When We Fail To Understand Privacy As A Set Of Trade-Offs, Everyone's 'Solutions' Are Unhelpful

from the not-going-to-fix-anything dept

Last week, Karl wrote up a fascinating post about a NY Times effort to use a dataset that a whistleblower at a data broker firm gave them to track the whereabouts of President Trump, by spotting the location data of what appears to be a Secret Service agent detailed to the President. Karl included two quotes from two different Senators in the article, and I found both of them amusing, as they both basically took the story and responded with their own "hobby horse" solution to the problem, even though neither one of them seemed to accurately understand or describe it:

"This is terrifying,” said Senator Josh Hawley, Republican of Missouri, who has called for the federal government take a tougher stance with tech companies. “It is terrifying not just because of the major national security implications, what Beijing could get ahold of. But it also raises personal privacy concerns for individuals and families. These companies are tracking our kids."

“Tech companies are profiting by spying on Americans — trampling on the right to privacy and risking our national security,” Senator Elizabeth Warren, a Democrat running for president, told us. “They are throwing around their power to undermine our democracy with zero consequences. This report is another alarming case for why we need to break up big tech, adopt serious privacy regulations and hold top executives of these companies personally responsible.”

The Hawley quote is classic Hawley, because he immediately jumps to the claim that these companies are tracking our "kids." Many of his attempts at regulating big tech has resulted in "but think of the children" arguments. Even when he was directly asked to respond to a Techdirt article, he ignored the question and went on a rant about how much damage tech is doing to the children. Except, this story is entirely about location data on phones. So, um, maybe don't give your kid a phone and then they're not directly tracking your kid anymore? Yes, obviously it's more complicated than that, and with the kind of data at issue you could probably identify adults who were with certain kids and track them. So there are legit concerns as is clear from the initial report. But, it's kind of a weird thing to focus on "the children" when the companies themselves focusing on location data -- as bad as they are -- are not actually tracking kids unless you, the parent, give them a phone with location sharing turned on.

Hawley sometimes likes to pretend he's against big government and especially against government taking over for parents. And, yet, here's a simple way that parents can take control in this situation: don't give your kid a phone with location info turned on.

The Warren quote is a similar thing. She immediately latches onto her idea that the correct answer is to break up big tech. But... while the NY Times does not say exactly where it got the data from to make this report, they do explicitly say that this data is not from the big internet companies Warren has suggested breaking up (i.e., Google, Facebook, Amazon, or Apple). Those companies aren't in the business of selling or sharing your location data with third parties. Indeed, with Google and Apple, they actually tell you what data your phone is sharing and allow you to block services from accessing that data. The data appears to be coming from a smaller data broker firm who got it from elsewhere (most likely a sketchy app provider selling your location data). Yet Warren uses it as evidence that internet companies need to be broken up.

Even if the data did come from such a company, it's difficult to see how breaking them up would solve any of the issues laid out in the report. Indeed, by cutting off ancillary and complementary lines of business, it's only likely to make such data collection efforts more central to a business, and push companies to rely even more heavily on such activity.

So, yes, obviously the NY Times' reporting here raises all sorts of alarm bells and concerns -- and it's nice to see some Senators concerned about all of this as well. Except it would have been a hell of a lot nicer if they were actually concerned about what the report said, and didn't use it as an opportunity to spew nonsense, make a non-existent connection to their own personal stump speech talking points, and ignore what's actually happening. But, hey, I guess that's asking too much of our elected officials these days.

Of course, all of this is just a symptom of a larger issue. As I've been talking about for years, we still don't fully understand what "privacy" means. Everyone seems to have a different conception of what privacy means, and that makes it quite difficult to talk about it -- but even more difficult to regulate it. This is why so many attempts at regulating privacy have insane unintended consequences. The quotes from Hawley and Warren just serve to illustrate all that. Neither are offering actual solutions to the issue of data brokers selling granular location data that can easily be de-anonymized. They're just pushing the same plan they've pushed in the past that vaguely speaks of "tech bad."

