Lindsey Graham's Sneak Attack On Section 230 And Encryption: A Backdoor To A Backdoor?

from the if-it-aint-broke dept

Both Republicans and Democrats have been talking about amending Section 230, the law that made today’s Internet possible. Most politicians are foggy on the details, complaining generally about “Big Tech” being biased against them (Republicans), “not doing enough” about harmful content (Democrats, usually), or just being too powerful (populists on both sides). Some have promised legislation to amend, while others hope to revoke Section 230 entirely. And more bills will doubtless follow.

Rather than get mired in the specifics about how tinkering with Section 230 could backfire, Sen. Lindsey Graham is circulating a draft bill called the “Eliminating Abusive and Rampant Neglect of Interactive Technologies Act of 2019” — the “EARN IT Act of 2019,” leaked by Bloomberg yesterday. Democratic Sen. Richard Blumenthal has apparently been involved in drafting.

At first blush, the bill may seem uncontroversial: it would create a presidential commission of experts to “develop recommended best practices for providers of interactive computer services regarding the prevention of online child exploitation conduct.” Who could argue with that? Indeed, given how little lawmakers understand online content moderation, getting analysis and recommendations from real experts about Section 230 is probably the only way out of the increasingly intractable, empty debate over the law.

But what Graham’s bill would actually do is give the Attorney General a blank check to bypass Congress in cracking down on Internet services in ways that may have little to do with child sexual abuse material (CSAM). Specifically, the bill would:

1. Amend Criminal Law & Section 230: Section 230 has never shielded operators of websites and Internet services from federal criminal prosecution for CSAM. But the Graham bill would create broad new legal risks by lowering the (actual) knowledge requirement from “knowingly” to “recklessly” (which would include an after-the-fact assessment of what the company “should have known”) and amending Section 230 to authorize both criminal prosecution and civil suits under state law. For the first time, operators could be sued by plaintiff’s lawyers in class-action suits for “reckless” decisions in designing or operating their sites/services.

2. Condition Section 230 Immunity: The commission’s (a) recommended “best practices” would quickly become (b) conditions for invoking Section 230 immunity against greatly expanded liability for CSAM — immunity so vital to the operation of many online services that (c) the conditions would be tantamount to legal mandates.

As drafted, Graham’s bill entails a shocking abandonment of the most basic principles of how administrative agencies make rules — based on the fiction that the “best practices” wouldn’t be effectively mandatory — by allowing the AG to bypass Congress on other controversial issues like mandatory age verification or even encryption. As I told Bloomberg: “The absolute worst-case scenario could easily become reality: DOJ could effectively ban end-to-end encryption.” Signal, Telegram and Whatsapp all could no longer exist in their current form. All would be required to build in backdoors for law enforcement because all could be accused of “recklessly” designing their products to make it impossible for the operators or law enforcement to stop CSAM sharing. The same could happen for age verification mechanisms. It’s the worst kind of indirect regulation. And because of the crazy way it's done, it could be hard to challenge in court.

The rhetorical premise of the “EARN IT” Act — that Section 230 was a special favor that tech companies must continually “earn” — is false. Republicans have repeatedly made this claim in arguing that only “neutral” platforms “deserve” Section 230’s protections, and Democrats likewise argue that website operators should lose Section 230’s protections if they don’t “do more” to combat disinformation or other forms of problematic speech by users.

Congress has never conditioned Section 230 in the way Graham’s bill would do. Section 230, far from being a special favor or subsidy to tech companies, was crafted because, without its protections, website operators would have been discouraged from taking active measures to moderate user content — or from hosting user-generated content altogether, often referred to as the “moderator’s dilemma.”

Here’s how Graham’s monstrous, Rube-Goldberg-esque legal contraption would work in practice. To understand which services will be affected and why they’d feel compelled to do whatever DOJ commands to retain their Section 230 immunity, we’ll unpack the changes to criminal law first.

Step #1: Expanding Legal Liability

Graham’s bill would amend existing law in a variety of ways, mostly paralleling SESTA-FOSTA: while the 2018 law expanded the federal prostitution law (18 U.S.C. § 1591, 2421A), the Graham bill focuses on “child exploitation” imagery (child porn). (Note: To help prosecutors prosecute sex trafficking, without the need for any amendment to Section 230, TechFreedom supported toughening 18 U.S.C. § 1591, 2421A to cover trafficking of minors when FOSTA was a stand-alone bill — but opposed marrying FOSTA with SESTA, the Senate bill, which unwisely amended Section 230.) Specifically, the Graham bill would:

1. Create a new civil remedy under 18 U.S.C. § 2255 that extends to suits brought against an “interactive computer service” for reckless § 2252 violations;

2. Amend Section 230(e) to exclude immunity for state criminal prosecution for crimes coextensive with § 2252; and

3. Amend Section 230(e) to exclude immunity for civil causes of action against an “interactive computer service” pursuant to other state laws if the underlying claim constitutes a violation of § 2252 (or by operation of § 2255(a)(1)). Most notably, this would open the door to states to authorize class-action lawsuits brought by entrepreneurial trial lawyers — which may even be a greater threat than criminal prosecution since the burden of proof would be lower (even though, in principle, a civil plaintiff would have to establish that a violation of criminal law had occurred under Section 2252).

