DOJ Boss Joins UK, Australian Gov't In Asking Facebook To Ditch Its End-To-End Encryption Plan

from the [stacks-exploited-bodies-higher]-MR-FACEBOOK-PLEASE dept

The DOJ seems to be handling its anti-encryption (a.k.a. "going dark") grief badly. I doubt it will ever reach "acceptance," but it is accelerating through the rest of the stages with alarming speed.

It went through shock first, personified by former FBI director Jim Comey, who insisted tech companies were offering encryption to:

A. Give the feds the middle finger
B. Enable all sorts of dangerous criminals
C. To act like children in a roomful of adults

"Denial" seems to have been bypassed completely. Instead, Comey (and others) repeated the "shock" stage, banging the table louder and louder in hopes of convincing everyone they were right.

They weren't right and encryption deployments continued.

The FBI and DOJ shifted quickly to anger. This was first displayed during the legal fight over the San Bernardino shooter's iPhone. The DOJ insisted a law nearly 230 years old gave it permission to force Apple to break encryption. Apple disagreed. The court disagreed. The FBI insisted this would be the death of us all and ignored outside offers to crack the phone while pursuing precedent it would never obtain.

The phone was eventually cracked by a third party and the FBI moved on, still clinging to its "going dark" narrative, even as vendor after vendor stepped up to provide phone-cracking tools. It also overstated the number of "uncrackable" devices in its possession by at least 6,000 devices. It has been nearly 17 months since the FBI promised to correct this count. It still has yet to provide an updated number.

The DOJ's new boss is carrying the (apparently unlit) torch for the FBI. He has demonized both end-to-end encryption and citizens who don't believe cops are blameless white knights standing between us and the collapse of civilization.

Now, he's moving the feds on to the next stage of grief: bargaining. A letter sent to Facebook -- sporting Barr's signature, along with other stalwart encryption foes like UK Home Dept. head Priti Patel and Australian MP Peter Dutton -- begs Facebook to please please please stop adding encryption to its services.

BuzzFeed obtained a draft report of the letter, which appears to be the charm offensive preceding the new US-UK data sharing agreement that targets encrypted communications. The letter contains some loaded language about child porn and its victims, suggesting Barr isn't done leaning on victimized children to advance his anti-encryption efforts. Hey, it didn't work for Comey, but maybe Bill Barr will get the horrific crime he needs to turn the public against their own best interests.

Here are some excerpts from the letter, as first published by BuzzFeed.

Dear Mr. Zuckerberg,

OPEN LETTER: FACEBOOK’S “PRIVACY FIRST” PROPOSALS

We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety and without including a means for lawful access to the content of communications to protect our citizens.

So, this is a request for a backdoor. (But one no government agency will refer to as a "backdoor.") "Lawful access" is law enforcement slang for "backdoor," kind of like "officer-involved shooting" is slang for "homicide" and "detected the odor of marijuana" is slang for "Fourth Amendment violation."

Barr (and his anti-encryption warriors) then attempt to call Zuck's bluff... um... I guess??

In your post of 6 March 2019, “A Privacy-Focused Vision for Social Networking,” you acknowledged that “there are real safety concerns to address before we can implement end-to-end encryption across all our messaging services.” You stated that “we have a responsibility to work with law enforcement and to help prevent” the use of Facebook for things like child sexual exploitation, terrorism, and extortion. We welcome this commitment to consultation. As you know, our governments have engaged with Facebook on this issue, and some of us have written to you to express our views. Unfortunately, Facebook has not committed to address our serious concerns about the impact its proposals could have on protecting our most vulnerable citizens.

And there it is. "Our most vulnerable citizens." Apparently that demographic group doesn't contain Facebook users. Facebook users will be fine, I guess, even if any number of malicious hackers/governments want access to communications no one on Facebook actually wants to share with them. "For the children" is the game here, and Barr forges forward with contradictory statements and terrible logic.

