argued it has a First Amendment right to hand your call data over to the government. Comcast has argued its First Amendment rights were violated when it was told to stop blocking competing channels' access to its cable lineup. Charter has tried to argue that requiring it adhere to local video franchise agreements (it signed) similarly violates its free speech rights. Inversely, the industry-friendly FCC has falsely claimed community-owned and operated broadband ISPs pose a dire threat to free speech.

And as companies try to scuttle efforts to finally pass some kind of US privacy law for the internet era, this argument has popped up yet again. As you might recall, the telecom lobby convinced the GOP-held Senate to kill off some modest federal FCC privacy guidelines back in 2017. In response, much as we've seen with the net neutrality fight, numerous states have responded by trying to fill the void with an inconsistent platter of state-level privacy guidelines.

After effectively creating this problem telecom lobbyists have whined endlessly about these state laws clinging once again to the argument that it somehow violates their First Amendment right to free speech. Hoan Ton-That, the CEO of Clearview AI, has similarly been trying to claim that his company has the First Amendment right to scrape user photos from social media platforms.

Given the shaky nature of the US court system when it comes to ignoring hard logic and data (Exhibit A: both the T-Mobile Sprint and AT&T Time Warner merger approvals) it's not impossible that some courts will help prop up these shaky, self-serving arguments. But Colorado Law's Margot Kaminski and Scott Thompson at Slate have a good primer on how they probably won't:

"We are cautiously optimistic that courts won’t fall for the simplistic arguments offered by companies trying to fend off new privacy laws, in part because the Supreme Court has recently expanded its understanding of privacy harms. Companies often ignore that the above cases do empower governments to enact privacy laws when they have an interest “of the highest order” in doing so—that is, when they can articulate significant privacy harms.

Of late, the Supreme Court has recognized exactly the kinds of harms implicated by large-scale, ongoing surveillance enabled by technologies such as facial recognition, even when the surveillance is of “public” space. Such surveillance, the court acknowledged, reveals traditionally sensitive information such as your health (if you are recorded regularly visiting a doctor), your political affiliations (if you are tracked to a protest), your addictions (if you are tracked to an Alcoholics Anonymous meeting), and even your sexuality (if you are tracked to a gay bar). Additionally, surveillance over time reveals patterns in your behavior, sensitive inferences that you may not knowingly reveal at all."

Their central argument is that regulations aimed at protecting basic privacy rights are often necessary to safeguard First Amendment rights. As a result, efforts to scuttle state-level privacy efforts in states like Maine may not go all that well, given that ISPs ignore that privacy in one’s communications is central to free expression and free association:

"There is a not insignificant chance that courts will consider most of the wave of new privacy laws (such as Maine’s) to be regulation of bargains struck between consumers and companies, not regulations of speech.

...As we’ve each underscored in our research reconciling the right to privacy with the First Amendment, the two are often interdependent. Where privacy regulations advance First Amendment interests, they are on stronger legal ground against First Amendment challenges.

Keep in mind, the privacy, hacking, and security scandals we've seen to date -- even the extraordinarily dumb ones like Equifax or Cambridge Analytica -- are probably a faint echo of the privacy scandals to come. Especially if we continue down the same path of feckless regulators, flimsy antitrust enforcement and consumer protection, and a refusal to even embrace some very basic privacy and security guidelines for the internet era. As such, as even dumber scandals arise, the arguments cited above are likely to become more potent.

Filed Under: 1st amendment, free speech, privacy, telco
Companies: at&t, comcast, verizon

The US Government Is Also Looking At Increasing Domestic Surveillance To Fight The Spread Of The Coronavirus

from the big-brother-just-wants-to-make-sure-you're-healthy dept

Say hello to the coronavirus and goodbye to privacy. The government is working with a variety of tech companies -- including infamous analytics companies like Palantir -- to get a grasp on the spread of the virus. Unfortunately, this means the data citizens have generated for a variety of tech companies will become a handy way to track them and their movements, especially if they're infected or in contact with those who are.

