Facebook Claims Users Sign Up Because They Want To See Personalized Ads, Max Schrems Disagrees -- And Usually Wins These GDPR Arguments

from the time-to-start-planning-for-defeat dept

The privacy activist Max Schrems has been conducting a battle on multiple fronts against Facebook's use of personal data. Last year, Techdirt wrote about one of the skirmishes, which saw the EU's highest court, the Court of Justice of the European Union (CJEU), ruling that Schrems could use the GDPR to litigate in Austria, where he is based, rather than in Ireland, where Facebook has its international headquarters. The latter option would have been prohibitively expensive for Schrems, and would probably have meant he dropped the case.

Schems has now begun his legal action in Austria, before the Vienna Regional Court. According to Schrems, Facebook admitted that it has been collecting and processing data without users' consent since the introduction of the GDPR last year. However, in an interesting move, Facebook has claimed that it is not breaking EU law for the following reason:

According to the GDPR, in addition to consent, there is also the possibility of processing data for the "performance of a contract" (Article 6(1)(b) GDPR). Facebook now claims to have concluded such an "advertising contract" with users who, according to Facebook, have ordered "personalized advertising" when they signed up to the new terms and conditions on May 25, 2018.

Essentially, Facebook is claiming that people join its service because they are simply dying to see all those personalized ads that Facebook wants to show them. To counter that novel claim, Schrem's organization NOYB commissioned a study by the Austrian Gallup Institute, which interviewed a representative sample of 1000 Austrians (original in German - pdf). According to Gallup, only 4% of the sample actually loved the ads, with 6% liking them slightly, 21% indifferent and 69% disliking them or really disliking them. That's only one survey, but it certainly suggests that Facebook is clutching at straws with its new line of arguing. According to NOYB:

Cecilia Álvarez (Privacy Policy Director of Facebook EMEA) was questioned by the Viennese judge yesterday. However, she was unable to answer many of the questions. Facebook's lawyers argued that she lacked the "technical understanding" to answer questions on Facebook's handling of personal data.

As Schrems points out, Facebook would have the court believe that users know exactly what they are committing to when they agree to the service's terms and conditions, and yet: "not even the top Facebook privacy expert can explain exactly what the company does with our data." The hearing before the Viennese court to decide the issue has been adjourned until February, so nothing more will happen until then. But the stakes are high. Schrems comments: "If we succeed, Facebook will have to change its practices to comply with the GDPR and give users real voting rights. That’s our goal."

Moreover, a victory by NOYB on this point, if confirmed by the CJEU, would affect every company operating in the EU that gathers private data from its users, and sells advertising based on the personal details. However much Internet services like Facebook and Google might hate that prospect, they know that it is a real possibility, as proved by Schrems' already impressive track record of winning these kind of GDPR arguments.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: austria, eu, gdpr, max schrems, permission, personalized ads, privacy
Companies: facebook, noyb

Andrew Yang's Horrible, No Good, Very Bad Tech Policy

from the did-you-hire-josh-hawley-to-write-your-policy? dept

Andrew Yang has been a bit of a surprise Presidential candidate this year, and is often described as a former "tech exec" or "Silicon Valley's presidential candidate". The "tech exec" claim seems a bit exaggerated, as he was a lawyer, and then ran a test prep company before a non-profit. Still, he got lots of attention for being a bit wonky and at least speaking the language of tech. His main claim to fame has been to support Universal Basic Income of $1,000/month which is a popular idea here in Silicon Valley.

However, the more we hear from Yang about his tech policy ideas, the more ridiculous and completely disconnected from the actual tech world he seems. He got a lot of flak a couple months back when he advocated for voting via your mobile device via blockchain which he declared to be "fraud proof." This was universally mocked by security professionals and cryptocurrency experts, including one who described the proposal as "unbelievably dumb."

So, his pro-tech campaign had already hit some choppy waters, and they got much, much worse last week when he introduced his official policy for regulating technology firms that is so filled with bad ideas that I initially thought it was a parody. It may be the single worst tech policy proposal of any current or former candidate for President (and, frankly, nearly all of them are pretty bad). It's as if he took all the terrible ideas that Senator Josh Hawley has been proposing over the last year or so and said "Oh, I can top all of those with worse proposals."

Let's go through the details one by one.

Regulate the use of data and privacy by establishing data as a property right. The associated rights will enable individuals to retain ownership and share in the economic value generated by their data.

No, no, no, no. I'd been meaning to write a separate blog post for a while about this, but there are a few folks out there pushing for the idea that "data" should now be considered a form of "intellectual property," with the originator holding some sort of property right over it. It's a horrible idea. Take two horribly misunderstood and abused areas -- intellectual property law and privacy -- and awkwardly mash them together and pretend it will actually help? Come on. If we've learned anything about trying to build property rights over information, it's that it creates all sorts of awful unintended consequences. Adding those to data will make them much worse.