Filed Under: elizabeth warren, josh hawley, privacy, trade-offs

Using Trump As A Prop, The Myth Of 'Anonymized' Cell Data Is Finally Exposed

from the privacy-doesn't-exist dept

As companies and governments increasingly hoover up our personal data, a common refrain to keep people from worrying is the claim that nothing can go wrong because the data itself is "anonymized"--or stripped of personal detail. But time and time again, studies have shown how this really is cold comfort; given it takes only a little effort to pretty quickly identify a person based on access to other data sets. Yet most companies, policy folk, and government officials still act as if "anonymizing" your data means something. It's simply not true.

While that point hasn't yet resonated with the public and press fully, it should now.

The second in an amazing 7 series saga by the New York Times was released this week, taking a closer look at a data trove of 50 billion location pings from the phones of more than 12 million Americans given to the Times by an anonymous insider at one of countless location data brokers. The first in the Times' series took a look at how easy it was to identify "anonymized" normal citizens and track their everyday lives. This second piece ups the ante by... easily tracking the President of the United States via the location data of one of his secret service agents:

"The meticulous movements — down to a few feet — of the president’s entourage were recorded by a smartphone we believe belonged to a Secret Service agent, whose home was also clearly identifiable in the data. Connecting the home to public deeds revealed the person’s name, along with the name of the person’s spouse, exposing even more details about both families. We could also see other stops this person made, apparently more connected with his private life than his public duties. The Secret Service declined to comment on our findings or describe its policies regarding location data."

I'm not sure I've ever seen a story that more perfectly encapsulates both the stupidity of the "anonymized data is a panacea" claim, as well as the government's feckless refusal to seriously address one of the biggest scandals in privacy history. Granted it wasn't just the daily movement habits of the President's security detail that the data revealed, but that of Congressional staffers and lawmakers, many of whom have similarly been utterly apathetic to the problem:

"We were able to track smartphones in nearly every major government building and facility in Washington. We could follow them back to homes and, ultimately, their owners’ true identities. Even a prominent senator’s national security adviser — someone for whom privacy and security are core to their every working day — was identified and tracked in the data."

DC lawmakers could use this as a learning opportunity to finally understand why location data--whether it comes from an app or your cellular provider--shouldn't be treated cavalierly and sold to every nitwit with a nickel. Granted, it's just as likely the end lesson government learns is a focus on better location data security for government officials, and nobody else. As we've noted for a while, "feckless" is the best term to describe the government's response to a steady parade of scandals showing this data is routinely abused from everybody from rogue law enforcement officers to crazed stalkers.

The Congressional response to the Times' latest report was bipartisan in nature, even though a desire to actually do something about it hasn't been. Recall Congress voted along strict party lines to kill FCC broadband privacy rules in 2017 that could have at least partially addressed the problem. The GOP also supported the erosion of FCC authority in the net neutrality repeal, which also opened the door to greater abuse. Still, when the check comes due for those policy moves, notice how the outrage is suddenly bipartisan:

"This is terrifying,” said Senator Josh Hawley, Republican of Missouri, who has called for the federal government take a tougher stance with tech companies. “It is terrifying not just because of the major national security implications, what Beijing could get ahold of. But it also raises personal privacy concerns for individuals and families. These companies are tracking our kids."

“Tech companies are profiting by spying on Americans — trampling on the right to privacy and risking our national security,” Senator Elizabeth Warren, a Democrat running for president, told us. “They are throwing around their power to undermine our democracy with zero consequences. This report is another alarming case for why we need to break up big tech, adopt serious privacy regulations and hold top executives of these companies personally responsible.”