We support strong encryption, which is used by billions of people every day for services such as banking, commerce, and communications.

(But, pointedly, not Facebook communications.)

We also respect promises made by technology companies to protect users’ data. Law abiding citizens have a legitimate expectation that their privacy will be protected.

(Except from us.)

However, as your March blog post recognized, we must ensure that technology companies protect their users and others affected by their users’ online activities. Security enhancements to the virtual world should not make us more vulnerable in the physical world. We must find a way to balance the need to secure data with public safety and the need for law enforcement to access the information they need to safeguard the public, investigate crimes, and prevent future criminal activity. Not doing so hinders our law enforcement agencies’ ability to stop criminals and abusers in their tracks.

Ah, the famous tradeoff government officials always pitch, but one that isn't actually the tradeoff being made. It's not privacy vs. the security of the nation as a whole. It's personal security vs. government access that also grants access to criminals and state-sponsored hackers.

What people want is security. They're aren't really interested in trading security for government access. That does nothing for them. The government may solve a few more crimes, but the government was solving crimes long before cellphones, social media platforms, and end-to-end encryption.

Now, multiple governments feel they can't solve crimes without on-demand access to people's communications -- something they have never had in the history of crime-solving and communications. But here we are, listening to Barr and his buddies make a pitch for encryption backdoors while standing on the backs of child porn victims.

Barr makes this pitch while acknowledging that Facebook probably does far more than all US and UK law enforcement agencies combined to combat child porn.

Facebook currently undertakes significant work to identify and tackle the most serious illegal content and activity by enforcing your community standards. In 2018, Facebook made 16.8 million reports to the US National Center for Missing & Exploited Children (NCMEC) – more than 90% of the 18.4 million total reports that year. As well as child abuse imagery, these referrals include more than 8,000 reports related to attempts by offenders to meet children online and groom or entice them into sharing indecent imagery or meeting in real life. The UK National Crime Agency (NCA) estimates that, last year, NCMEC reporting from Facebook will have resulted in more than 2,500 arrests by UK law enforcement and almost 3,000 children safeguarded in the UK.

And yet, Barr wants to complain. Barr and his UK/Aussie counterparts want to claim this isn't enough. What's really needed is insecure communications on a platform used by billions. And to make this claim, Barr again points to something Facebook does as evidence that Facebook isn't doing enough.

While these statistics are remarkable, mere numbers cannot capture the significance of the harm to children. To take one example, Facebook sent a priority report to NCMEC, having identified a child who had sent self-produced child sexual abuse material to an adult male. Facebook located multiple chats between the two that indicated historical and ongoing sexual abuse. When investigators were able to locate and interview the child, she reported that the adult had sexually abused her hundreds of times over the course of four years, starting when she was 11. He also regularly demanded that she send him sexually explicit imagery of herself. The offender, who had held a position of trust with the child, was sentenced to 18 years in prison. Without the information from Facebook, abuse of this girl might be continuing to this day.

Here's what Barr thinks will happen if Facebook deploys end-to-end encryption. Facebook will no longer be able to "read" messages sent between users, which will result in an increase in abused children that authorities will be powerless to help.

Our understanding is that much of this activity, which is critical to protecting children and fighting terrorism, will no longer be possible if Facebook implements its proposals as planned. NCMEC estimates that 70% of Facebook’s reporting – 12 million reports globally – would be lost. This would significantly increase the risk of child sexual exploitation or other serious harms. You have said yourself that “we face an inherent tradeoff because we will never find all of the potential harm we do today when our security systems can see the messages themselves”. While this tradeoff has not been quantified, we are very concerned that the right balance is not being struck, which would make your platform an unsafe space, including for children.

"For children." That's the leverage. Barr wants Facebook to abandon its encryption plans to save children. Sure, that's admirable, if you're willing to overlook the considerable downside of creating a backdoor for governments or simply removing the encryption offer altogether. Facebook's encryption plans offer a whole new layer of security for lawful users -- some of which are targeted by authoritarian/corrupt governments. Many governments around the world pose as much of a threat to their citizens as criminals do. And a great many people believe their communications should be private, which means not being read/scanned by Facebook, much less any government that happens to stroll by waving some paperwork.