Technology giant Palantir Inc., which was credited with helping to find Osama bin Laden, is helping the Centers for Disease Control and Prevention model the virus outbreak. Other companies that scrape public social-media data have contracts in place with the agency and the National Institutes of Health, documents show.

The push is in part being coordinated by a task force working in conjunction with the White House, and includes startups as well as tech giants such as Alphabet Inc.’s Google unit, Facebook Inc. and Amazon.com Inc. The task-force discussions involving the White House and tech companies were reported by The Wall Street Journal on Sunday.

The legal limits on what the government can grab from service providers and platforms are pretty much waived if there's a national emergency. No one's arguing the spread of the virus isn't at least a crisis. But only a few people are arguing this justifies domestic surveillance aided and abetted by an abundance of third party records. Normally, the government would have to show at least reasonable suspicion before collecting these records from third parties, but it won't even need this minimal, individualized showing if it can declare this an emergency.

Even privacy-focused legislators seem to be on board with broad harvesting of location data for this reason.

Sen. Ron Wyden, a Democrat from Oregon, is among the lawmakers who have been briefed on the discussions. In a statement, Sen. Wyden said the efforts are sensible as long as the appropriate conditions are in place. “There must be procedures to keep this information safe, to delete information once it’s no longer in use, and to ensure it isn’t used against Americans by law enforcement,” he said.

Good luck ensuring it isn't used by law enforcement. The only thing keeping them honest, for the most part, is their own honesty -- something that seems rarely an innate part of US law enforcement. Even if things appear to be above-board, parallel construction can whitewash info gathered by government agencies purportedly for tracking the spread of the coronavirus.

What we don't have at this point in time is many details on how this would happen and what constraints would be placed on data collection and use. But what little we do have isn't promising.

Public-health experts are interested in the possibility that private-sector companies could compile the data in anonymous, aggregated form, which they could then use to map the spread of the infection, according to three people familiar with the effort, who spoke on the condition of anonymity because the project is in its early stages.

First off, anonymized data is never truly "anonymized." With very little effort, data can be stripped of its anonymity to identify the people who generated the data. Second, if efforts already in place in other countries are any indication, this is only the starting point, not the entire plan. Government agencies are going to want to track infected citizens in order to ensure/enforce self-quarantining and track potentially-infected friends and acquaintances of those who've tested positive for COVID-19.

Location data is what the administration wants -- something no longer under the purview of the Third Party Doctrine thanks to the Supreme Court's Carpenter decision.

In recent interviews, Facebook executives said the U.S. government is particularly interested in understanding patterns of people’s movements, which can be derived through data the company collects from users who allow it.

Google is saying pretty much the same thing. Government officials and health experts want access to location data. At this point, the government seems willing to collect this data in aggregate form to predict trends and determine the impact of social distancing and local bans on gatherings.

An open letter to tech companies from dozens of engineers and epidemiologists suggests the government should have this data, but possibly only with the approval of platform users who would have to opt-in. It's a little disconcerting to read a call for handing over user location info to the government coupled with complimentary reference to China's surveillance state.

Apple, Google, and other mobile operating system vendors should work to provide an opt-in, privacy preserving OS feature to support contact tracing. Users who opt in could be notified in a non-identifiable way if they had been in the same spaces as subsequently identified cases, in order to enable self-quarantine, monitoring, early detection and prevention of tertiary cases. If such a feature could be built before SARS-CoV-2 is ubiquitous, it could prevent many people from being exposed. In the longer term, such infrastructure could allow future disease epidemics to be more reliably contained, and make large scale contact tracing of the sort that has worked in China and Korea, feasible everywhere.

At this point, everything is still in the planning and development stages. Google and Facebook collect tons of user info, including their locations, and it is true tracking people's movements -- even in "anonymized" form -- might slow the spread of the virus. There's a tradeoff here, one that isn't limited to this disease. The government -- without directly asking -- wants people to sacrifice some of their privacy for the benefit of the nation as a whole. But there's no expiration date on the request and there's no ensuring this will actually benefit the nation. And once the government is in, it's going to be very hesitant to step back out. There's always another emergency just over the horizon.