The FCC's supposed investigation into carrier location data sales appears to be stuck in neutral, with growing concerns the agency is running out the clock to avoid having to hold industry accountable. There's no real effort to craft rules that prohibit the widespread collection and sale of such data, and most policy conversations remain fixated exclusively on big tech, despite the problem also being rampant in big telecom. Meanwhile, our quest for an actual US privacy law in the internet are remains stuck in neutral, in large part because industry doesn't want to lose billions to consumers opting out of having their every waking moment monetized.

Still, the Times report (which many gearing up for the holidays won't read) may help finally dislodge some of this apathy and drive some actual, fact-based awareness of the real scope of the problem, maybe someday resulting in actual, serious proposals to fix it.

Filed Under: anonymized data, anonymous data, data brokers, datasets, donald trump, location data, privacy

NY Times Shows The Scope Of The Cell Location Data Scandal Nobody's Doing Anything About

from the ill-communication dept

First there was the Securus and LocationSmart scandal, which showcased how cellular carriers and data brokers buy and sell your daily movement data with only a fleeting effort to ensure all of the subsequent buyers and sellers of that data adhere to basic privacy and security standards. Then there was the blockbuster report by Motherboard showing how this data routinely ends up in the hands of everyone from bail bondsman to stalkers, again, with only a fleeting effort made to ensure the data itself is used ethically and responsibly.

Throughout it all, government has refused to lift a finger to address the problem, presumably because lobbyists don't want government upsetting the profitable apple cart, or because too many folks still labor under the illusion that this sort of widespread dysfunction will be fixed by a clearly broken and unaccountable US telecom market.

Enter the New York Times, which this week grabbed a hold of a massive data set from a broker, highlighting the scope of this problem. The dataset includes 50 billion location pings from the phones of more than 12 million Americans as they traveled around Washington DC, New York, San Francisco and Los Angeles. In this case the data came from a location data company that hoovers the data up from apps, though cellular carriers and appmakers alike have been equally complicit.

The report is part of a 7-part series highlighting just how big the problem has become, and just how little we're doing about it:

Each piece of information in this file represents the precise location of a single smartphone over a period of several months in 2016 and 2017. The data was provided to Times Opinion by sources who asked to remain anonymous because they were not authorized to share it and could face severe penalties for doing so. The sources of the information said they had grown alarmed about how it might be abused and urgently wanted to inform the public and lawmakers.

While cellular carriers have promised that they no longer sell that data after a parade of scandals, nobody has independently confirmed that claim. Nor has anybody asked what they're doing with the data already collected over the last decade. And despite claims of an investigation at the FCC, there are indications the agency is dragging its feet on the inquiry to help run out the clock on the statute of limitations for carrier culpablity. This is the ultimate cost of regulatory capture: profits trump all else, including basic, fundamental human rights.

While carriers and data brokers continue to say this is all just fine because people consent to be tracked and the data is anonymized, it's nice to see the Times point out that studies routinely highlight that anonymized data is far from anonymous. The Times found it wasn't particularly difficult to identify individuals and build detailed profiles based on their movement data:

Reporters hoping to evade other forms of surveillance by meeting in person with a source might want to rethink that practice. Every major newsroom covered by the data contained dozens of pings; we easily traced one Washington Post journalist through Arlington, Va.

In other cases, there were detours to hotels and late-night visits to the homes of prominent people. One person, plucked from the data in Los Angeles nearly at random, was found traveling to and from roadside motels multiple times, for visits of only a few hours each time. While these pointillist pings don’t in themselves reveal a complete picture, a lot can be gleaned by examining the date, time and length of time at each point.

The perils of what we're building here should be obvious. And it's fairly obvious that even bigger scandals on this front are waiting in the wings until we collectively demand some basic privacy guidelines for the internet era. This again highlights the myopia in DC policy circles, which have been focused in recent years almost exclusively on the perils of "big tech," while "big telecom" gets a free pass despite engaging in the exact same (or worse) behavior.