All Barr wants is for Facebook to abandon its encryption plans. He wants Facebook to be able to access the content of its users' messages. He wants every government in the world to be able to access the content of users' messages. He may only be aligned with three-fifths of the Five Eyes in this letter, but ensuring US/UK/Australian "lawful access" means giving every other two-bit dictatorship the same level of access to users' communications.

This isn't standard government bullshit. This is heinous, dangerous bullshit. This is a conglomerate of Western governments, on the eve of the deployment of a mysterious "data-sharing" agreement, portraying the implementation of encryption for communications as aiding and abetting the sexual abuse of children. This is a not-very-subtle smearing of every tech company that deploys encryption to protect its users from criminals and governments that behave like criminals. This is the abuse of the phrase "lawful access" to portray the possession of a warrant as a golden ticket to everything law enforcement wishes to obtain.

To be historically clear, a warrant has NEVER guaranteed access to communications. It has only allowed law enforcement to search for them. The implementation of encryption doesn't change this equation. But Barr and others keep pushing this in hopes of persuading the public -- and the tech companies they patronize -- that secret communications are something new and far more dangerous than anything law enforcement has ever encountered prior to the rise of social media and smartphones.

Filed Under: doj, encryption, mark zuckerberg, messenger, peter dutton, priti patel, privacy, security, snooping, william barr
Companies: facebook, instagram, whatsapp

Yet Another Study Shows The Internet Of Things Is A Privacy Shitshow

from the dysfunction-junction dept

Day in and day out, it's becoming increasingly clear that the smart home revolution simply isn't all that smart.

Security analysts like Bruce Schneier have been sounding the alarm bells for years now about the lax to nonexistent security and privacy standards inherent in the internet of broken things space. From refrigerators that leak your Gmail credentials to Barbie dolls that can be easily hacked to spy on kids, it's increasingly clear that dumber technology is often the smarter solution. Not only do many of these devices actually make us less secure, their lack of real security has resulted in their use in historically large DDoS attacks.

As if the point hadn't been made clear enough, a new joint study between Northeastern University and Imperial College London took a closer look at 81 popular smart door bells, dongles, TVs, and other gear, and came away notably unimpressed. The study, the biggest ever of its kind, found that the lion's share of such devices routinely share an ocean of data (your IP address, MAC address, location info, viewing preferences) with a massive array of third parties. Worse, many of these transfers were not properly secured, meaning they could be intercepted by another party:

"In a series of 34,586 experiments, the study found that 72 of the devices made contact with someone other than its manufacturer. In many instances, these transfers “expose information to eavesdroppers via at least one plaintext flow, and a passive eavesdropper can reliably infer user and device behavior from the traffic,” the researchers said."

One popular camera studied by the researchers pinged 52 different IP addresses every time it phoned home. And while some of the contact points were largely innocuous (cloud service providers, etc.), many of these devices were happily providing usage data to a wide variety of marketers and third parties without making those data transfers clear to the end user. Often many of the devices were routinely providing this data to companies like Netflix even if the end user didn't have a Netflix account. Much of this data is being used with other data sets to build complex behavioral profiles, again without this always being clear to users (a notable point of contention in the smart electricity meter space).

On the plus side, a number of high-profile wrist slaps on this front (like the $17 million paid by Vizio for spying on its users for 3 years, or the bad press Samsung got when its smart TVs were shown to be transmitting viewer voice data unencrypted to the cloud) have at least resulted in these companies beefing up their use of encryption, though that's a mixed blessing for those trying to study what data is being sent between your smart fridge and third parties:

"Choffnes told me that while the high profile wrist slaps of recent years have resulted in an increase in the use of encryption by vendors, that poses a double edged sword for researchers “One of the biggest challenges we face is that the same encryption that protects users' data from eavesdroppers also prevents us researchers from seeing what is inside,” he said."