I'm all for a completely voluntary system that fully informs citizens who opt in what their rights are, one of which should be the right to revoke consent at any point in time. Anything else sounds like a convenient way to engage in domestic surveillance and ignore the Constitutional protections afforded to these particular third-party records. And while I appreciate tech companies' willingness to do anything they can to curb the spread of the virus, they should be asking the tough questions that need to be asked on behalf of their millions of users, rather than deciding they can contribute to the greater good of the public without asking for the public's permission.

Filed Under: coronavirus, covid-19, mission creep, privacy, surveillance, us government

Governments Around The World Are Tracking Their Citizens' Movements To Prevent The Spread Of COVID-19

from the our-new-pervasive-overlords-etc. dept

In an effort to turn an unmitigated disaster into something a bit more mitigated, governments around the world are heading towards the "drastic" end of the scale to slow down the spread of the coronavirus. Cities and everything in them have been effectively shut down. Preventing the spread of the virus depends a lot on the voluntary cooperation of citizens to self-report and self-quarantine. Meanwhile, no one has any toilet paper. What a time to be alive, at least temporarily.

How do you enforce "voluntary" quarantine without filling cities with cops and/or soldiers? You turn to the tracking devices nearly everyone carries. Extreme times/extreme measures and all that, so every bit of location data hoovered up by carriers of phones and/or viruses is now apparently fair game.

It's already happening in the countries we expect it to happen in. China is still being China, except moreso:

In China, SenseTime, a highly valued AI firm, is being deployed in multiple cities in order to identify people with elevated temperatures, as well as those who aren’t wearing face masks. On its website, the company touts its “Smart AI Epidemic Prevention Solutions.” The company calls it a “quick and effective system in screening and detecting individuals with elevated temperature in a crowd.

You don't erect a massive surveillance infrastructure if you don't plan to exploit every bit of it. This new deployment might be one of least nefarious uses of China's massive camera network, but that doesn't make it any less frightening. China's government has given itself a lot of power and every new iteration of its surveillance network shows just how pervasive its surveillance of its own citizens is.

Over in Hong Kong, every new arrival is being tracked from the moment they set foot in the country.

Hong Kong has made it mandatory for all new arrivals to wear an “electronic wristband” that links to a smartphone to provide location-tracking services, so that authorities can be sure they’re observing COVID-19 quarantine requirements.

This sounds very intrusive. But, rest assured, it actually isn't because the government has clearly explained it is not intrusive.

[T]he city-state insists its privacy commissioner has signed off on the idea because it “does not pose privacy concerns.”

Oh. OK. I guess it's not a location tracker because it does not constantly track location, only any "changes in the location." This is the equivalent of a parolee's ankle bracelet, except it's on people's wrists and escapees will be hit with fines rather than jail time. That could change in the future. In fact, it probably will if enough suspected carriers wander around too much. The government will also be making "surprise video calls" to wristband-wearers to verify they're in the places they're supposed to be.

There's no wristband system in Israel. But that's because there's something worse.

Prime Minister Benjamin Netanyahu of Israel has authorized the country’s internal security agency to tap into a vast and previously undisclosed trove of cellphone data to retrace the movements of people who have contracted the coronavirus and identify others who should be quarantined because their paths crossed.

Information harvested for supposed national security reasons is now being used to track non-security threats and everyone they've come in contact with. It's a scary new version of contact chaining that treats everyone as some sort of public health criminal for moving around the country in the proximity of other people. The plan is to sort through the data to find people who have come in contact with known carriers and send them text messages telling them to immediately isolate themselves. They will become the new "targets" and everyone they've come in contact with are the next links in the chain. And so on.

None of this was discussed with the public, who will now be receiving unsolicited texts from their government, which is using data citizens were previously unaware was being collected en masse. The consequences of ignoring the Israeli government are dire: six months in prison and the authorization of police use-of-force to break up any gatherings of ten or more people.

This virus is unusual and unpredictable. Responses from world governments have been just as unusual and unpredictable. But once a new domestic surveillance baseline is established, it's tough to roll all of it back after the virus is contained and treatable.