Filed Under: cell site location data, data brokers, location data, privacy

Top EU Court's Adviser Says Personal Data Can Be Transferred Using 'Standard Contractual Clauses' -- But Also Suggests That Privacy Shield Should Be Ruled Invalid

from the sting-in-the-tail dept

As is usual for cases being considered by the EU's highest court, the Court of Justice of the European Union (CJEU), before the main ruling a senior legal adviser offers a preliminary opinion. Although the view by the Advocate General is not binding on the court, it often gives a good idea of how things will go. That makes some of the issues raised in a new opinion by Advocate General Saugmandsgaard Øe (pdf) concerning the EU's GDPR privacy regulation particularly interesting. The case is yet another one triggered by a complaint from the privacy activist Max Schrems as a result of Snowden's revelations. The background is summed up well by the press release on the Advocate General's opinion (pdf):

The data of Facebook users residing in the EU, such as Mr Schrems, are transferred, in full or in part, from Facebook Ireland, the Irish subsidiary of Facebook Inc., to servers located in the United States, where they are processed. In 2013, Mr Schrems lodged a complaint with the Irish authority responsible for monitoring the application of the provisions relating to the protection of personal data ('the supervisory authority'), taking the view that, in the light of the revelations made by Edward Snowden concerning the activities of the United States intelligence services (in particular the National Security Agency or 'NSA'), the law and practices of the United States do not offer sufficient protection against surveillance, by the public authorities, of the data transferred to that country. The supervisory authority rejected the complaint, on the ground, inter alia, that in a decision of 26 July 2000 the Commission had considered that, under the 'safe harbour' scheme, the United States ensured an adequate level of protection of the personal data transferred.

As Techdirt reported, the "safe harbor" framework was thrown out by the CJEU in 2015, because it failed to offer enough protection for EU data. It was swiftly replaced by the Privacy Shield framework -- a slightly tweaked version of the safe harbor scheme. Both made transfers of EU personal data to the US legal by certifying that US data protection standards are "adequate".

But there is another way to make such transfers legally. Instead of relying on a general framework, individual companies can use standard contractual clauses (SCC), which are simply a promise that EU personal data will be protected in the US (or elsewhere) according to EU standards. The key issue considered by the Advocate General in advance of the CJEU ruling is whether the use of SCCs for the transfer of personal data to non-EU countries is valid. On that point, the court adviser has now said that in his view SCCs can be used as an alternative to things like the Privacy Shield framework. The main reason is that SCCs can be cancelled at any time -- for example, if evidence emerges that EU personal data is not sufficiently protected under foreign laws. The Advocate General goes further, saying:

there is an obligation -- placed on the data controllers [in a company, for example] and, where the latter fail to act, on the supervisory authorities [of each EU nation] -- to suspend or prohibit a transfer when, because of a conflict between the obligations arising under the standard clauses and those imposed by the law of the third country of destination, those clauses cannot be complied with.

So the good news for companies is that SCCs are a perfectly legitimate way of transferring EU personal data to the US. The bad news is that the data protection authorities in the EU must check whether the personal data is really protected according to EU norms, and if not, to block the flows immediately. In his press release on the opinion (pdf), Schrems says this is a huge step for the enforcement of the GDPR if it is followed by the CJEU: "At the moment, many data protection authorities simply look the other way when they receive reports of infringements or simply do not deal with complaints." In particular, Schrems says the Irish Data Protection Commissioner (DPC) would have to suspend the data flows between Facebook Ireland and Facebook Inc. because the DPC has already agreed EU data is not sufficiently protected by the latter. More generally, Schrems thinks this will lead to "More privacy for EU consumers, massive issues for certain US business":

If the Court follows today's opinion to have a "targeted approach" [on a case-by-case basis], there would be no impact on most EU data transfers. EU data protection authorities may however stop transfers to US companies that fall under FISA 702 ("electronic communication service providers"). This includes companies like Facebook, Google, Microsoft, Amazon Web Services or Yahoo.