The Graham bill goes further than SESTA-FOSTA in two key respects:

1. It would lower the mens rea (knowledge) requirement from “knowingly” to “recklessly,” making it considerably easier to prosecute or sue operators; and

2. Allow for state criminal and civil prosecution for hosting child exploitation imagery that could violate § 2252).

In a ploy to make their bill seem less draconian, SESTA-FOSTA’s sponsors loudly proclaimed that they preserved “core” parts of Section 230’s immunity. Graham will no doubt do the same thing. Both bills leave untouched Section 230(c)(2)(A)’s immunity for “good faith” content removal decisions. But this protection is essentially useless against prosecutions for either sex trafficking or CSAM. In either case, the relevant immunity would be Section 230(c)(1), which ensures that ICS operators are not held responsible as “publishers” for user content. The overwhelming majority of cases turn on that provision — and that is the provision that Graham’s bill conditions on compliance with the AG’s “best practices.”

Step #2: How a “Recommendation” Becomes a Condition to 230

The bill seems to provide an important procedural safeguard by requiring consensus — at least 10 of the 15 commissioners — for each recommended “best practice.” But the chairman (the FTC chairman or his proxy) could issue his own “alternative best practices” with no minimum level of support. The criteria for membership ensure that he’d be able to command at least a majority of the commission, with the FTC, DOJ and Department of Homeland Security each getting one seat, law enforcement getting two, prosecutors getting two more — that’s seven just for government actors — plus two more for those with “experience in providing victims services for victims of child exploitation” — which makes nine reliable votes for “getting tough.” The remaining six Commissioners would include two technical experts (who could turn out to be just as hawkish) plus two commissioners with “experience in child safety” at a big company and two more from small companies. So the “alternative” recommendations would almost certainly command a majority anyway.

More importantly, it doesn’t really matter what the Commissioners recommend: the Attorney General (AG) could issue a radically different set of “best practices” — without public comment. He need only explain why he modified the Commission’s recommendations.

What the AG ultimately issues would not just be recommendations. No, Graham’s bill would empower the AG to enact requirements for enjoying Section 230’s protections against a range of new civil lawsuits and from criminal prosecutions related to “child exploitation” or “child abuse” — two terms that the bill never defines.

Step #3: How Conditioning 230 Eligibility Amounts to a Mandate

Most websites and services, especially the smallest ones, but even the largest ones, simply couldn’t exist if their operators could be held civilly liable for what their users do and say — or if they could be prosecuted under an endless array of state laws. But it’s important to stress at the outset that Section 230 immunity isn’t anywhere near as “absolute” or “sweeping” as its critics claim. Despite the panic over online sex trafficking that finally led Congress, in 2018, to pass SESTA-FOSTA, Section 230 never hindered federal criminal prosecutions. In fact, the CEO of Backpage.com — the company at the center of the controversy over Section 230 — pled guilty to facilitating prostitution (and money laundering) the day after SESTA-FOSTA became law in April 2018. Prosecutors didn’t need a new law, as we stressed at the time.

Just as SESTA-FOSTA created considerable new legal liability for websites for sex trafficking, Graham’s bill does so for CSAM (discussed below) — which makes Section 230 an even more critical legal shield and, in turn, makes companies more willing to follow whatever requirements might be attached to that legal shield.

How Broad Could the Bill’s Effects Be?

Understanding the bill’s real-world effects depends on three separate questions:

1. What counts as “child exploitation” and “child abuse?”

2. Which companies would really need Section 230 protection against new, expanded liability for CSAM?

3. What could be the scope of the AG’s conditions to 230 liability? Must they be related to conduct covered by Section 230?

What Do We Mean by “Child Exploitation” and “Child Abuse?”

The bill’s title focuses on “child exploitation” but the bill also repeatedly talks about “child abuse” — without defining either term. The former comes from the title of 18 U.S.C. § 2252, which governs the “visual depiction involves the use of a minor engaging in sexually explicit conduct” (CSAM). The bill directly invokes that bedrock law, so one might assume that’s what Graham had in mind. There is a federal child abuse law but it’s never mentioned in the bill.

This lack of clarity becomes a significant problem because, as discussed below, the bill is so broadly drafted that the AG could mandate just about anything as a condition of Section 230 immunity.

Which Websites & Services Are We Talking About?

Today, every website and Internet service operator faces some legal risk for CSAM. At greatest risk are those services that allow users to communicate with each other in private messaging or groups, or to share images or videos, because this is how CSAM is most likely to be exchanged. Those who traffic in CSAM are known to be highly creative in finding unexpected places to interact online — just as terrorist groups may use chat rooms in video games to hold staff meetings.

It’s hard to anticipate all the services that might be affected by the Graham bill, but it’s safe to bet that any messaging, photo-sharing, video-hosting or file-sharing tool would consider the bill a real threat. At greatest risk would be services that cannot see what their users do because they offer end-to-end encryption. They risk being accused of making a “reckless” design decision if it turns out that their users share CSAM with each other.

What De Facto Requirements Are We Talking About?

Again, Graham’s bill claims a narrow scope: “The purpose of the Commission is to develop recommended best practices for providers of interactive computer services regarding the prevention of online child exploitation conduct.”

The former term (ICS) is the term Section 230 uses to refer to covered operators: a service, system or software that “provides or enables computer access by multiple users to a computer server.” You might think the Graham bill’s use of this term means the bill couldn’t be used to force Apple to change how it puts E2EE on iPhones — because the iPhone, unlike iMessage, is not an ICS. You might also think that the bill couldn’t be used to regulate things that seem unrelated to CSAM — like requiring “fairness” or “neutrality” in content moderation practices, as Sen. Hawley has proposed and Graham has mentioned repeatedly.

But the bill won’t actually stop the AG from using this bill to do either. The reason is the same in both cases: this is not how legislation normally works. In a normal bill, Congress might authorize the Federal Communications Commission to do something — say, require accessibility features for disabled users of communications services. The FCC could then issue regulations that would have to be reasonably related to that purpose and within its jurisdiction over “communications.” As we know from the 2005 American Library decision, the FCC can’t regulate after the process of “communications” has ended — and thus had no authority to require television manufacturers to build in “broadcast flag” technology on their devices to ensure that, once the device received a broadcast signal, it could not make copies of the device unless authorized by the copyright holder.