Filed Under: china, covid-19, hong kong, israel, privacy, surveillance, tracking

Privacy & Encryption Will Be More Important Than Ever In Wake Of Coronavirus

from the encrypt-ALL-the-things! dept

Be it Cambridge Analytica, Equifax, or wireless carrier location data, the U.S. has already faced a steady parade of privacy and security related scandals. Now as countries around the world hunker down to slow the rate of COVID-19, the problem could easily grow even larger as a chain reaction of implications make privacy, security, and tools like encryption more important than ever.

Millions of Americans are now telecommuting for the first time. As they do so, more than a few of them won't be wise enough to use basic security precautions while handling sensitive work or health related data. And as we've noted for years, services like VPNs often don't provide reliable protection, given it's hard to verify just how secure or trustworthy service owners are. Many services were already shady as hell, and even the reliable offerings may struggle under the load.

Many folks are already using the pandemic as scam fodder. As a result, the shift to home work -- and the dramatic spike in healthcare information being shoveled around the internet -- means that the battle over encryption is also more important than ever:

As with everything this pandemic is going to touch, there are layers and layers of complications here. Many popular teleconferencing services don't have particularly great privacy standards. And with no U.S. privacy law to speak of for the internet era (outside of the problematic COPPA), it shouldn't be hard to see how we might run into some additional problems. It should also be easy to see how the pandemic may provide justification for all manner of problematic privacy and security related behavior, from the war on encryption to the quest to expand domestic surveillance.

Israel, for example, has started using a previously unknown database of phone location data to help track the spread of COVID-19. The Washington Post this week indicated that both Google and Facebook (that bastion of privacy-related trust) are also working with the U.S. government to explore the use of location data to help combat the spread of the virus. Experts suggest that we should be able to walk and chew gum at the same time, including data sharing and sunset provisions into any efforts designed to battle the pandemic:

We're only going to have so much attention to go around as we worry about ourselves, our families, and our livelihoods. Unfortunately, the pandemic could easily provide cover for the steady expansion of problematic domestic surveillance efforts that continues at a pretty brisk clip, even in normal times.

Filed Under: covid-19, encryption, privacy, surveillance, tracking

Clearview Sued By Vermont Attorney General For Violating The State's Privacy Laws

from the engineering-its-own-downfall dept

For the second time in a little over 30 days, odious facial recognition tech supplier Clearview is being sued. Unlike the first lawsuit, which is a proposed class action over violations of Illinois' biometric privacy law, this one [PDF] is being filed by a government agency. The Attorney General of Vermont is seeking to permanently ban Clearview from collecting info about state residents or sell access to the info it's already collected.

The complaint alleges that Clearview AI has been collecting photos of Vermonters available on the internet – called “screen scraping” – and using artificial intelligence to “map” individual’s faces. Private businesses, individuals, and law enforcement use this data via an app that allows a user to identify a person within seconds using only a photograph. No Vermont state or local law enforcement agencies have used the app. Clearview AI collects the facial recognition data of Vermont children, as well as adults, without their notice or consent.

The complaint also alleges that Clearview AI violated Vermont’s new Data Broker Law by fraudulently acquiring data through its use of screen scraping.

The method used to compile Clearview's database of three billion images is going to make it very difficult for the company to dodge lawsuits like these. Scraping sites may be mostly legal, but Clearview doesn't provide any way to opt out of this collection. Scraping images from sites where users have granted the platform permission to publish their information doesn't mean the TOS agreement the user made with the platform magically migrates with the scraped data.

From the lawsuit:

[T]he term "publicly available" does not have any meaning in the manner used by Clearview, as even though a photograph is being displayed on a certain social media website, it is being displayed subject to all of the rights and agreements associated with the website, the law, and reasonable expectations. One of those expectations was not that someone would amass an enormous facial-recognition-fueled surveillance database, as the idea that this would be, permitted in the United States was, until recently, unthinkable.

Thus, when an individual uploads a photograph to Facebook for "public" viewing, they consent to a human being looking at the photograph on Facebook. They are not consenting to the mass collection of those photographs by an automated process that will then put those photographs into a facial recognition database. Such a use violates the terms under which the consumer uploaded the photograph, which the consumer reasonably expects will be enforced.