Studies in both the UK and the US continue to highlight how privacy and security are just distant afterthoughts in the rush to sell more kit. Many of these devices aren't just overly chatty, they're extremely hackable. As security expert Bruce Schneier has long noted, there's no market solution to this problem because neither the hardware vendors nor the consumers actually care, given the privacy and security shortcomings (usually) only harm other people:

"The market can't fix this because neither the buyer nor the seller cares. The owners of the webcams and DVRs used in the denial-of-service attacks don't care. Their devices were cheap to buy, they still work, and they don't know any of the victims of the attacks. The sellers of those devices don't care: They're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution, because the insecurity is what economists call an externality: It's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

He's also long made the point that none of this is going to get fixed until there's some kind of massive calamity that makes the broader public finally take the problem more seriously. And with businesses and consumers attaching easily-compromised devices to their network at the rate of millions per year, it's a day that doesn't seem too far over the horizon.

Filed Under: iot, privacy

Telcos And Rupert Murdoch Pushing Nonsense Story That Google Helping Keep Your Internet Activity More Private Is An Antitrust Violation

from the oh-really-now? dept

There are all sorts of reasons and ways to hate on big internet companies these days, but as we've warned, some of them are in conflict with one another -- though that doesn't seem to stop those who keep pushing the narrative forward from blindly repeating them anyway. The latest is a positively bonkers article in the Wall Street Journal arguing that Google's (somewhat middle of the road) support for DNS over HTTPS (DoH) is potentially an antitrust violation worthy of Congressional action.

This is (1) utter nonsense and (2) driven by telcos looking to undermine consumer privacy. So if you're a pro-privacy Google hater, you might want to at least reconsider supporting this particular line of attack. If you are unaware, under the current DNS system, you still leak some key metadata every time you visit a site to your DNS provider (which is usually, but not always, your broadband/internet access provider). It used to be that those providers could collect even more, page-level, information, but that is less and less true as more and more of the web itself is encrypted with HTTPS. DoH is an attempt to encrypt the last bit of info that leaks when you surf -- the metadata about the top level domains you are visiting. Mozilla has been strongly pushing support for DoH, and will plan to move most public Firefox users to DoH in the relatively near future. Google, on the other hand, is supportive of the standard, but has shown no inclination to adopt it nearly as widely as Mozilla.

Either way, done correctly, DoH protects your privacy and stops the fairly large metadata loophole that has allowed DNS providers (generally your telco/broadband provider) from being able to snoop on everywhere you surf. There are some reasonable concerns that if browsers automatically force users to use specific DNS resolvers for DoH that it could, potentially, lead to more control/centralization of both those servers, but as EFF points out in the link above, that's mitigated by more ISPs simply adopting DoH themselves.

The problem, of course, is that the biggest telcos, such as AT&T, Verizon, and Comcast don't want to stop spying on you and all of your internet habits. And, so, rather than adopting DoH, they're trying to undermine DoH entirely by pretending that Google's lukewarm interest in supporting DoH is, itself, an antitrust violation. What's kind of incredible, however, is just how open they are about this plan, and that's it's entirely about preventing the big broadband providers from spying on your traffic:

“Because the majority of world-wide internet traffic…runs through the Chrome browser or the Android operating system, Google could become the overwhelmingly predominant DNS lookup provider,” a coalition of internet service providers said in a Sept. 19 letter to lawmakers. “Google would acquire greater control over user data across networks and devices around the world. This could inhibit competitors and possibly foreclose competition in advertising and other industries.”

They urged lawmakers to call on Google not to impose the new standard as a default standard in Chrome and Android.

Google, for it's part, reiterated (as it has in the past) that it has no plans to force users into using its own DNS offerings. While the Wall Street Journal report at least quotes some pushback on this claim, it still seems to present this mostly as a credible antitrust concern, when the reality is that it's clearly an attempt by big broadband players to play an antitrust card to (1) attack Google and (2) to prevent Google from helping consumers better protect their own internet privacy.