But that’s not how Graham’s bill would work. A company that only makes devices, or installs firmware or operating system on them, may not feel compelled to follow the AG’s “best practices” because it does not operate an ICS, and, as such, could not claim Section 230 content (and is highly unlikely to be sued for what its users do anyway). But Apple or Google, in addition to doing these things, also operate multiple ICSes. Nothing in the Graham bill would stop the AG from saying that Apple would lose its Section 230 immunity for iMessage, iCloud or any ICS if it does not build in a backdoor on iPhones for law enforcement. Apple would likely comply. And even if Apple resists, smaller companies with fewer legal resources would likely cave under pressure.

In fact, the Graham bill specifically includes, among ten “matters addressed,” the “retention of evidence and attribution or user identification data relating to child exploitation or child sexual abuse, including such retention by subcontractors” — plus two other prongs relating to identifying such material. While these may appear to be limited to CSAM, the government has long argued that E2EE makes it impossible for operators either to identify or retain CSAM — and thus that law enforcement must have a backdoor and/or that operators must be able to see everything their users do (the opposite of E2EE).

Most of the “matters addressed” pertain to child exploitation (at least in theory) but one other stands out: “employing age limits and age verification systems.” Congress tried to mandate minimum age limits and age verification systems for adult materials back in the Child Online Protection Act (COPA) of 1998. Fortunately, that law was blocked in court in a protracted legal battle because adults have a right to access sensitive content without being subjected to age verification — which generally requires submitting a credit card, and thus necessarily entails identifying oneself. (The court also recognized publishers’ rights to reach privacy-sensitive users.)

Rep. Bart Stupak’s (D-MI) ‘‘Online Age Verification and Child Safety Act’’ of 2009 attempted to revive age verification mandates, but died amidst a howl of protest from civil libertarians. But, like banning E2EE, this is precisely the kind of thing the AG might try to mandate under Graham’s bill. And, critically, the government would argue that the bill does not present the same constitutional questions because it is not a mandate, but rather merely a condition of special immunity bestowed upon operators as a kind of subsidy. Courts should protect us from “unconstitutional conditions,” but given the state of the law and the difficulty of getting the right parties to sue, don’t count on it.

These “matters addressed” need not be the only things the Commission recommends. The bill merely says the “[t]he matters addressed by the recommended best practices developed and submitted by the Commission … shall include [the ten things outlined in the bill].” The Commission could “recommend” more — and the AG could create whatever conditions to Section 230 liability he felt he could get away with, politically. His sense of shame, even more than the courts or Congress, would determine how far the law could stretch.

It wouldn’t be hard to imagine this AG (or AGs of, sadly, either party) using the bill to reshape moderation practices more generally. Republicans increasingly argue that social media are “public fora” to which people like Alex Jones or pseudo-journalistic outlets like Gateway Pundit have First Amendment rights of access. Under the same crazy pseudo-logic, the AG might argue that, the more involved the government becomes in content moderation through whatever conditions he imposes on Section 230 immunity, the more essential it is that website operators “respect the free speech rights” of users. Ultimately, the Commission would operate as a censorship board, with murky but enormous powers — and the AG would be the ultimate censor.

If this sounds like a crazy way to make law, it is! It’s free-form lawmaking — not “we tell what you must do” (and you can raise constitutional objections in court) but rather “we’re not gonna tell you what to do, but if you don’t want to be sued or prosecuted under vague new sex trafficking laws, you’d better do what we tell you.” Once the Commission or the AG strays from “best practice” recommendations that strictly related to CSAM, then the floodgates are open to politically motivated back-door rulemaking that leave platforms with no input and virtually no avenue for appeal. And even if the best practices are related to CSAM, the way the Commission makes what amounts to law will still be unprecedented, secretive, arbitrary and difficult to challenge in court.

Other Key Aspects of How the Bill Would Work

The bill would operate as follows:

• The bill allows 90 days Commissioners to be appointed, 60 days for the Commission’s first meeting, and 18 months to make its first set of recommendations — 25 months in total. The leaked draft leaves blankr the window in which the AG must issue his “best practices.”

• Those would de facto requirements would not become legally valid until publication in the Federal Register — which usually takes a month but which sometimes drags out indefinitely.

• Operators would have 1 year to submit a written certification of their compliance.

• If, say, the next administration drags its feet and the AG never issues “best practices,” the bill’s amendments to Section 230 and criminal law go into effect four years after enactment — creating sweeping new liability for CSAM and removing Section 230’s protections.

• The Commission and AG will go through the whole farce again at least every two years.

The bill also grants DOJ broad subpoena power to determine whether operators are, in fact, living up to their certification of compliance with the AG’s “best practices.” Expect this power to be used aggressively to turn tech companies inside out.

Conclusion

In the end, one must ask: what problem is the Graham bill trying to solve? Section 230 has never prevented federal criminal prosecution of those who traffic in CSAM — as more than 36,000 individuals were between 2004 and 2017. Website operators themselves already have enormous legal liability for CSAM — and can be prosecuted by the Department of Justice for failing to cooperate with law enforcement, just as Backpage executives were prosecuted under Federal sex trafficking before SESTA-FOSTA (and plead guilty).

The Graham bill seems to be designed for one overarching purpose: to make services that offer end-to-end encryption effectively illegal, and ensure that law enforcement (and the intelligence agencies) has a backdoor into every major communications platform.