I mean, given how many copyright, patent, and trademark trolls already exist, aren't folks super excited about the ability to soon deal with data or privacy trolls as well? It'll be a real blast. But what it won't do is actually protect anyone's privacy. Nor will it allow them to "share in the economic value generated by their data." That's now how any of this actually works. In fact, you already share in the economic value generated by your data by getting to use all the amazing services you already use. Charging for the data doesn't open that up. In fact, it's likely to close it down.

Minimize health impacts of modern tech on our people, particularly our children. I will create a Department of the Attention Economy that focuses on smartphones, social media, gaming, and apps, and how to responsibly design and use them, including age restrictions and guidelines.

A "Department of the Attention Economy"? What the fuck is that I don't even.... And, again, this sounds exactly like Josh Hawley's desire to appoint himself the product manager for the internet, by determining exactly how various apps and services must be designed. What makes Yang think that some bureaucrats are going to know how to do this well? Also, while I get that there are potentially reasonable concerns about how various apps and services are used, much of it still smacks of moral panics. Would Yang have created a special new regulatory agency to regulate rock and roll back in the 60s, determining age restrictions and guidelines for what kinds of songs were okay?

Stop the spread of misinformation that is eroding trust in our institutions and fanning the flames of polarization in our society. I will scale up VAT on digital ads to hasten a shift away from ad-driven business models, require disclosures on all ads, regulate bot activity, and regulate algorithms, addressing the grey area between publishers and platforms.

How do you stop the spread of misinformation without violating the 1st Amendment? Can someone ask Yang that? And if he thinks that "digital ads" are the problem, or that a VAT will somehow stop such misinformation, he's even more disconnected from the reality of how tech works than I had previously imagined. Finally, that line "addressing the grey area between publishers and platforms" is a nod to the made up nonsense by a bunch of conservative trolls pretending that there's some legal distinction between a publisher and a platform. There isn't. There isn't a legal grey area. The law is quite clear and the courts have had no problem in understanding the issues. It's just a bunch of trolls -- usually the folks spreading misinformation -- who like to pretend there's some grey area.

In the details to this plan, Yang dumps on Section 230, because of course he does:

Section 230 of the Communications Decency Act14 absolves platforms from all responsibility for any content published on them. However, given the role of recommendation algorithms—which push negative, polarizing, and false content to maximize engagement—there needs to be some accountability.

That "14" actually is a footnote to the EFF's page about 230 that debunks Yang's blatantly false claim that Section 230 "absolves platforms from all responsibility for any content published on them." It does not and never has. It simply places the legal liability on whoever created the content. Which is a sensible and reasonable thing. And, even then, it only immunizes platforms from certain types of liability on certain types of content, not "any content published on them."

Indeed, it's once again ironic that someone pointing to Section 230 as being a problem because of misinformation being spread online... is spreading blatantly false information about Section 230. Yang's actual "proposal" for 230 is also pretty much a 404 error:

Amend the Communications Decency Act to reflect the reality of the 21st century— that large tech companies are using tools to act as publishers without any of the responsibility.

What does that even mean? If anyone thinks that the large tech companies have no responsibility, they haven't been paying attention and literally have no clue what they're talking about. Apparently Yang has no clue what he's talking about.

Adopt a 21st century approach to regulation that increases the knowledge and capacity of government while using new metrics to determine competitiveness and quickly identifies emerging tech in need of regulation.

Out of the four key "prongs" of his proposal, this is the only one that touches on an idea that makes sense. We've talked quite a lot about increasingly the knowledge and capacity of government, but the latter half of the prong should raise eyebrows. He acts as if any emerging area of tech is "in need of regulation." How 'bout we use this new knowledge and capacity to actually explore if regulation is needed, before rushing in to focus in on regulating every new area of tech. Given how many emerging areas of innovation tend to be threatened or stifled by overregulation, the fact that Yang's approach seems to be regulate everything as soon as it emerges, should be disqualifying.

And even here, nearly all the details are odd. He does support bringing back the Office of Technology Assessment, which is good, but then he goes into a weird and nonsensical idea of creating a "Department of Technology" and making it a Cabinet level agency. This smacks of the idiotic days in the early 2000s when every company would appoint a "Chief Digital Officer," as if "digital" were its own silo like marketing or finance or human resources. As we explained back in the time where Yang was tutoring people to take their GMATs, thinking digitally isn't a separate job function. These days it permeates all jobs, all government, and all society. Siloing it into a special new department makes no sense. Sure, get everyone in government more knowledgeable and tech literate, but that doesn't require a whole new Department, which suggests only it needs to understand tech.