There are, of course, plenty of legitimate concerns that people have about Google's own privacy practices. But pushing people towards DoH is a good thing. A few months back we saw UK ISPs laughably attack Mozilla's plans to support DoH by calling the company an "internet villain" claiming that better protecting your privacy would undermine "internet safety standards." To be clear: this is nonsense. What they mean is, like with other forms of encryption, it might make a very tiny number of criminals marginally harder to track down. But, on the flip side, it will massively protect everyone else's privacy from overly snoop happy broadband providers.

We've noted for a while how hypocritical it is for people to focus on "antitrust" and "privacy" claims about the big internet companies, while ignoring the much larger problems on both fronts regarding broadband companies. Similarly, we've talked about how many of the attacks on "big tech" are quietly driven by the big broadband players quietly fanning the flames. But this story combines all of that. It's the big broadband players/telcos pushing a totally bogus monopoly story against Google (which makes no sense at all if you understand the details, and which wouldn't even be a potential monopoly concern at all if those very same broadband companies adopted DoH themselves), in order to stop Google from better protecting your privacy -- so that the broadband providers can better snoop on you.

And, a side note: Rupert Mudoch's Wall Street Journal has been one of the worst in pushing these misleading anti-Google/Facebook stories over the last few months, which is, again, no surprise at all, as it's been revealed before that Murdoch has been eager to attack Google and Facebook and has no problem using the Wall Street Journal to do so. While this story at least includes some balance, the entire narrative arc of it seems to follow the telcos talking points -- and it's notable that while it briefly quotes a section of the telcos letter to Congress, it fails to post the entire letter. I wonder why...

Either way, this kind of thing undermines any serious discussion of either privacy or competition online, by mixing up and conflating an attempt to better protect privacy, and pretending it's an antitrust violation.

Filed Under: antitrust, competition, dns over https, doh, privacy, rupert murdoch, snooping, telcos
Companies: google, mozilla

Ring Considered Using 911 Calls To Trigger Automated Streaming Of Camera Footage To Local PDs

from the bringing-the-police-state-home dept

Amazon's Ring doorbell/camera venture hasn't met a news cycle it can't fill with unintentionally-bad PR. Every time someone thinks they've heard the last odious effort by this company to become an unofficial extension of police department surveillance networks, another set of documents obtained through public records requests resets the counter to "zero days since last PR black eye."

To date, the company that's already formed partnerships with nearly 400 law enforcement agencies has:

• Instructed cops on how to obtain doorbell footage without a warrant
• Provided cops with info on how often their requests are rejected by citizens
• Written/re-written public statements involving Ring cameras for law enforcement agencies
• Engaged in a heavily-publicized sting operation that failed to net any criminals
• Denied it wants to implement facial recognition technology while employing a "Head of Facial Recognition Technology"

Here's the latest PR coup by the expert self-maligners, as reported by Alfred Ng for CNET:

Ring considered building a tool that would use calls to the 911 emergency number to automatically activate the video cameras on its smart doorbells, according to emails obtained by CNET. The Amazon-owned company isn't currently working on the project, but it told a California police department in August 2018 that the function could be introduced in the "not-so-distant future."

One email obtained by CNET expressed the company's desire to implement a "call-for-service" trigger for recording. And not just recording. The cameras would start streaming footage to police departments partnering with Ring to give them a live feed of the affected (triggered?) area. Ring doorbell users would have to opt in, at least, but the pressure to do so would obviously be increased if the users got their doorbell cameras for free from their friendly local PD.

It appears this plan has been ditched, which will allow Ring to steer clear of at least one more terrible news cycle. That being said, everything else that's bad about this private/public partnership remains true, which isn't going to somehow start being less bad any time soon.