That would be outrageous enough if it were done through a direct mandate, but doing it in the roundabout way Graham’s bill proposes is effectively a backdoor to a backdoor. Unfortunately, that doesn’t mean the bill might not suddenly move quickly through Congress, just as SESTA did. Be ready: the “Cryptowars” may finally turn very, very hot.

Filed Under: encryption, fosta, lindsey graham, privacy, section 230, sesta

Lawsuit Says Clearview's Facial Recognition App Violates Illinois Privacy Laws

from the OR-DOES-IT-[dramatic-side-eye] dept

Clearview has gathered a whole lot of (negative) attention ever since its exposure by Kashmir Hill for the New York Times. The facial recognition app developed by Hoan Ton-That (whose previous app was a novelty that allowed users to transpose President Trump's distinctive hairdo on their own heads) relies on scraped photos to perform its questionable magic. Rather than limiting themselves to law enforcement databases, cops can upload a photo and search a face against pictures taken from dozens of websites.

The company's marketing materials claim cops have access to 3 billion face photos via Clearview -- all pulled from public accounts linked to names, addresses, and any other personal info millions of unwitting social media users have uploaded to the internet.

Its marketing materials also claims it has been instrumental in solving current crimes and generating suspect lists for cold cases. So far, very few of these claims seem to be based on fact. That's only one of the company's issues. Another is the heat it's drawing from companies like Twitter and Facebook who claim photo scraping violates their terms of service. That's one for the courts and it's only a matter of time before someone sues.

Someone has sued, but it's not an affected service provider. It's some guy from Illinois trying to fire up a class action lawsuit against the company for violating his home state's privacy laws. Here's Catalin Cimpanu of ZDNet with the details:

According to a copy of the complaint obtained by ZDNet, plaintiffs claim Clearview AI broke Illinois privacy laws.

Namely, the New York startup broke the Illinois Biometric Information Privacy Act (BIPA), a law that safeguards state residents from having their biometrics data used without consent.

According to BIPA, companies must obtain explicit consent from Illinois residents before collecting or using any of their biometric information -- such as the facial scans Clearview collected from people's social media photos.

"Plaintiff and the Illinois Class retain a significant interest in ensuring that their biometric identifiers and information, which remain in Defendant Clearview's possession, are protected from hacks and further unlawful sales and use," the lawsuit reads.

Hmm. This doesn't seem to have much going for it. And, believe it or not, it's not a pro se lawsuit. Whether it's possible to violate a privacy law by scraping public photos remains to be litigated, but it would seem the word "public" is pretty integral here. Unless Clearview found some way to scrape photos not published publicly, the lawsuit is dead in the water.

It shouldn't take too long for a judge to declare public and private legally contradictory. This lawsuit was composed by a member of the bar, but it reads more like a Facebook note the lawyer published accidentally. From the lawsuit [PDF]:

Without obtaining any consent and without notice, Defendant Clearview used the internet to covertly gather information on millions of American citizens, collecting approximately three billion pictures of them, without any reason to suspect any of them of having done anything wrong, ever.

Wat? Just because Clearview is aggressively pitching LEOs doesn't mean Clearview can only scrape photos of people it suspects of wrongdoing. Yes, it's disturbing Clearview has decided to make its stalker-enabling AI available to people who can hurt, maim, jail, and kill you, but there's nothing on any law book that says collecting pictures of faces can only be done if the people are probably criminals -- even if the targeted end users of this software are people who go after criminals.

Putting it in a sworn document doesn't make it any less ridiculous. But it does get more ridiculous.

[A]lmost none of the citizens in the database has ever been arrested, much less been convicted. Yet these criminal investigatory records are being maintained on them, and provide government almost instantaneous access to almost every aspect of their digital lives.

Facebook is collecting photos of people, almost none of which have been criminally charged. They reside in Facebook's database. Facebook is publicly searchable, and public profiles can be searched for photos, even by law enforcement officers. Is Facebook breaking state law by "collecting" photos of innocent people? No rational person would argue that it is. And yet, this is the same argument and it's no less stupid just because an actual lawyer is involved.

Look, I also don't want Clearview pushing this "product," much less to people with the power to do incredible amounts of damage to anyone the AI mistakes for a criminal. But this isn't going to fix anything. The lawsuit makes better points about Clearview's end of the deal, which makes it easier for it to look over law enforcement's shoulder. Since Clearview hosts all the pictures on its own servers, it can see what cops are looking for and do its own digging into the personal lives of anyone cops might be thinking about targeting. That's an ugly byproduct of this service and Clearview hasn't said anything about siloing itself off from government queries.

The claims in this suit are almost certain to fail. Clearview streamlines processes cops can perform on their own, like reverse image searches and browsing of social media accounts. Actions you can perform one person at a time without violating the Constitution (or state law), you can most likely do in bulk. For now. A more realistic approach would be to take edge cases to the Supreme Court, which has been more receptive to expanding the boundaries of citizens' expectations of privacy in the digital era. This lawsuit may raise limited awareness about Clearview (and discovery could be very interesting) but it's not going to end Clearview's scraping or deter law enforcement from using it. And it's certainly not going to earn a payout for the plaintiff.

Filed Under: facial recognition, illinois, privacy, privacy law
Companies: clearview, clearview ai

Puerto Rico's Justice Department Demanded Info From Facebook About Journalists Who Livestreamed Protests

from the not-how-that-works dept

Historically, the DOJ hasn't really let the First Amendment stand in the way of its investigations. In very recent history, the FBI has targeted journalists to hunt down leakers, and has impersonated journalists during investigations. While the DOJ and FBI have dealt with some limited repercussions due to their targeting of First Amendment activities (which includes targeting Muslims because they're Muslims), it really hasn't promised to stop doing this. Nor has it been told to stop doing this. Instead, the DOJ has simply made it slightly more difficult for investigators to violate people's rights.