Clearview's database compilation relies on its violating website terms of service en masse. Sites have begun pushing back but at this point their legal options are limited to being angry about it. But some state-by-state litigation may actually have an effect, since it seems almost impossible for Clearview to comply with privacy laws governing the collection of biometric data. Selling access to the data makes it even more difficult, since there's no way for those packaged up in Clearview's database to request removal or limit access to the scraped data.

It's too late for Clearview to salvage its reputation by claiming it controls access carefully and sells only to law enforcement agencies to assist in solving crimes. That cat walked right out of the bag and over to BuzzFeed, which reported Clearview is selling its tech to private companies and governments engaged in ongoing human rights abuses. Claiming to serve a higher purpose while behaving like a bottom feeder doesn't do anything for anyone, least of all a company that hoped it would fly under the radar long enough to capitalize fully on a bunch of free photos it found scattered around the internet.

Filed Under: data broker law, facial recognition, privacy, privacy law, vermont
Companies: clearview, clearview ai

AI Company Has Access To Pretty Much Every Piece Of Surveillance Tech The State Of Utah Owns

from the good-time-was-had-by-all-surveilled dept

A stash of documents obtained from Utah government agencies has exposed another surveillance tech purveyor who's threatening to disrupt privacy for unquantified law enforcement gains. Banjo is the innocuous name the company does business under, led by a CEO sporting a ZZ Top beard and an urban camo sports coat.

The public this is going to affect wasn't cut in on the deal. But nearly everything their tax dollars pay for was. Banjo's proprietary panopticon -- with servers located on Utah government property -- draws from nearly every piece of surveillance tech already deployed by cities and law enforcement. Banjo's contribution is the algorithms it drops on top of all of this:

The state of Utah has given an artificial intelligence company real-time access to state traffic cameras, CCTV and “public safety” cameras, 911 emergency systems, location data for state-owned vehicles, and other sensitive data.

The company, called Banjo, says that it's combining this data with information collected from social media, satellites, and other apps, and claims its algorithms “detect anomalies” in the real world.

This isn't surveillance creep. This is a surveillance sprint.

Banjo has installed its own servers in the headquarters of the Utah Department of Transportation (UDOT), a civilian agency, and has direct, real-time access to the thousands of traffic cameras the state operates. It has jacked into 911 systems of emergency operations centers all over the state, according to contracts, emails, and other government documents obtained by Motherboard using public record requests, as well as video and audio recordings of city council meetings around the state that we reviewed.

There's more to it than this long list. Banjo also pulls in data from social media, autonomous vehicles, flight info, and "data signal ingestion for IoT sensors." Anything that crosses the internet or the state's government intranets is converted into data points for Banjo's thirsty software.

The state of Utah has already agreed to sprinkle Banjo's surveillance dust over all 29 counties in the state, as well as its 13 largest cities and 10 other cities that have the misfortune of being deemed "significantly relevant" to the state's spyware deployment plans.

Banjo promises a mixture of predictive policing and real-time alerts, with an eye on the worst crimes of course. Banjo's reps and executives talk a lot about how much child abduction this thing could stop -- or at least bring to an end quickly. But there's nothing on the record showing Banjo has done any crime prevention or crime solving, despite the breadth of its access and the state's explicit blessing of its unproven tech.

Banjo also literally unbelievably claims it can do all of this without engaging in massive amounts of privacy violations. It says it anonymizes all data it scoops up from dozens of sources, pointing cops at crime, rather than people. First of all, anonymization is a myth that has been debunked several times. Second of all, this:

Banjo's pitch to Utah from the beginning has been that it finds crime without identifying criminals. It looks for cars without looking for who is inside the cars. It detects riots and protests without telling cops who is at them. It detects drug use hotspots without identifying the drug user. Patton often mentions his company has patented technology to strip PII from publicly available data, but patents Motherboard found do not go into detail about how that is done.