Ring's stated prioritization of customer privacy continues to ring (sorry) hollow. The company pushes users and police departments to gravitate towards its snitch app, where users can be encouraged to "share" footage of "suspicious" events, relieving cops of the burden of requesting footage from users or Ring itself. Investigators can still approach Ring directly for camera footage if residents aren't willing to cooperate. Ring says it only complies with "lawful demands" for recordings. What it doesn't say it that the "lawful demand" is usually a subpoena, not a warrant.

This is working out well for Ring. It's probably also working out fine for local law enforcement agencies. The latter seems very willing to cede creative control to Ring, so whatever relationship these parties have must be beneficial enough that cop shops don't mind taking a backseat to Ring's spin team. Ring seems willing to ride out these turbulent news cycles without making any changes to its business model. And why should it? It has claimed over 95% of the doorbell/camera market and is living rent-free in the hearts and minds of over 400 law enforcement agencies.

Filed Under: 911 calls, doorbells, police, privacy, streaming
Companies: amazon, ring

Rich Dude Goes Back On His Promise About Forcing California Into A Dreadfully Bad Privacy Law, Brings A Worse Version Back

from the this-is-not-how-law-making-should-be-done dept

California is inching ever closer to having its very problematic privacy law take effect. As we've noted, while good privacy legislation would be desirable, this is not it. Indeed, this law is woefully undercooked by design. If you don't remember, the process by which we got here dictated terrible results. A wealthy real estate developer, Alastair Mactaggart, decided that he was going to "fix" internet privacy, by putting a truly bad proposal regarding internet privacy to a public vote, using California's somewhat horrific public referendum system -- that allows for the public to effectively modify California's constitution by popular vote.

While, in theory, this could be an example of popular democracy at work, in practice, the California referendum system has been a way for ultra-wealthy people, with too much time and money on their hands, to push through pet projects -- often either misrepresenting the nuances to the public, or perhaps not understanding them themselves -- and then locking California into the results. Recognizing just what an unmitigated disaster Mactaggart's referendum would have been for an open internet, a deal was cut: if California's legislature rushed through a privacy bill in two weeks, Mactaggart would drop the referendum from the ballot. And that lead to the woefully undercooked CCPA (California Consumer Privacy Act) law, which was at least marginally better than Mactaggart's nonsense proposal.

But, here's the thing, after agreeing to pull that referendum from the ballot, Mactaggart has now announced that he's bringing it back for the next ballot. Really.

The activist who spurred California to adopt the country’s first-ever consumer privacy law is readying for another battle: a new ballot initiative that would be even tougher on tech giants and other big businesses that collect people’s personal information.

The proposal, unveiled late Tuesday, is the brainchild of Alastair Mactaggart, a real estate developer whose efforts beginning two years ago resulted in the California Consumer Privacy Act, or CCPA. Building on that success, Mactaggart has set his sights on the 2020 election, hoping that local voters will enact reforms targeting the way companies harness data to make decisions or serve ads.

But, remember, the whole point of forcing through the undercooked CCPA was to get Mactaggart to back off his stupid referendum, but now it's back, meaning that there's just going to be more nonsense and fighting, to stop a ballot measure from a guy who has no clue what his proposal would actually do to the internet. And, because California's ballot measures are playthings for rich people, Mactaggart will likely get his way:

Mactaggart spent $3.1 million of his own money to gather signatures for his first privacy measure in 2018 and said he’s prepared to spend the same, or more, on this effort. He has said he came to the issue somewhat by accident after having a cocktail party conversation with a Silicon Valley technology engineer that left him startled when he learned about the kinds of information routinely being gathered, sold and bought by companies with relatively low public profiles.

Furthermore, he says he won't even back off this time:

One week before the 2018 deadline to certify the list of statewide propositions, Mactaggart and Democratic legislative leaders announced a compromise that was quickly signed by then-Gov. Jerry Brown.

Mactaggart doubted that he would do the same this time around.