The Intercept has done some investigating of its own and discovered the FBI actively engaged in First Amendment violations for years during its partnership with Puerto Rican law enforcement agencies.

For decades, Puerto Rico’s police department operated an intelligence unit dedicated to spying on dissidents. With the knowledge of the FBI, police officers created a file, known as a carpeta, for anyone who could be construed as a supporter of Puerto Rican independence or other environmental or labor causes. Officers recruited neighbors, friends, and relatives to collect information about those targeted, and planted rumors that led to divorce, job loss, and irreparable discord within communities and families.

75,000 of these files were created. This secret surveillance was finally revealed in 1987 and was ruled unconstitutional in 1988 by a Puerto Rican court. That should have ended it. Instead, the surveillance of First Amendment-protected activities is alive and well, headed by the island's Justice Department. Seven students are facing charges related to a nonviolent anti-austerity protest held in 2017. To locate the suspects it wanted to charge, the Justice Department targeted the student publications that streamed footage of the demonstration.

The documents released to defense attorneys provide... evidence of a broad and invasive hunt for prosecutable crimes related to the protests. An agent from the cybercrimes unit of Puerto Rico’s Justice Department sought a search warrant for the records of virtually every Facebook interaction over a 72-hour period with the three publications that livestreamed the protest. The agent obtained private messages with the publications’ followers and detailed information about the student journalists who managed the pages.

The warrant demanded everything. It asked Facebook to hand over searches performed by page administrators, any content that had been deleted, GPS coordinates for posts, IMSI numbers from associated phones, and billing records. The agent working for the Justice Department claimed this was a normal thing to do during an investigation of an incident where no one was arrested, saying all this was needed to collect "evidence" of supposed criminal activity.

Again, the protest being investigated resulted in only a small amount of property damage and zero arrests. Only in hindsight did Puerto Rican law enforcement decide some people needed to be prosecuted and, bizarrely, decided to start this investigation by demanding information about journalists who did nothing more than record the demonstration.

Unfortunately, this sort of thing seems to be increasing, rather than being relegated to law enforcement agencies' pasts. The protests that greeted Trump's inauguration did result in property damage and violence, but the investigation started with broad demands for data on the 1.2 million visitors to a protest group's website.

This investigation also involved a protest, one that lasted only a half-hour, and resulted in a broken glass door and some damaged furniture. This led to an investigation where 1,553 pages of information about student journalists were handed over to the Justice Department by Facebook. And for what? To investigate people who weren't even participating in the protest? To give the government evidence it doesn't even appear to be interested in using in this case?

Collateral damage to rights is something to be taken seriously. Targeting one First Amendment activity (protesting) through the Facebook pages of another First Amendment activity (journalism) is pretty much the worst way to investigate anything. In this case, the obvious problems were made worse by the government's inability (or unwillingness) to narrow the scope of data demands. And the demand for info should never have been approved by any level of oversight (judicial or otherwise) without more restrictions being put in place.

Filed Under: 1st amendment, doj, fbi, investigations, journalism, privacy, protests, puerto rico, surveillance
Companies: facebook

Verizon Launches New Private Search Engine In Hopes You've Forgotten Its Terrible Track Record On Privacy

from the ill-communication dept

We've noted for some time now how Verizon desperately wants to pivot from dull old broadband provider to sexy, Millennial-focused, video advertising juggernaut. To accomplish this task, Verizon acquired both Yahoo and AOL, smushed them together, then hoped this would be enough to compete with the likes of Google and Facebook. The effort distracted the company from upgrading or repairing much of its fixed-line broadband footprint, since investing in networks isn't profitable enough, quickly enough, for many on Wall Street.

But Verizon's pivot hasn't been going so well. The company's Go90 video platform, which was supposed to be the cornerstone of the company's effort, recently fell flat on its face after Verizon spent $1.2 billion on the effort. And the company's Oath ad network, the combination of AOL and Yahoo, hasn't been doing much better.

Undaunted, Verizon's back again with a new effort nobody asked for. The company this week launched a new privacy-centric browser it's calling OneSearch. According to a Verizon press release, this is all just part of Verizon's "commitment to transparency and privacy," and a reflection of the way the company has led the industry on privacy "for decades":

"In support of our commitment to trust and transparency, we are excited to launch OneSearch, an innovative new online search experience built for privacy-minded searchers...This is in line with our strong commitment to lead the industry over the last couple decades,” added Albers. “We are excited to evolve further, along with our partners and users, delivering a brand-new, privacy-minded experience for the search ecosystem."

There's clearly some awareness on Verizon's part its brand is a bit toxic on this subject, as you can't find any mention that this is even a Verizon effort outside of the privacy policy. Superficially, the engine (which largely just pulls from Bing results) works as intended, limiting ad trackers and encrypting users' URL and search queries on demand. The problem is that many of Verizon's other promises (like its promise not to use the engine to build detailed profiles on you) requires some significant trust in Verizon, a company that has, well, the exact opposite of that:

"In 2016, Verizon struck a $1.35 settlement with the FCC for modifying wireless user data packets to covertly track users around the internet without telling them. It took two years for security researchers to even identify what Verizon was doing, and several more before Verizon finally let users opt out of being tracked in such a fashion.

Verizon has also found itself at the center of a privacy scandal involving consumer location data, which has been hoovered up and sold to a laundry list of often dubious third parties for the better part of the last decade. While Verizon has promised that it stopped collecting such data, that claim has yet to be independently verified by state or federal regulators."

That's before you even get to Verizon's ultra-cozy, no questions asked relationship with the NSA, which eroded consumer trust even further.