Pitching its product, Banjo talks a lot about child abductions, mass shootings, acts of terrorism… all the things we always hear about when law enforcement wants to extend its reach and grasp. Plenty of surveillance tech has been purchased using these noble goals, only to be deployed to do normal crime stuff like seek out drug dealers and robbery suspects. Meanwhile, the sacrifices made in the name of public safety haven't resulted in net public safety gains, and mass shootings (in particular) still routinely go unthwarted, no matter how much round-the-clock surveillance is in place.

Banjo says it will save lives -- the only metric it claims to care about. So far, it can't even seem to solve crimes.

While it's still very early days for its implementation in Utah, we have no idea whether it has been useful in the real world. [Attorney General Chief of Staff Ric] Cantrell couldn't identify a single case that Banjo's technology had helped on. A public records request sent to Utah's Highway Patrol requesting any case reports in which Banjo was used returned no documents. Police departments who have signed up for Banjo told Motherboard that they have not actually used it.

While it's true the state won't know how effective Banjo is until it deploys it, that doesn't explain its willingness to deploy it all over the state before it has any idea how well it's going to work and what negative side effects turning everything into fodder for surveillance software might produce. That's incredibly irresponsible and it indicates the state clearly didn't factor residents' concerns into the equation.

Filed Under: facial recognition, law enforcement, privacy, social media, surveillance, utah
Companies: banjo

T-Mobile Cares So Much About Consumer Privacy, It's Fighting The FCC's Flimsy Fine For Location Data Sharing

from the light-wrist-slaps dept

T-Mobile, like many mobile carriers, insists in highly values consumer privacy. But that hasn't really been reflected in the company's response to ongoing SIM hijacking scandals. Nor was that dedication particularly apparent when T-Mobile (along with AT&T, Verizon, and Sprint) were all caught selling access to user location and 911 data to pretty much any nitwith with a nickel.

Last week, after a year of stonewalling, the Trump FCC announced it would be doling out some light wrist slaps to companies that were caught selling access to this data. For most of the companies, the fines they received were a tiny, tiny fraction of not only their annual revenues, but the billions made over the last decade selling access to this data to law enforcement, people pretending to be law enforcement, and even stalkers. All four of the companies also just received tens of billions on dollars from the Trump tax cuts in exchange for promises they completely flaked out on.

It would be a pittance to pay off the fine and move on, especially given this particular FCC is unlikely to engage in much follow up to either confirm data collection has actually stopped, or police access to the mountains of data already collected. But T-Mobile says it's intending to fight the fine anyway, because, you know, it cares just that much about consumer privacy and accountability:

"While we strongly support the FCC’s commitment to consumer protection, we fully intend to dispute the conclusions of this NAL and the associated fine," the company said."

So yeah, T-Mobile will "support" the FCC's "commitment to consumer protection" (which barely exists in the first place) by...(checks notes)...fighting the already feeble end result. This is, again, apparently a reflection of T-Mobile taking "consumer privacy seriously":

"We take the privacy and security of our customers’ data very seriously," said T-Mobile. "When we learned that our location aggregator program was being abused by bad actor third parties, we took quick action. We were the first wireless provider to commit to ending the program and terminated it in February 2019 after first ensuring that valid and important services were not adversely impacted."

Again, there's little chance these companies will actually leave billions in location data revenues on the table. While all four major carriers say they've stopped the practice, it's far more likely they've simply tweaked their privacy policies, renamed the collection systems, and buried them deep in some subsidiary somewhere. After all, who is going to do the legwork required to audit the entire industry's privacy and data collection practices, Ajit Pai?

Filed Under: competition, consumers, fcc, fines, privacy
Companies: t-mobile

FCC To Dole Out Some Dainty Wrist Slaps For Wireless Carrier Location Data Scandals

from the ill-communication dept

As you know by now, all four major wireless carriers have been selling access to user location data for the better part of the last decade to pretty much any nitwit with a nickel. Journalists subsequently exposed how nobody was really policing the use of this data, resulting in it being abused by law enforcement, people pretending to be law enforcement, and even stalkers. Worse perhaps, wireless carriers were even selling access to even more sensitive 911 emergency location data, something that's very clearly prohibited.