“I don’t think any substantial gains like this are made in the Legislature,” he said. “I’m really happy what I did [in 2018]. It got us a beachhead. But I like the idea of having a new high-water mark that can’t be undone.”

So let's be clear: even if you agree with Mactaggart's position 100% and believe that his ballot initiative is good for personal privacy (which it is not), this is a horrible way to go about making privacy law. This is a rich guy, randomly throwing money at an issue that will get plenty of attention with almost no nuance or understanding, and setting levels that are nearly impossible to change, which will create all sorts of problems. It's not how policy should be made, no matter how you feel about privacy laws.

Filed Under: alastair mactaggart, california, policy making, privacy, referendum

AT&T Proclaims It Cannot Be Sued For Selling Your Location Data To Random Nitwits

from the ill-communication dept

You'll of course recall that wireless carriers are in the midst of a massive, ongoing scandal involving your location data. As in, they've been repeatedly caught collecting and selling your daily movement habits to a rotating crop of random nitwits, including stalkers and folks pretending to be law enforcement. And while they say they've stopped the practice there's no way to be sure, given that the current industry-friendly FCC has yet to pressure (or even mildly scold) them, much less conduct any real investigation into whether mobile carriers have actually stopped, or what they've done with location data collected over the last decade.

With regulatory capture ensuring that government is feckless in the face of the scandal, the EFF sued AT&T back in July on behalf of several California AT&T users who say they were never informed, nor gave consent, for their location data to be used and sold in this fashion. The lawsuit alleges that AT&T violated the Federal Communications Act by not protecting location data, and California's Unfair Competition Law and the Consumers Legal Remedies Act by misleading consumers as to the sale of this data. The group also pushed to have AT&T delete the trove of valuable location data it has already collected.

AT&T being AT&T, the company has responded by proclaiming that it cannot be sued because its customers have agreed to mandatory binding arbitration in their user contracts:

"AT&T is arguing that its customers can’t sue the company for selling location data to bounty hunters, according to recently filed court records. AT&T says the customers signed contracts that force them into arbitration, meaning consumers have to settle complaints privately with the company rather than in court."

For years, mobile carriers used contract fine print to prohibit its customers from suing them. Instead, users were forced to participate in binding arbitration, a system whereby company-employed arbitrators weigh the evidence -- and unsurprisingly rule in favor of the company employing them a dramatic majority of the time. Initially, lower courts repeatedly derided this behavior as an "unconscionable" curtailing of consumer rights and abuse of the law. But in 2011 the Supreme Court's AT&T Mobility v. Concepcion ruling declared that what AT&T was doing was perfectly okay, resulting in countless companies now following AT&T's lead.

AT&T's problem is this new case is pending in the US District Court for the Northern District of California. Last year this same court declared that AT&T couldn't use these binding arbitration agreements to avoid class action lawsuits over accusations AT&T had repeatedly lied to users about their "unlimited" data plans being throttled. Why? Because the California Supreme Court ruled in McGill v. Citibank that "an arbitration agreement that waives the right to seek the statutory remedy of public injunctive relief in any forum is contrary to California public policy and therefore unenforceable."

Enter AT&T, which is effectively arguing that because the EFF is only representing a handful of pissed off customers and not the public as a whole, that ruling doesn't apply:

" In the new case, AT&T argues that the McGill decision does not apply "because the injunctive relief Plaintiffs seek is directed at a subgroup of AT&T customers, not the general public as a whole."

Granted AT&T's tap dancing to avoid anything even vaguely resembling accountability is a thing to behold. Like other ISPs it had argued that states can't hold it accountable for wrong doing because it would violate the company's First Amendment rights. It has also tried to tap dance in and out of the lines of FTC and FCC authority making conflicting arguments on agency authority when convenient. Here, AT&T had previously denied that selling phone location data was illegal, despite the fact that Section 222 of the Communications Act clearly says it is "without the express prior authorization of the customer."