Verizon has also lobbied tirelessly to prevent anybody from holding it accountable for these violations. In 2017, Verizon lobbied aggressively to convince Congress to kill some modest broadband privacy rules at the FCC (requiring more transparency over what data is collected and sold) before they could even take effect. Later that same year they successfully lobbied the Trump FCC to effectively neuter its oversight of broadband providers entirely, creating a consumer protection vacuum. Verizon then lobbied to ban states from filling that vacuum and protecting consumers.

Verizon, of course, is trying to get out ahead of renewed calls for federal and state privacy laws, which wouldn't be occurring in the first place if Verizon hadn't been such a reckless jackass on the privacy front. Like countless other companies worried about these laws, Verizon is trying to fix its image as a bad actor on the privacy space ("look mom, privacy laws aren't needed because we're a model citizen!"), in the process hoping most of you have the memory of a goldfish.

Granted Verizon's new project has another major obstacle: Verizon itself. Nearly every time Verizon tries to wander outside of its core competency (lobbying the government to crush competition and running networks) it fails (see: Go90, its app store, its ISIS payment platform, Sugarstring tech news site, etc.) because as a government-pampered mono/duopolist, competition, adaptation, and innovation are largely alien constructs.

Filed Under: competition, onesearch, privacy, search
Companies: verizon

Bad Ideas: Raising The Arbitrary Age Of Internet Service 'Consent' To 16

from the want-to-piss-off-high-schoolers? dept

We all know various ideas for "protecting privacy online" are floating around Congress, but must all of them be so incredibly bad? Nearly all of them assume a world that doesn't exist. Nearly all of them assume an understanding of "privacy" that is not accurate. The latest dumb idea is to expand COPPA -- the Children's Online Privacy Protection Act -- that was put in place two decades ago and has been a complete joke. COPPA's sole success is in getting everyone to think that anyone under the age of 13 isn't supposed to be online. COPPA's backers have admitted that they used no data in creating and have done no research into the effectiveness of the law. Indeed, actual studies have shown that COPPA's real impact is in having parents teach their kids its okay to lie about their age online in order to access the kinds of useful services they want to use.

The "age of consent" within COPPA is 13 -- and that's why a bunch of sites claim you shouldn't use their site if you're under that age. Because if a site is targeting people under that age, then it has to go through extensive COPPA compliance, which most sites don't want to do. The end result: sites say "don't sign up if you're under 13" and then lots of parents (and kids) lie about ages in order to let kids access those sites. It doesn't actually protect anyone's privacy.

So... along comes Congress and they decide the way to better protect privacy online is to raise that "age of consent" to 16.

The "Preventing Real Online Threats Endangering Children Today Act" is sponsored by Republican Rep. Tim Walberg of Michigan and Democratic Rep. Bobby Rush of Illinois.

The legislation would also require parental consent before companies can collect personal data like names, addresses and selfies from children under 16 years old. That's up from 13 years old under the 1998 Children's Online Privacy Protection Act.

Because we all know that teenagers are always truthful online and, dang, are they going to totally love the idea that they need their parents' permission to use 99% of the internet. That's really going to solve the problems now, right?

Of course not. It's just going to teach more kids to lie about their birth dates when they sign up for internet accounts. Or, alternatively, it will overly punish the few honest kids who refuse to sign up for accounts until they're 16. But, hey, why should Congress care about that when they're "protecting the children."

Filed Under: bobby rush, congress, coppa, internet, kids, lying, privacy, tim walberg

Chrome's Move To Stomp Out Third Party Cookies? Good For Privacy, Good For Google's Ad Business... Or Both?

from the people-are-so-bad-at-systems-thinking dept

We've talked in the past how efforts solely focused on "protecting privacy" without looking at the wider tech ecosystem and the challenges its facing may result in unintended consequences, and now we've got another example. Google has announced that it's beginning a process to phase out support for third-party cookies in Chrome. Looking at this solely through the lens of privacy, many privacy advocates are celebrating this move, saying that it will better protect user privacy. But... if you viewed it from a more competitive standpoint, it also does much to give Google significantly more power over the ad market and could harm many other companies. Former Facebook CSO, Alex Stamos' take is pretty dead on here:

A win for privacy may be a loss for competition -- and nearly every big regulatory effort to "deal with" big internet companies is going to play right into those companies' hands.

For years I've been talking about how we need to view privacy as a series of tradeoffs, or any attempt to regulate privacy will go badly. Here, this is even pre-regulation, but just based on the nature of the public narrative that third party cookies must obviously be bad. They can be, but not always. And the end result here is that the "trade off" for protecting more privacy is giving more of the ad market to Google. I'm guessing that most privacy advocates would argue that they don't want to do that. But if you look solely through the lens of 3rd party cookies and no further -- that's what you get.

Filed Under: 3rd party cookies, chrome, competition, cookies, privacy, tradeoffs
Companies: google

Senator Wyden Wants Paid Ad Blocking Whitelists Investigated

from the malleable-integrity dept

For years, journalists have highlighted how ad blocking companies have slowly but surely been compromising their ethics -- and products -- to make an extra buck. Several years ago you'll recall that numerous ad blocking companies were busted letting some companies' ads through their filters if they were willing to pay extra. Others collect and monetize "anonymized" data that's gleaned from what ads you're receiving and which ones you're blocking (recall that studies repeatedly have shown that anonymized data is not at all anonymous).

Enter Oregon Senator Ron Wyden, who, this week, sent a letter to the FTC (pdf, hat tip The Verge) urging some greater scrutiny of the sector:

"Hundreds of millions of consumers around the world have downloaded and installed software tools that purport to block online ads. In turn, the largest ad companies--including Google, Amazon, Microsoft and Verizon Media--have quietly paid millions of dollars to some of the largest ad blocking software companies in order to be able to continue to track and target consumers with ads.