Hopefully we can no get everyone to admit that Yang is not quite the tech savvy "former tech exec" that the media likes to pretend he is. For what it's worth, I sent Yang's proposal to a close friend in the tech industry who had been a vocal Yang supporter, and got back a text saying "WTF? Not even one point is good. It's like he doesn't know tech at all." Yup.

Filed Under: andrew yang, attention economy, data, intellectual property, privacy, section 230, tech policy

Should Doxxing Be Illegal?

from the questions,-questions dept

There has been a debate over the past few years about the legality of "doxxing," which would loosely be defined as identifying individuals and/or their personal information which they'd prefer to remain secret. This is coming up in a variety of contexts, including effort to unveil the whistleblower who first called attention to President Trump's questionable call with Ukraine's President. However, we also noted in passing, last week, that the new privacy bill from Reps. Zoe Lofgren and Anna Eshoo contained an anti-doxxing clause, which states:

Whoever uses a channel of interstate or foreign commerce to knowingly disclose an individual’s personal information—

(1) with the intent to threaten, intimidate, or harass any person, incite or facilitate the commission of a crime of violence against any person, or place any person in reasonable fear of death or serious bodily injury; or

(2) with the intent that the information will be used to threaten, intimidate, or harass any person, incite or facilitate the commission of a crime of violence against any person, or place any person in reasonable fear of death or serious bodily injury,

shall be fined under this title or imprisoned not more than 5 years, or both.

At a first pass, you can certainly understand the thinking here. If you're looking to disclose someone's personal information in order to "threaten, intimidate, or harass" someone, that feels problematic. But, then again, what is meant by "intimidate or harass" in this situation could matter quite a bit. What got me thinking about this again was another news report, about people doxxing members of a defunct neo-nazi online forum:

The metadata of a now-defunct neo-Nazi message board that is considered the birthplace of several militant organizations—among them the U.S.-based terror group Atomwaffen Division—was dumped onto the internet by what appears to be anti-fascist activists.

The site, IronMarch, is widely associated with the rise of the new wave of white supremacist accelerationst groups advocating for armed insurgency against society. The site ran from 2011 to 2017 and garnered more than 150,000 posts while active. The dump of its inner workings includes the login names of its former members and their associated emails and IP addresses.

For fairly obvious reasons, many would likely argue that we should want those people identified. And while the report notes that efforts are underway to try to track down the identities of people who were active on this forum, and it could be argued that the intent behind figuring out who was on this forum is to "intimidate or harass" those individuals (for being Nazis), I think many people who might otherwise support these kinds of privacy laws might take issue with the idea that revealing these individuals as Nazis and/or Nazi sympathizers should be illegal.

And that, again, gets at part of the issue with legislating privacy. Context matters quite a bit, and it's pretty difficult to write context into the law. Yes, doxxing is often used in negative ways to harm, intimidate or silence people. But it can also be used to reveal people who are doing crazy stuff hidden behind a shield of anonymity.

Filed Under: doxxing, investigation, privacy, privacy laws

Congress Says The FCC Is Trying To Run Out The Clock On Wireless Location Data Scandals

from the whoo-needs-accountability dept

US wireless carriers have spent much of the last year under fire for hoovering up your location data, then selling that data to any nitwit with a nickel. More recently they've been busted even selling access to E-911 location data, which is increasingly even more accurate in tracking users than traditional GPS. We've noted repeatedly that lax ethical standards result in this data often being abused by dubious third parties, or used illegally by law enforcement or those pretending to be law enforcement.

Throughout these evolving scandals, the Trump FCC hasn't done anything to ensure the public this is being adequately looked into. There's been no critical statement about this practice issued by the FCC, and despite some early hints at a potential investigation, there's been zero public traction of any kind. Last week, some lawmakers wrote to the FCC boss Ajit Pai calling him out for doing nothing in response to the scandal:

"We write regarding our growing concern that the Federal Communications Commission (FCC) is failing in its duty to enforce the laws Congress passed to protect consumers’ privacy. This Committee has repeatedly urged you to act quickly to protect consumers’ privacy interests, and unfortunately you have failed to do so."

The apathy is particularly interesting given the Trump administration's frequent hyperventilation on privacy when it's Facebook or some other, large Silicon Valley giant in the crosshairs. Given the FCC hasn't done much of anything about other major scandals haunting the telecom sector (like SIM hijacking leading to cryptocurrency theft), this kind of apathy toward telecom misbehavior isn't surprising. But when it comes to the location data scandals, lawmakers suggest the FCC is trying to run out the clock so that wireless carriers can't be held accountable under FCC guidelines:

"Despite announcing that it began an investigation into the wireless carriers after being made aware of the allegations in 2018, the FCC has failed, to date, to take any action. And now time is running out since the statute of limitations gives the FCC one year to act.