It's that last bit that probably finally forced the hand of Ajit "what broadband competition problem" Pai, who after a year of doing nothing is poised to announced that AT&T, Verizon, T-Mobile, and Sprint are likely to soon face a collective $200 million fine (warning: WSJ paywall):

"The Federal Communications Commission (FCC) will propose fines for the nation's largest telecom companies for selling the location data of their customers without consent. In all, the FCC says the carriers should pay around $200 million, according to a person familiar with the matter. The Wall Street Journal first reported the fines, and said the action includes AT&T, T-Mobile, Sprint, and Verizon."

Assuming wireless carriers don't win an appeal and the FCC follows up on the fine, that's around $50 million per company, which isn't likely to be much of a deterrent. AT&T's revenues last year topped $180 billion, and these four companies have received tens of billions in Trump tax cuts, regulatory favors (killing net neutrality, broadband privacy rules), and other perks during the last three years of the Trump administration. AT&T alone scored an estimated $42 billion from the Trump tax cuts in exchange for promises the company completely lied about delivering. Accountability has been nonexistent.

In total, $50 million is a pretty great deal given these companies likely made countless billions over the course of a decade selling access to this data. Needless to say, lawmakers like Ron Wyden released statements to journalists making it clear he wasn't particularly impressed by this regulatory theater:

"Based on today’s news reports, it seems clear Chairman Pai has failed to protect American consumers at every stage of the game – this issue only came to light after my office and dedicated journalists discovered how wireless companies shared Americans’ locations willy nilly. He only investigated after public pressure mounted. And now his response is a set of comically inadequate fines that won’t stop phone companies from abusing Americans’ privacy the next time they can make a quick buck.

"Time and again, from Facebook to Equifax, massive companies take reckless disregard for Americans’ personal information, knowing they can write off comparatively tiny fines as the cost of doing business. The only way to truly protect Americans’ personal information is to pass strong privacy legislation like my Mind Your Own Business Act to put teeth into privacy laws and hold CEOs personally responsible for lying about protecting Americans’ privacy.”

The FCC is expected to offer more details at its Friday meeting. Of particular note will be what the FCC requires carriers do with the decade-plus of consumer location records already collected, and how diligent the agency will be to ensure this doesn't continue. Knowing AT&T and Verizon pretty well, it would be unlike them to leave tens of billions in location data revenues on the table, especially given the feckless nature of this FCC. It wouldn't be all that hard to revamp and rename these programs, purge 911 data specifically from collection, then bury these new projects under layers of subsidiary deniability and obfuscation.

After all, who's really going to make sure they've learned the error of their ways? Ajit Pai? The former Verizon lawyer that has rubber stamped every fleeting desire of some of the most anti-competitive and scandal prone companies in American history?

Filed Under: ajit pai, fcc, fines, location data, privacy
Companies: at&t, sprint, t-mobile, verizon

Hoping To Combat ISP Snooping, Mozilla Enables Encrypted DNS

from the encrypt-ALL-the-things! dept

Historically, like much of the internet, DNS hasn't been all that secure. That's why Mozilla last year announced it would begin testing something called "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. Obviously, this puts a bit of a wrinkle in government, telecom, or other organizational efforts to use DNS records to block and filter content, or track and sell user activity.

As a result, a lot of these folks have been throwing temper tantrums in recent weeks.

The telecom sector, which makes plenty of cash selling your daily browsing habits, have spent much of the last year trying to demonize the Google and Mozilla efforts any way they can, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah, that's an entirely different mess). Mozilla's response to telecoms' face fanning? To first urge Congress to investigate telecom's long history of privacy abuses, then proceeding this week to enable the feature by default in the Mozilla browser.

In a blog post, Mozilla explains its thinking as such:

"At the creation of the internet, these kinds of threats to people’s privacy and security were known, but not being exploited yet. Today, we know that unencrypted DNS is not only vulnerable to spying but is being exploited, and so we are helping the internet to make the shift to more secure alternatives. We do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit."

While there's a lot of overheated rhetoric about the risk of DNS over HTTPS from the likes of big telecom and government surveillance aficionados, there are some legitimate concerns about the standard from more above-board cybersecurity professionals. They'll be quick to note there's several other points at which ISPs can still engage in data surveillance and sales. They'll also argue that DNS over HTTPS really complicates life for enterprise IT managers, and in some instances encrypted DNS could derail existing cybersecurity solutions or parental control solutions.