Much like VPN companies who promise security and privacy but then hoover up your personal data, it's an erosion of consumer trust to promise a product that's doing the opposite of what it claims while not being transparent about it. While ad blockers are maligned by many sites, they're a natural evolution of the internet's insistence on pushing its luck with terrible, performance and security-eroding ads. So if they're going to be viewed as essential security and privacy tools, Wyden suggests they should be more up front about behavior like this:

"Eyeo, the German company that makes Adblock Plus, operates and "Acceptable Ads" program in which it whitelists advertisers that agree to prohibit pop-ups and other types of annoying ads. Eyeo requires the largest internet advertising companies to pay 30% of their revenue from ad blocking users to be included in this program. In October of 2015, Eyeo announced that it had opened its acceptable ads program to competing ad blockers, enabling competitors to use Eyeo's whitelist and receive payments from the major ad companies. The same day, AdBlock, another popular ad blocker, revealed that it had been sold to an anonymous buyer and would be joining the Acceptable Ads program. AdBlock then automatically "upgraded" millions of AdBlock users, without their affirmative consent, into tracking and targeting by major ad companies that paid to be included in Eyeo's whitelist."

In short what began as a sector responding ethically to the rise in terrible ads has been co-opted by the ad industry itself via cash and consolidation, without being transparent about its "evolving" relationship with advertisers. Wyden suggests the failures of transparency and notification here are likely illegal under federal law, and the sector should be prompted to, at the very least, make these relationships and product limitations clear to the end user.

Filed Under: ad blocking, data, filters, ftc, pay for play, privacy, ron wyden, whitelists

DHS Move Ahead With Plan To Harvest DNA Samples From Nearly Everyone Detained By ICE And CBP

from the don't-forget-to-pack-your-saliva dept

Looks like everyone roaming across the board is going to become a source of info for the US government. The DHS has already rolled out facial recognition at international airports and additional biometric collections elsewhere. The Fourth Amendment's near-nonexistence at the border has led to a steadily-increasing number of invasive device searches. Visa applicants and other long-term visitors are being forced to turn over social media information (including passwords) during the application process.

Now, the DHS is hoping to collect DNA from nearly every immigrant it has in custody. The DHS first pitched this idea back in October, hoping to strike the lone exemption keeping it from collecting samples from the hundreds of thousands of people crossing southern borders every year.

The previous administration said it simply wasn't feasible to collect DNA from every detainee, especially those rounded up near southern borders. This administration says it's no longer a logistical problem, so it should be allowed to collect it from everyone detained by ICE or the CBP.

[S]ubsequent developments have resulted in fundamental changes in the cost and ease of DNA-sample collection. DNA-sample collection from persons taken into or held in custody is no longer a novelty. Rather, pursuant to the mandate of § 28.12(b), it is now carried out as a routine booking measure, parallel to fingerprinting, by Federal agencies on a government-wide basis.

The rule change removes the logistics exemption, effectively removing the power to make judgment calls on DNA collection from the DHS and placing it in the hands of the Attorney General. Presumably, Bill Barr will be far less likely to exempt any immigrants from this DNA collection, no matter how much of a burden it places on the agencies performing the collection.

The change is now in effect and the DHS is moving forward with its expanded DNA collection.

The U.S. government on Monday launched a pilot program to collect DNA from people in immigration custody and submit it to the FBI, with plans to expand nationwide.

In Detroit, people as young as 14 will be subject to DNA collection.

The information would go into a massive criminal database run by the FBI, where it would be held indefinitely. A memo outlining the program published Monday by the Department of Homeland Security said U.S. citizens and permanent residents holding a “green card” who are detained could be subject to DNA testing, as well as asylum seekers and people entering the country without authorization. Refusing to submit DNA could lead to a misdemeanor criminal charge, the document said.

It will take more than a detention to collect DNA from US persons and lawful permanent residents, so that's not an entirely accurate synopsis of the DHS's memo [PDF]. US persons and lawful residents will have to be under arrest or facing criminal charges to be subjected to the DNA collection.

But it does change the scope of the collection, which will now include as many immigrants as possible, even if they're crossing at heavily-trafficked areas of the border. It also means the DHS is creating additional logistical challenges under the theory that filling an FBI database with non-criminals will make it easier to apprehend criminals.

The DHS expects this to cost an additional $3-5 million a year, including the $5.38 the FBI spends for each DNA kit. Processing is another matter -- the DHS did not address this cost in its proposal other than saying the FBI "won't charge" the DHS for processing. This is an especially meaningless assurance. Taxpayers will still be paying for the gratis processing the FBI will be performing. There will just be less paperwork involved.

Even if it's cost-effective, it's still mostly useless. Most of the DNA collected will be linked to people who did nothing more than attempt to cross a border. It puts more needles in the FBI's haystack under the theory it might result in the occasional apprehension of a dangerous individual. Even the DHS believes the collection won't do much to ensure the worst of the worst aren't returned to general population.

The DHS memo acknowledged that the DNA its agents collect may not be immediately useful. Agents plan to take saliva swabs of detained people, then mail them to the FBI. By the time the results are processed, the memo said, the people in question may have already been released, deported or transferred to another federal agency.

Useful or not, the collected DNA belongs to the US government for life. The government has authorized DNA collection on detainees as young as 14 and can hold onto the info indefinitely. In practical terms, this means CBP and ICE will be taking DNA samples from children because agents generally decide how old immigrant minors are, rather than relying on produced documents or statements from detainees and family members. If they really want the sample, they'll just declare someone to be 14 years old.