We write regarding our growing concern that the Federal Communications Commission (FCC) is failing in its duty to enforce the laws Congress passed to protect consumers’ privacy. This Committee has repeatedly urged you to act quickly to protect consumers’ privacy interests, and unfortunately you have failed to do so."

While wireless carriers have insisted they've stopped collecting and selling this data, nobody has bothered to actually independently confirm that. Nobody's really been able to answer what happens to the troves of location data these companies have been collecting for the better part of the last decade, either. Have carriers really stopped monetizing your every waking movement? Are they still monetizing a decade's worth of your daily habits? ¯\_(ツ)_/¯

Like so many tech policy issues (net neutrality comes quickly to mind), this will be idiotically framed as a "he said, she said" partisan issue by lawmakers and many media outlets, resulting in the Republican FCC only doubling down on what they'll insist is "unfair partisan criticism." But that doesn't really address the fact that we're doing little to nothing about one of the biggest privacy scandals in the last decade. Nor does it really speak to the fact that when it comes to consumer privacy, the telecom sector is every bit as terrible as giants like Facebook -- which now enjoy a myopic level of consternation in the DC policy space to the exclusion of all else.

Filed Under: ajit pai, fcc, location data, privacy

Microsoft Says It's Cool With California's New Privacy Law

from the competing-on-privacy dept

We've made it abundantly clear that California's new privacy law is aggressively undercooked, and will require some very serious fine tuning if it's going to be workable for many California companies. At the same time, giant companies like Google, Comcast, and AT&T have spent a lot of time aggressively misrepresenting what the law actually does, running ads outright lying about the bill's impact, and downplaying the fact that states wouldn't be wading into the privacy waters if these companies hadn't lobbied to kill modest federal privacy requirements in the first place.

Whereas companies like Facebook have repeatedly and routinely tripped over themselves in almost dystiopian fashion to make their existing regulatory headaches worse, it has been interesting to watch Microsoft, steeled from its experiences in the late 90s, navigate the current minefield more deftly. That was on display again this week when Microsoft came out in seemingly total support of California's new privacy law, with a blog post by Chief Privacy Officer Julie Brill stating the company intends to apply its adherence to the California Consumer Privacy Act (CCPA) law nationwide:

"CCPA marks an important step toward providing people with more robust control over their data in the United States. It also shows that we can make progress to strengthen privacy protections in this country at the state level even when Congress can’t or won’t act.

We are strong supporters of California’s new law and the expansion of privacy protections in the United States that it represents. Our approach to privacy starts with the belief that privacy is a fundamental human right and includes our commitment to provide robust protection for every individual."

It may just be that I've covered telecom companies like AT&T for too long, but it's interesting to note that nowhere in the blog post does Microsoft even fling so much as an underhanded, veiled criticism of California's efforts. It's a notable contrast to other Internet Association members, many of which have been running advertisements falsely claiming the bill will result in people having to pay per click just to access websites that used to be free:

While Microsoft is still a member of the group running these ads, the blog post seems to indicate at least a few people at Microsoft understand that this is a battle you're not going to win by swimming upstream or doubling down on idiotic behavior (oh hey Facebook, didn't see you standing there).

Outside of the problematic COPPA, there's no meaningful US privacy laws for the internet era, and the endless series of hacks, breaches, incompetence (like leaving private data in openly exposed Amazon cloud buckets) make it clear modern US industry is too incompetent to self regulate and we need at least some basic rules of the road on privacy. Yes, government dysfunction and corruption means it's going to be ugly as hell as we figure out what that looks like, but that doesn't somehow magically eliminate the necessity for some meaningful penalties for incompetent privacy-violating corporate giants.

Microsoft's clear support for existing efforts is a far cry from the response by companies like Facebook and AT&T. Both companies claim they want a federal privacy law, but what they really want is their lawyers to write a loophole-filled federal law with only one real purpose: to pre-empt any tougher state or federal measures. They're well aware that any good bill will result in informed, empowered consumers who'll opt out of snoopvertising, costing them billions, and their response is to try and undermine those efforts at every opportunity.

And while it's certainly possible Microsoft feels the same way and is just engaged in a convincing head fake here, it's also possible Microsoft seriously intends to actually compete on privacy, realizes the die is already cast thanks to an incredibly pissed off public, and knows that swimming against the tide is going to prove counterproductive and harmful to their brand--and their customers--over the longer haul.