Although it's subsidiary to the main issue of whether SCCs are valid, the Advocate General concludes with something of a legal bombshell. As the press release puts it:

According to the Advocate General, the resolution of the dispute in the main proceedings does not require the Court to rule on the validity of the 'privacy shield' decision, since that dispute concerns only the validity of Decision 2010/87 [regarding SCCs]. Nevertheless, the Advocate General sets out, in the alternative, the reasons that lead him to question the validity of the 'privacy shield' decision in the light of the right to respect for private life and the right to an effective remedy.

The Advocate General is saying that the EU's top court doesn't have to consider whether today's Privacy Shield offers enough protection of EU personal data sent to the US, but if it chooses to do so, he thinks it ought to rule that it's invalid. If the CJEU agrees, and throws out Privacy Shield as it threw out the safe harbor framework, that would have a major impact on today's digital world. We'll find out some time next year whether the judges are happy to do that.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, eu, personal data, privacy, privacy shield

Avast CEO Downplays Collection Of 400 Million Users' Browsing Data

from the you're-not-helping dept

In an ideal world, companies that profess to be dedicated to protecting users from malware and privacy threats probably shouldn't contribute to the problem. In the world we live in however, that's often not the case--as everybody saw when Facebook tried to sell its users on a "privacy protecting VPN" that actually hoovered up their browsing data, providing insight into user behavior when they aren't using Facebook. Facebook did ultimately shut the project down, but it took a year before they were willing to do so.

Enter antivirus and security firm Avast, which has been taking heat after it was discovered that the company's services are collecting user browsing data. Back in August, Wladimir Palant, the creator behind Adblock Plus, wrote a blog post detailing how Avast Online Security and Avast Secure Browser were covertly collecting the browsing data of the Czech company's 400 million users. In response earlier this month, both Opera and Mozilla pulled Avast extensions from their respective add on markets, though Google has lagged in any comparable response.

Hoping to calm the waters a bit, Avast CEO Ondrej Vlcek talked with Forbes, who informs its readers there's "no privacy scandal here":

"Recently-appointed chief executive Ondrej Vlcek tells Forbes there's no privacy scandal here. All that user information that it sells cannot be traced back to individual users, he asserts. Here's how it works, according to Vlcek: Avast users have their web activity harvested by the company's browser extensions. But before it lands on Avast servers, the data is stripped of anything that might expose an individual's identity, such as a name in the URL as when a Facebook user is logged in. All that data is analysed by Jumpshot, a company that's 65%-owned by Avast, before being sold on as "insights" to customers. Those customers might be investors or brand managers."

There's several problems here. One, it's not up to the CEO of a company collecting user data or Forbes to dictate what is or isn't a "privacy scandal." I mean sure, executives in the middle of the scandal would like to proclaim there is no scandal, but reality doesn't work that way. The people who determine what's a privacy scandal are the consumers who feel their private data has been abused without consent or transparency.

Two, study after study after study have showcased how anonymized data isn't actually anonymous.

Should that data get into the wild (pretty easy to do when it's being shared with an ocean of companies), it's fairly easy to compare it with existing data sets and obtain a real world identity with relatively little work. One study built a machine learning model that was able to correctly re-identify 99.98% of Americans in any anonymised dataset using just 15 characteristics including age, gender and marital status. Another study looking at vehicle data found that 15 minutes’ worth of data from just brake pedal use could lead them to choose the right driver, out of 15 options, 90% of the time.

In Avast's case, researchers found their apps collected way more data than was reasonably needed, including whether you'd visited a page in the past, your browser version, your country code, your browsing URLs, the websites you navigated from, etc. If Avast Antivirus was installed even more data was collected and shared, including the OS version of your devices.

No, collecting "clickstream" data isn't the end of the world. Nor is it new. After all, nearly every ISP has been doing something similar for the last twenty years (and routinely lying about it). Still, companies that profess to be protectors of your private data should be held to a slightly higher standard than telecom, which shouldn't be too hard since telecom isn't held to any real standard whatsoever.