Maybe the ultimate goal is to make coming to America just not worth the hassle. The government's thirst for data is never quenched. Every so often the public may make it take a step back from the fire hose, but it will always come back for more.

Filed Under: cbp, dhs, dna samples, ice, privacy

UL Pushes Security Standards For The Internet Of Broken Things

from the internet-of-very-broken-things dept

If you hadn't noticed yet, the internet of things is a security and privacy shit show. Millions of poorly-secured internet-connected devices are now being sold annually, introducing massive new attack vectors and vulnerabilities into home and business networks nationwide. Thanks to IOT companies and evangelists that prioritize gee-whizzery and profits over privacy and security, your refrigerator can now leak your gmail credentials, your kids' Barbie doll can now be used as a surveillance tool, and your "smart" tea kettle can now open your wireless network to attack.

Security analysts like Bruce Schneier have been warning for a while that the check is about to come due for this mammoth dumpster fire, potentially resulting in human fatalities at scale -- especially if these flaws are allowed to impact integral infrastructure systems. But Schneier has also done a good job noting how nobody in the production or consumer cycle has any incentive to take responsibility for what's happening:

"The market can't fix this because neither the buyer nor the seller cares. Think of all the CCTV cameras and DVRs used in the attack against Brian Krebs. The owners of those devices don't care. Their devices were cheap to buy, they still work, and they don't even know Brian. The sellers of those devices don't care: they're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution because the insecurity is what economists call an externality: it's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

Enter consumer groups and other independent operations, who are trying to finally step in with solutions. One is the open source standards system Consumer Reports has been pushing that would require that security and privacy issues be clearly highlighted in product reviews. Underwriters Laboratories (UL), the electronics safety organization, is also now joining the fray, proposing a five tier certification process to help consumers better avoid products and vendors who view privacy and security standards as an unnecessary afterthought:

"These days, when you look at products, they have been moving from an analog function to a digital function," said Andrew Jamieson, UL's director of security and technology. "From that context, the security of the software directly affects the safety of the product, so we have to really start thinking about that."

There is no unified standard for connected gadgets, which means that the smart TV you buy could be a hacking concern waiting to get plugged in. Unless you researched all your connected gadgets yourself, there'd be no way of knowing without a standard."

The UL's white paper on the proposal is worth a read. Granted such a system isn't going to get a lot of help from industry, which won't want to a.) lose revenues because some informed consumer avoided their products, or b.) be forced to spend money to improve privacy and security standards on current and past products. Similarly, captured regulators and well-lobbied lawmakers aren't likely to want to upset apathetic corporations. Which brings us back full circle, waiting for security scandals of unprecedented scale that will finally prompt action in this indisputably broken space.

Filed Under: devices, iot, privacy, security, standards, surveillance
Companies: ul

Pentagon Tells Military Members To Steer Clear Of Consumer DNA Testing Kits

from the save-that-saliva-for-the-battlefield,-soldier! dept

Dozens of companies are offering off-the-shelf DNA tests that promise to do everything from settling paternity claims to letting you know what horrible disease is going to end your life. Other companies simply offer you a chance to connect with the roots and outer branches of your family tree by matching your DNA to the thousands of other people in their databases.

What's not in the marketing pitches are the side effects of tying DNA markers to personally-identifiable info. Some companies are allowing law enforcement agencies to access entire databases with a single warrant. One company (Family Tree) has basically granted the FBI carte blanche access to its entire database.

Then there's the private sector. Insurance companies and employers may be using DNA tests to deny coverage or raise rates on existing coverage if markers for genetic diseases are found. Nothing's more personal than your DNA. When it's tied to you with a bunch of third-party records, it can cause problems.

That's the general message of a letter sent to US military members by the Department of Defense. Yahoo News obtained a copy of the DoD's letter [PDF], which warns troops away from using consumer DNA products because of the risks they pose.

What the Pentagon has to say about DNA kits applies to everyone, not just members of the military.

These DTC [direct-to-consumer] genetic tests are largely unregulated and could expose personal and genetic information, and potentially create unintended security consequences and increased risk to the joint force and mission...

[...]

Moreover, there is increased concern in the scientific community that outside parties are exploiting the use of genetic data for questionable purposes, including mass surveillance and the ability to track individuals without their authorization or awareness.

The memo also explains many of those offered have not received FDA approval, which means claims made by the DNA companies have not been verified. If the company's product doesn't work as well as advertised, the serviceperson could end up receiving inaccurate statements about health issues (or offspring, apparently).

While it's not exactly clear how DNA info stored in a database can result in new security risks, there's something to be said about the negative effects it could have on a serviceperson's career. A statement given to the Military Times by Pentagon spokesman Sean Robertson says the "unintentional discovery" of markers indicating potential future health risks could negatively affect readiness and, consequently, the soldier's career. Soldiers are required to disclose any medial issues that might affect readiness and a bad test could result in an erroneous disclosure that takes them off the battlefield, or puts them out of a job. Robertson says this sort of information is best obtained through a healthcare professional, rather than a third party service that hoovers up DNA and PII en masse.

Mass surveillance may not actually be an issue, but the potential for being swept up in a police investigation obviously poses a risk to military members -- especially those engaged in sensitive operations and whose involvement could be exposed during the course of an investigation. The increasing use of DNA databases as investigational tools increases the chances of innocent people being viewed as suspects just because their DNA bears some similarity to the sample investigators are working with.

If there are security risks beyond what's covered in the letter, the Pentagon isn't willing to discuss them. But there are enough problems with the way this sensitive data is handled by a number of companies that the best bet for most people is to steer clear of those that aren't transparent about who the data is shared with or sold to.

Filed Under: defense department, dna testing, home dna testing, pentagon, privacy, surveillance