Filed Under: california, ccpa, privacy
Companies: microsoft

Mozilla: ISPs Are Lying About Encrypted DNS, Should Have Privacy Practices Investigated

from the ill-communication dept

In a bid to avoid losing access to the cash cow that is your daily browsing data, ISPs like Comcast have been lying about Google and Mozilla's quest to encrypt DNS data. The effort would effectively let Chrome and Mozilla users opt in to DNS encryption -- making your browser data more secure from spying and monetization -- assuming your DNS provider supports it. Needless to day, telecom giants that have made billions of dollars monetizing your every online behavior for decades now (and routinely lying about it) don't much like that.

As a result, Comcast, AT&T, and others have been trying to demonize the Google and Mozilla efforts any way they can, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah).

Mozilla this week came out with a letter not only taking aim at those claims, but urging Congress to investigate telecom's long history of privacy problems:

"Our recent experience in rolling out DNS over HTTPs (DoH)—an important privacy and security protection for consumers—has raised questions about how ISPs collect and use sensitive user data in their gatekeeper role over internet usage," the letter, signed by Marshall Erwin, senior director of trust and security and Mozilla, reads. "With this in mind, a congressional examination of ISP practices may uncover valuable insights, educate the public, and help guide continuing efforts to draft consumer privacy legislation."

While there's obviously plenty of perfectly legitimate criticism of Silicon Valley giants like Facebook and Google, we've been noting how telecom lobbyists have been quietly co-opting this backlash to help the telecom sector. So far you'd have to view these efforts as successful; while the government hyperventilates about Facebook and whether it should be broken up and heavily regulated, telecom has convinced lawmakers to effectively obliterate all oversight of telecom, despite the sector having historically been every bit as terrible as Facebook on the subjects of privacy, consumer rights, and competition.

As a result there are a few lawmakers (Marsha Blackburn comes quickly to mind) who claim to be utterly incensed at Facebook's behavior, but have chosen to give telecom a free pass. Mozilla's letter urges Congress to, you know, stop doing that if they want to be taken seriously:

"We believe that more information regarding ISP practices could be useful to the Committee as it continues its deliberations on this front, and we encourage the Committee to publicly probe current ISP data collection and use policies."

As we look to craft what the privacy standards and guidelines of tomorrow look like, it's another reminder of how focusing too exclusively on the missteps of Silicon Valley giants obscures the fact that these problems aren't just exclusive to "big tech." Mozilla's spot on when it notes that privacy solutions that don't consider telecom aren't much of a solution in the first place.

Filed Under: congress, dns over https, doh, encrypted dns, privacy, security
Companies: at&t, comcast, google, mozilla, verizon

Health Minister Wants Full-Genome Sequencing Of Every Newborn Child In UK To Become Routine

from the knowing-too-much dept

The cost of sequencing every DNA "letter" in a human genome has fallen faster than Moore's Law, from around $100 million in 2001, to under $1,000 today (although some say the overall cost in a clinical context is higher). This brings with it the prospect of routinely carrying out full-genome sequencing for everyone. That's precisely what Matt Hancock, the UK's Health Secretary, has said he wants to see as a part of the country's National Health Service (NHS), reported here by The Telegraph:

"My ambition is that eventually every child will be able to receive whole genome sequencing along with the heel prick test [a basic test for genetic conditions]," he told the conference.

"We will give every child the best possible start in life by ensuring they get the best possible medical care as soon as they enter the world. Predictive, preventative, personalised healthcare -- that is the future of the NHS -- and whole genome sequencing and genomics is going to play a huge part in that," he said.

Creating a massive database of near-complete genomes will probably ring alarm bells for Techdirt readers. Just recently, US police have started obtaining warrants to search entire DNA databases, even of people who opted out of allowing law enforcement to access their genomic data. That's despite the fact that "touch DNA" is mostly guesswork, and that crime lab testing is beset with problems. Moreover, a mistaken belief that DNA is infallible can lead to innocent people being charged with serious crimes like murder.

It's true that DNA can be a very powerful tool for solving crimes by finding distant matches in publicly-available genetic data, and then constructing family trees to narrow down the possible suspects. But that fact also exposes why routinely obtaining someone's DNA, as Hancock proposes for newborns in the UK, has an important impact on anyone related to the person whose whole genome is sequenced.

Even when DNA databases of a complete population are not set up for the purposes of mass surveillance, as Kuwait proposed (but then scaled back), and as China is implementing in Xinjiang as a way of controlling the local Uyghur population, there are other serious issues that need to be considered.

For example, the Telegraph article notes that full-genome sequencing of newborns means "parents could choose to be alerted to the fact their child faced heightened risks of specific diseases, and allow the NHS to offer more tailored treatment." But would parents necessarily welcome knowing that their child is more likely than the average individual to develop some serious genetic condition at some point in their lives? And what about if that condition had no treatment at present? What is gained by knowing of the risk? Might parents, and later the affected children themselves, find that knowledge almost too much to bear -- a genetic sword of Damocles hanging over them all their lives? Equally, parents might feel guilty if they don't ask for this information, which could allow for earlier treatment of diseases.