Mozilla says it's listening to these complaints, so it's starting slowly with a gradual roll out across the US only. The organization says Firefox will disable encrypted DNS if it conflicts with parental controls. The feature will also be disabled by default in enterprise configurations. Firefox's encrypted DNS will use Cloudflare by default, though users can switch to other encrypted DNS providers manually in their browser settings. Those curious about the particulars can dig through Mozilla's FAQ here.

Filed Under: browsers, dns, dns-over-https, encryption, firefox, privacy, snooping
Companies: mozilla

Comcast, AT&T Sue Maine Over Privacy Law, Claim It Violates Free Speech

from the ALL-the-rights-for-me,-none-of-the-rights-for-you dept

Back in 2017, the telecom industry successfully lobbied Congress to kill some modest FCC privacy rules before they could even take effect. The rules simply required that ISPs be more transparent about what data they collect and who they sell it to, requiring that consumers opt in to the sale of more sensitive location data (financial, location). From there, the telecom lobby proceeded to convince the FCC to effectively neuter its consumer protection authority almost entirely. Not only that, it successfully lobbied the FCC to try and ban states from stepping in and protecting consumers -- though the courts (so far) didn't look too kindly upon that.

In short the telecom sector lobbied to kill federal oversight, resulting in a lot of states now rushing in to try and fill the void. It then proceeded to cry like a toddler about a "discordant and fractured framework of state protections," hoping you'd ignore this was a problem the sector created.

Case in point: the telecom sector has now stepped in to sue Maine for attempting to pass a new privacy law that closely mirrors the FCC's discarded 2017 rules. According to a coalition of telecom lobbying organizations, Maine's law violates AT&T, Verizon, Comcast, and Spectrum's First Amendment rights:

"Maine cannot discriminate against a subset of companies that collect and use consumer data by attempting to regulate just that subset and not others, especially given the absence of any legislative findings or other evidentiary support that would justify targeting ISPs alone. Maine's decision to impose unique burdens on ISPs' speech—while ignoring the online and offline businesses that have and use the very same information and for the same and similar purposes as ISPs—represents discrimination between similarly situated speakers that is impermissible under the First Amendment."

Maine's law was signed by Governor Janet Mills last June, and is scheduled to take effect on July 1, 2020. The law not only requires that consumers opt in before sensitive data is collected and sold, but it also attempted to ban ISPs from charging broadband subscribers even more money to opt out of snoopvertising, something AT&T engaged in for years. Again, Maine's law, like the laws popping up in other states, wouldn't exist if the telecom sector hadn't lobbied to effectively obliterate modest federal FCC rules. And again, this is a problem the sector created by trying to have its cake and eat it too.

One of the key arguments underpinning most of the telecom sector's lobbying shenanigans of late involves one central claim: that state or federal efforts to hold giant ISPs accountable somehow violates Comcast and other ISPs' First Amendment rights. You'll recall ISPs tried to claim that net neutrality also somehow violated ISPs' free speech rights, despite the fact that as simple conduits they don't engage in "editorial" decisions, making the argument rather silly. Effectively, the industry has spent a decade trying to claim that any federal or state consumer protections violate ISPs' free speech rights and therefore shouldn't exist.

All the while, the industry falsely claims it really wants meaningful privacy guidelines. In reality, what the industry wants is either no privacy guidelines at all (pretty much what we've "enjoyed" for 20 some odd years now), or weak federal guidelines their lawyers get to write -- so flimsy and loophole filled that they don't do much of anything. Well, anything except pre-empting other better state or federal privacy laws written with something vaguely resembling a consensus.

While everybody fixates on "big tech," "big telecom" is effectively gutting all meaningful oversight of a quickly consolidating sector that was already an anti-consumer, anti-innovation, and anticompetitive mess. Gosh, wonder how that's going to turn out?

Filed Under: 1st amendment, fcc, free speech, maine, privacy, privacy laws
Companies: at&t, comcast, spectrum, verizon