Filed Under: data, data collection, free software, malware, ondrej vicek, online security, privacy, secure browser
Companies: avast

Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again

from the lack-of-respect dept

One of the most visible manifestations of the EU's General Data Protection Regulation (GDPR) is the "cookie banner" that pops up when you visit many sites for the first time. These are designed to give visitors the opportunity to decide whether they want to be tracked, and if so by whom. Any business operating Internet sites in the EU should theoretically use them or something similar, or risk a GDPR fine of up to 4% of global turnover. Cookie banners may be tiresome, but at least they give users some measure of control over how much they are tracked online. But do they? Few of us have the skills or the time to check that our wishes are obeyed by every site. Fortunately, three researchers in France -- Célestin Matte, Nataliia Bielova, Cristiana Santos -- possess both, and have conducted the first rigorous study of this area. They've written a good summary of their full academic paper.

An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the Interactive Advertising Bureau Europe Transparency and Consent Framework, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:

Consent stored before choice

The cookie banner stores a positive consent before the user has made their choice in the banner. Therefore, when advertisers request for consent, the cookie banner responds with the positive consent even though the user has not clicked on a banner and has not made their choice yet.

No way to opt out

The banner does not offer a way to refuse consent. The most common case is a banner simply informing the users about the site's use of cookies

Pre-selected choices

The banner gives user a choice between one or more purposes or vendors, but some of the purposes or advertisers are pre-selected: pre-ticked boxes or sliders set to "accept".

Non-respect of choice

The cookie banner stores a positive consent in the browser even though the user has explicitly refused consent.

That's a pretty dismal state of affairs. The GDPR is designed to give control to those visiting Web sites in the EU, and yet over half of the latter studied in detail fail to respect users' choices. One person who has shown himself unwilling to accept the GDPR being flouted in this way is the privacy campaigner Max Schrems. Over the years, he has launched -- and won -- multiple legal challenges involving privacy and the GDPR. Now his privacy organization noyb.eu is turning its attention to disrespectful cookie banners:

noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a "fake consent". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.

Up to 565 "fake consents" per user. Despite users going through the trouble of "rejecting" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent "fake consent" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.

Schrems points out that one company taking advantage of "fake consent" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU's top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the GDPR is already doing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cookie banners, cookies, eu, gdpr, max schrems, privacy

FTC Slaps Cambridge Analytica With An Order Barring The Already Defunct Company From Illegally Collecting Data Ever Again

from the it's-all-for-show dept

There still remains little to no evidence that the silly games played by Cambridge Analytica actually did anything at all to influence voting practices in the US. However, Facebook allowing the company to get a bunch of data was a big part of the basis for hitting the company with a $5 billion fine earlier this year. The FTC also went after Cambridge Analytica, targeting the company, its CEO Alexander Nix, and the academic/app developer Aleksandr Kagan, whose app was used to grab all that Facebook data.

Of course, Nix and Kagan settled with the FTC a while back and Cambridge Analytica shut down in 2018. The company -- whatever is left of it -- completely ignored the FTC, and thus the FTC has now issued a mostly meaningless opinion, saying that the company violated the already problematic EU-US Privacy Shield agreement around transferring data across the Atlantic, and because of that Cambridge Analytica (which, I should remind you, is no longer around) is now barred from doing this again.

In its Opinion, the Commission found that Cambridge Analytica violated the FTC Act through the deceptive conduct alleged in the complaint. The Final Order prohibits Cambridge Analytica from making misrepresentations about the extent to which it protects the privacy and confidentiality of personal information, as well as its participation in the EU-U.S. Privacy Shield framework and other similar regulatory or standard-setting organizations. In addition, the company is required to continue to apply Privacy Shield protections to personal information it collected while participating in the program (or to provide other protections authorized by law), or return or delete the information. It also must delete the personal information that it collected through the GSRApp.

That'll show 'em.