There's no doubt that full-genome sequencing will have a major impact on medicine in the decades to come, and offers the hope of more targeted and more effective medicines for many conditions. But for the benefits to be realized, doctors and genetic counselors will need to find effective ways to talk to people about what the detailed but probabilistic information revealed by their complete genomes will mean for their future health and treatments. Only then can we make informed decisions that enhance our well-being and happiness.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: babies, dna, health minister, matt hancock, nhs, privacy, surveillance, uk, uk health secretary

The Race Is On To Create A Federal Online Privacy Law: First Entry From Reps. Eshoo & Lofgren

from the lots-of-thought,-but-little-chance dept

There's a race on to have Congress introduce a comprehensive federal privacy law. As you may (or may not?) know, the US really doesn't have a law protecting our privacy. To date, any privacy protections have been a mixture of other laws, from the defanged 4th Amendment protecting (in theory more than reality) against government intrusion into our private lives, to the FTC's consumer protection mandates. However, many people recognize that this probably isn't doing enough to protect privacy in this age -- and with the EU taking the lead with the GDPR, it's become clear that the US needs to put at least something in place. So far, Congress has failed to come up with much, and there's a bit of a ticking time bomb in the form of California's hugely problematic CCPA law, which is set to go into effect on January 1st, despite a long list of problems with the law.

So much of the discussion has been around whether or not a new federal law will come into play that pre-empts various states trying to create their own set of privacy laws. Reps. Anna Eshoo and Zoe Lofgren have now announced their entrant into the discussion with their Online Privacy Act. It is quite long and detailed, coming in at 132 pages which I recommend reading. They've also created a one page summary of the bill.

The bill is ambitious, detailed and thoughtful... but also has some problems and is not likely to become law. There's a lot in the bill, but it will create a brand new federal agency, staffed with 1,600 employees, to "enforce users' privacy rights." Along those lines, it establishes what those rights are -- with much of it pulling from concepts currently found in the GDPR (i.e., rights to access, correct, delete, and download information companies hold about you). There are some opt-in requirements for using your data for things like machine learning (what seems like a response to the kerfuffle over IBM using Flickr images to train facial recognition AI).

The law would also put a bunch of obligations on companies regarding data minimization and also force the companies to be more upfront about what they need particular data for. It would also limit the sale or transfer of personal information. It also criminalizes "doxxing" which it defines as disclosing "personal information with intent to cause harm." If this became law, that section might run into some 1st Amendment problems.

Part of the "thoughtfulness" of the bill is that Eshoo and Lofgren have clearly heard some of the concerns that were laid out about the GDPR or other approaches to privacy. It includes an exemption for small businesses and then also includes a "ramp up" phase for companies that cross out of the small business realm. I'm always a bit concerned about "small business exemptions" because they lead to weird incentives and not always great outcomes. From a purely efficient standpoint, I tend to think that if the law is written in a manner that requires exempting certain classes of companies, it tends to highlight problems with the overall law itself, though there are some exceptions to that rule.

Importantly, the bill also calls out that it should have no impact on journalism, and acts of journalism (reporting on people) should never be seen as violating the law. That could lead to some conflicting situations within the bill, but hopefully the blanket exemption on journalism would protect journalistic activity.

That said, there are still problems with the bill. The biggest one is that it does not appear to pre-empt state laws, which is kind of the whole reason for introducing a federal law in the first place. I know that some privacy activists have pushed back against state pre-emption, but that by itself makes the bill somewhat useless, because California's law and other state privacy laws would more or less wipe this law off the books in terms of effectiveness. I understand the thinking that some have put forth that letting states craft their own privacy laws encourages more experimentation and thoughtfulness, but it makes little sense on an internet that crosses all borders. Complying with all state privacy laws is going to be a huge mess -- and therefore it seems like a federal law must include pre-emption of state laws for it to be valid.

The bill also includes a private right of action, which is seen by many to be problematic -- as it's going to enable the rise of what are, in effect, privacy trolls. Again, there are reasonable concerns about if it's only left up to government enforcement that enforcement will be lax, or will suffer from regulatory capture, but leaving open a broad private right of action could have significant problematic consequences. The bill also seems clearly designed to set up certain non-profits to file a bunch of class action privacy lawsuits:

NONPROFIT COLLECTIVE REPRESENTATION.— An individual shall have the right to appoint a nonprofit body, organization, or association which has been properly constituted in accordance with the law, has statutory objectives which are in the public interest, and is active in the field of the protection of individual rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in this Act on his or her behalf.

I worry a bit about the incentive structure there as well. I certainly have faith that groups like EFF would use this particular power wisely and in pursuit of actually protecting our privacy, but there are a number of non-profits out there that would likely take this to ridiculous extremes and immediately go after lots of companies for potentially dubious reasons.

Most reports on this acknowledge that this bill is unlikely to become law. It does not currently have bipartisan support, and the creation of an entirely new government agency, the lack of state pre-emption, and the private right of action have been seen as non-starters for many.

All that said, we're likely to see a bunch of privacy bills showing up in Congress soon, so it's worth exploring the details of this one. And, of course, it should be noted that both Lofgren and Eshoo represent parts of Silicon Valley, which might make you assume that the bill is "friendly" to tech companies. Looking through the details, though, and that would be a mistake. While I'm sure some will criticize the bill for not going far enough, this would create a pretty massive overhaul in how online privacy is handled in the US today and would, in effect, create an equivalent of the GDPR. That might still "benefit" large companies in making it more difficult for others and new entrants to compete (even with the small business exemption), but this bill doesn't do any favors for internet companies.

I do still worry that most of our attempts to regulate privacy fail because we often misunderstand what privacy means, and I do worry that the approach in this bill, as with the GDPR and the CCPA, suggests a static, rather than dynamic internet world, in which the focus is on "limiting" things, rather than recognizing how they might be better enabled by putting more control in the hands of the end users. So much of the structure of this and other bills seems based on the idea that there are central entities "controlling" our data -- which may be the case today, but need not necessarily be the case in the future.

Filed Under: anna eshoo, competition, doxxing, gdpr, online privacy act, privacy, private right of action, state pre-emption, states, zoe lofgren

Comcast Insists It's An Innocent Little Daisy On Consumer Privacy

from the zero-credibility-left dept

Both Mozilla and Google have begun pushing encrypted DNS via their respective browsers, making it more difficult for outsiders to monitor and/or monetize your daily browsing habits. Not too surprisingly the broadband industry, which has a long, proud history of covertly collecting and selling this data, isn't particularly happy about this evolution. With the help of unskeptical news outlets, telecom lobbyists have been trying to convince the government that what Mozilla and Google are up to is somehow nefarious, going so far as to (incorrectly) claim the move is even an antitrust violation.

Last week, Motherboard published Comcast documents highlighting how Comcast has been also trying to convince gullible lawmakers that the move to encrypt DNS traffic somehow poses a threat to national security and the sacred DC tech policy pixie dust that is 5G:

"The unilateral centralization of DNS raises serious policy issues relating to cybersecurity, privacy, antitrust, national security and law enforcement, network performance and service quality (including 5G), and other areas," Comcast said in the presentation. "Congress should demand that Google pause and answer key questions," a section of the presentation reads. "Why is Google in such a rush?" reads another.

But Comcast's claims are false. Neither Google nor Mozilla are forcing their browser users to do anything. Users are simply being presented with the option to encrypt their DNS traffic -- if their current DNS provider supports it. The move would not switch users to Google's DNS servers by default, either, so the centralization claim is false. In short, you'll be surprised to learn, Comcast is lying about what the proposal will do. Why? It makes it harder for the telecom sector to spy on -- and monetize -- your daily browsing behavior.

In the wake of the leak, Comcast published a new blog post attempting to frame itself as an innocent little daisy on consumer privacy issues, going well afield to pretend that it doesn't actually monetize its users data:

"We play an important role as an Internet Service Provider in connecting you to whatever you want to do online. Whether you’re browsing the Internet or managing your connected home, we’re always working to protect your privacy and keep your information secure. We’re in the business of giving you a great Internet experience with products and services like xFi’s parental and WiFi control features; we are not in the business of selling your information."

The blog post is painfully careful with word choice as the company attempts to pretend it doesn't monetize user data. For example throughout the post Comcast carefully insists it doesn't track the websites you visit "through your broadband connection," though it's possible to track that same data at the heart of Comcast's network (technically not "your connection"). Similarly, Comcast insists it "deletes the DNS queries generated by our Internet customers every 24 hours," even though 24 hours remains plenty of time to monetize that data. And the company insists it doesn't "sell information that identifies who you are to anyone" -- an obvious nod to the fact that Comcast anonymizes this data first before selling it (researchers have long noted this data isn't really anonymous).

As Comcast attempts to vilify efforts to secure DNS, it's attempting to lean on privacy credibility it doesn't actually have. If Comcast's such a big fan of privacy, why did it lobby ferociously to eliminate modest and popular FCC broadband privacy rules in 2016? Comcast has also expressed interest in charging users more money to protect their privacy, in effect making privacy a luxury option. Privacy has long been the last thing on the mind of most major telecom players, who've historically seen zero real oversight as they repeatedly lie about what they do with subscriber data.