Filed Under: data, data collection, ftc, privacy
Companies: cambridge analytica

Cops Offered Deeper Discounts On Ring Cameras Depending On How Much Of The Neighborhood The Cameras Would Surveil

from the sweet-goddamn-christ-wtf-is-wrong-with-you dept

"You know what would be cool," said the consumer product that wished it was a cop? "If everything we made catered to law enforcement rather than the end user." That's the Ring business model: make inroads with security-conscious homeowners by inserting them into a toxic ecosystem that includes a snitch app that amps up the worst aspects of humanity, and breaks down the walls between "sharing" and "giving law enforcement agencies footage they can keep and distribute forever without limitation."

Ring doorbells have 95% of the doorbell camera market. That's a lot of "fuck you" market share. Ring says all doorbell camera footage belongs to homeowners, even as it renders homeowners extraneous by handing over footage stored in the cloud in response to subpoenas. Ring says it cares about the privacy of its customers, even as it tallies up doorbell rings and partners with law enforcement in sting operations.

The never ending negative news cycles continues for Ring with these details tucked away in another long, scathing report on the the doorbell company that wants so badly to be deputized, it's willing to cross lines most tech companies aren't willing to cross.

Caroline Haskins of Vice has been tracking Ring's incestuous relationship with law enforcement for several months now, using a slew of public records requests to make the things Ring and law enforcement don't want to discuss publicly public.

In her latest post -- one that should be read start to finish, especially if you haven't kept current with Ring's endless deluge of self-owns -- Haskins points out some more reprehensible behavior by the home security company that thinks it's a domestic surveillance contractor.

Being a good citizen involves more than flying an American flag over your driveway.

West Hollywood, CA distributed flyers advertising its Ring subsidy program at voter registration events, according to documents obtained by Motherboard. West Hollywood also sold subsidized Ring products “exclusively” to residents in areas moderated by neighborhood watches. Everyone who bought a discounted camera was added to a registry list with their name and address.

Ah, there's nothing more American than implicating the First and Fourth Amendments at the same time. The only way this would have been more American is if law enforcement asked citizens to turn over their weapons until troops were done staying at their homes.

Ask not what your [insert law enforcement agency name here] can do for you. Ask what you can do for [REDONDO BEACH POLICE DEPARTMENT].

Police from Redondo Beach, CA even used the pretense of camera registries to determine who should get a discount and who shouldn’t, according to a city council meeting memo obtained by Motherboard. Police said that they inspected the facades of homes of each applicant, and looked for who had the most “optimal viewpoints that could assist with criminal investigations.”

Kind of fucked up. What makes it really fucked up is the Redondo Beach PD offered steeper discounts to homeowners who agreed to place cameras in areas where they could capture footage "of the entire block" (60% stipend) or a "neighboring residence" (50% stipend).

Meanwhile, further north, Green Bay, WI police handed out cameras to residents under a "loan" program that predicated end user "ownership" on police ownership of all footage.

The implicit ask becomes explicit. Ring has partnered with 600+ law enforcement agencies. There's no reason to believe what's been revealed here is an anomaly.

Filed Under: doorbells, police, privacy, ring, surveillance
Companies: amazon, ring

The FBI Says Your TV Is Probably Spying On You

from the watching-you-watching-me dept

Like most of the infamous "internet of things," (IOT) smart TVs are a security and privacy dumpster fire. Numerous set vendors have already been caught hoovering up private conversations or transmitting private user data unencrypted to the cloud. One study in 2017 surmised that around 90% of smart televisions can be hacked remotely, something intelligence agencies, private contractors and other hackers are clearly eager to take full advantage of.

This week, the FBI, that bastion of sage privacy and security advice, issued a blog post out of its Portland field office warning cyber Monday shoppers that their smart TV is a little too smart, and likely watches you as much as you watch it. The post is filled with some handy tips to help you protect your privacy:

"Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”

Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.

If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.

Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?

Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it."