Even if Comcast was being honest here (which researchers, Google, Mozilla, and consumer groups all say they're not), between the privacy and net neutrality fights, the company has made it abundantly clear it no longer has serious credibility on policy issues. Meaning that even if Comcast engineers had legitimate concerns with how encrypted DNS is being implemented, the company's repeated policy falsehoods have ensured nobody's going to be believing them anytime soon.

Filed Under: dns over https, doh, encrypted dns, isps, privacy
Companies: comcast

India Looking To Be The Next China, Sends Out Call For Bids On Massive Facial Recognition Program

from the a-testing-environment-containing-1.3-billion-subjects dept

India must be looking across the border at China and nodding approvingly. India is rolling up the global censorship charts, firing off thousands of takedown demands and court orders to American social media companies. The government also seems overly-concerned with "fake news" and has been abusing its national security laws to make social media posts (and sometimes their posters) disappear into the ether.

Tech advancements are increasing the capabilities of the government's multiple surveillance networks. The most immediate beneficiary has been the country's law enforcement, which has added pre-crime analytics to a tool chest containing thousands of cameras and their biometric add ons.

Citizens are also being saddled with digital IDs based on their fingerprints. The tech doesn't work as well as dozens of sci-fi movies led us to believe. The end result is people being unable to convince the government they are who they say they are, thanks to faulty tech or fingerprints that aren't in perfect enough shape to talk print readers into responding appropriately. This had led to people losing access to public assistance, sending the nation's most vulnerable residents into tailspins they may never recover from.

Since this modernization is all going so well, the Indian government wants to expand its biometric collections. The country is seeking to assemble one of the world's largest facial recognition databases, as well as everything needed to make use of it, including cellphone apps for cops running scans and searches while on patrol.

The daunting scope of the proposed network is laid out in a detailed 172-page document published by the National Crime Records Bureau, which requests bids from companies to build the project. Interested parties had until October 11 to submit their proposal.

Currently unnamed, the project would match images from the country's growing network of CCTV cameras against a database encompassing mug shots of criminals, passport photos and images collected by agencies such as the Ministry of Women and Child Development.

It's being done for the children. Or, at least, that's one of the talking points. New Delhi police have been using existing databases to identify and locate some of the country's 300,000 missing children. While this effort is noble and well-intentioned, the expansion of this to encompass pretty much anyone who walks past a government camera is a problem. This isn't about maintaining criminal databases to track suspects who are being sought by the government. It's about adding everyone to the database as quickly as possible and giving law enforcement discretionary access.

According to the bid solicitation document [PDF], this database will be filled with images in bulk from a large number of sources. Here's part of the requested feature list:

Capture face images from CCTV feed and generate alerts if a blacklist match is found.

Add photographs obtained from newspapers, raids, sent by people, sketches etc. to the criminal’s repository tagged for sex, age, scars, tattoos, etc. for future searches.

The system should have option to upload bulk subject images and generate alerts if any of the subject images matches with the registered faces in the database.

The proposed FRS system should have option to input face images in JPEG, PNG etc. image and search and generate face matches with the stored database.

The government wants something it may not be able to have, at least not as soon as it would like it. It wants a database filled with as many photos as it can upload and software that can match faces quickly, even if the person requesting it is a police officer carrying nothing more powerful than a mobile phone in an area with sketchy service. The bid document says the government expects database search results in 3 seconds or less, no matter where the search is performed or what device is being used.

The system shall be able to broadly match a suspect/criminal photograph with database created using photograph images available with Passport, CCTNS, ICJS and Prisons, Ministry of women and child development (KhoyaPaya) State or National Automated Fingerprint Identification System or any other image database available with police/other entity. Match suspected criminal face from pre-recorded video feeds obtained from CCTVs deployed in various critical identified locations, or with the video feeds received from private or other public organization’s video feeds.

The system should also auto-refresh database contents every 30 minutes to ensure anyone using it has access to the latest uploads. The government is also demanding the contractor provide the "latest and the best solution/algorithm of facial configuration."

The Indian government is asking for everything. The winning vendor will have 30 weeks to design and deploy the system. The government wants it live less than eight months after the contract is signed. Given the timetable, it's likely the Indian government will end up with something that doesn't work as well as it wants to, but will involve 1.3 billion beta testers. No worries though. It will only be people's freedom and privacy on the line when the system rolls out, turning India into China 2.0, but with less stress testing and more "we actually care about privacy" talking points.

Filed Under: facial recognition, india, privacy, surveillance