Granted such tips don't really do much to fix a broken sector where privacy and security remains an afterthought. A Consumer Reports study from last year found that things aren't really improving in the space. Government hasn't done much to pass any meaningful privacy law for the internet era. Gadget obsessed consumers are historically oblivious or apathetic to the problem. And product makers are too busy worrying about margins and the next big product launch to spend money to upgrade past sets or improve their privacy and security practices (at least not until there's another major scandal).

And if you've shopped for a TV recently, you may have noticed that it's largely impossible to just buy a "dumb" TV set without all of the "smart" internals. More specifically, most TV vendors don't want to sell you a bare-bones set because they want you to use their streaming services. Even more specifically, they want you to buy their sets with their specific streaming functionality because they want to spy on you and monetize your usage data.

So yeah, the FBI's tips are great and all, but they don't really get to the root of the market dysfunction that's plaguing the IOT space. There are plenty of fractured entities trying to help (like Consumer Reports' efforts to integrate an open source privacy and security standard in hardware reviews, or efforts at Princeton to make it clear what devices are actually doing on the network), but in terms of any kind of cohesive solution to the problem, there's little to nothing on the horizon.

Filed Under: fbi, privacy, smart tv, snooping, spying

The Fate Of EU Legislation Designed To Bolster Data Protection Beyond The GDPR, The ePrivacy Regulation, Hangs In The Balance

from the lobbying?-what-lobbying? dept

Whatever your views on the EU's General Data Protection Regulation (GDPR), there is no denying the impact it has had on privacy around the world. Where the GDPR deals with personal data stored "at rest", the proposed ePrivacy Regulation deals with with personal data "in motion" -- that is, how it is gathered and flows across networks. As Techdirt discussed two years ago, the pushback from Internet companies and the advertising industry against increased consumer protection in this area has been unprecedented. Some details were provided at the time in a report from the Corporate Europe Observatory. Unfortunately, that massive lobbying has paid off. Good ideas in the draft text produced by the European Parliament, like banning encryption backdoors or "cookie walls", have been dropped, as has the right of Internet users to refuse to accept tracking cookies. In the most recent version of the text (pdf) put together under the Austrian Presidency of the Council of the European Union (one of the three EU institutions that has to agree on the final law), there's even a new bad idea:

In some cases the use of processing and storage capabilities of terminal equipment and the collection of information from end-users' terminal equipment may also be necessary for providing an information society service, requested by the end-user, such as services provided to safeguard freedom of expression and information including for journalistic purposes, such as online newspaper or other press publications...that is wholly or mainly financed by advertising provided that, in addition, the end-user has been provided with clear, precise and user-friendly information about the purposes of cookies or similar techniques and has accepted such use

This section would give the news publishing industry a special right, enshrined in the ePrivacy Regulation, to use tracking cookies to support advertising, even though the original impetus behind the new law was to stop precisely this kind of obligatory commercial surveillance. Following its lobbyists' success in obtaining a special link tax included in the awful EU Copyright Directive, this latest legal privilege is further testament to the power of the publishing industry in the EU.

Judging by the most recent draft text, the ePrivacy Regulation has been almost completely gutted of any strong protections for Internet users. And yet it seems even what little remains is too much for some EU member states, as a story on Euractiv reports:

The European Commission will present a revised ePrivacy proposal as part of the forthcoming Croatian Presidency of the EU, Internal Market Commissioner Thierry Breton announced on Tuesday (3 December), after previous talks failed to produce an agreement among member states.

The revamped measures will be made in a bid to find consensus between EU countries on the ePrivacy regulation which would see tech companies offering messaging and email services subjected to the same privacy rules as telecommunications providers.

Although the new Internal Market Commissioner Breton is quoted as saying: "You can count on me to find consensus between each of us", others are not so sure. Some now believe that the entire ePrivacy Regulation will be dropped as being too hard to fix. That would be an incredible waste of years of work, a missed opportunity -- and a huge victory for the lobbyists.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: eprivacy regulation, eu, lobbying, privacy