But other court rulings on other subjects (like this one on roaming fees in the Ninth Circuit U.S. Court of Appeals) have been poking holes in AT&T's arbitration arguments, suggesting it's not quite the bullet proof "get out of jail free card" AT&T's lawyers seem to think it is.

Filed Under: arbitration, data, privacy
Companies: at&t

Private Companies Gathering Plate Data Are Selling Access To People's Movements For $20 A Search

from the lojacking-humans dept

License plate readers are everywhere. Their existence is predicated on the assumption that traveling on public roads strips drivers of their privacy. To a certain extent this is true. But automation allows government agencies to reconstruct peoples' lives and movements by simply typing in a plate number and accessing the billions of image/location data records stored by ALPR manufacturers like Vigilant.

But it's not just a government thing. The new market for plate readers is residential neighborhoods, with purchases being made by home owners associations and others who feel they have a right to know who's traveling in and out of "their" neighborhoods.

Prior to this, though, ALPRs were already being utilized extensively by private entities. Insurance companies and repossession firms have been using plate readers for years, using them to track down vehicles after missed payments or those suspected of insurance fraud. Unlike the databases compiled by law enforcement agencies, these private databases can be accessed by nearly anyone for any reason.

That's exactly what Motherboard did. It found someone willing to offer up their license plate as a lab rat to see how much data was being harvested by a repo company's plate readers and ran a search.

Armed with just a car's plate number, the tool—fed by a network of private cameras spread across the country—provides users a list of all the times that car has been spotted. I gave the private investigator, who offered to demonstrate the capability, a plate of someone who consented to be tracked.

It was a match.

The results popped up: dozens of sightings, spanning years. The system could see photos of the car parked outside the owner's house; the car in another state as its driver went to visit family; and the car parked in other spots in the owner's city. Each was tagged with the time and GPS coordinates of the car. Some showed the car's location as recently as a few weeks before. In addition to photos of the vehicle itself, the tool displayed the car's accurate location on an easy to understand, Google Maps-style interface.

Unlike government databases, there are no rules protecting citizens from misuse or limiting long-term storage of plate photos. All that's preventing abuse is the limited language of each company's terms of service -- something these companies don't seem to spend too much time enforcing. Digital Recognition Network's (DRN) offering is "crowdsourced" from thousands of cameras mounted on hundreds of repo men's vehicles. It's a persistent, long-term database of vehicle movements controlled by a single company -- one that law enforcement also has access to, as if government agencies needed any more access to plate data.

It's also surprisingly cheap. $15,000 gets drivers a four-camera setup and access to the DRN database. Searches go for $20 per and paying $70 for a search provides the searcher with live updates when a searched plate is snagged by a plate reader. Customers love it. So do repossession outfits, whose drivers earn bonuses for racking up plate photos. And DRN loves the data it collects, which it packages for sale through other programs, like one specifically marketed to private investigators.

The potential for abuse is real. The Motherboard report notes that members of a closed Facebook group for private investigators was filled with messages asking others to run plates for them. DRN's official line on abuse prevention is pretty much a jargon-filled shrug.

Notably, DRN does not immediately ban someone for abusing the service, according to the contract. It reads that if DRN determines or suspects that the user has used the data for personal or non-business purposes, "Licensor [DRN] shall notify Licensee in writing of the alleged breach and give Licensee an opportunity to cure any curable breaches within 30 days of Licensee's receipt of such notice; thereafter Licensor may take immediate action, including, without limitation, terminating the delivery of, and the license to use, the Licensed Data."

There may be no "expectation of privacy" in driving on public streets. But I think most Americans would consider their privacy violated by the existence of a product that reconstructs their lives for the low, low price of $20 a search. Given that these companies are also selling access to law enforcement, they may yet find a way to trip over the Fourth Amendment. But until a company like DRN does, it's just another company doing what so many tech companies do best: harvest and sell data.

Filed Under: alpr, bounty hunters, license plates, location data, privacy

Denmark Releases 32 Prisoners Convicted Because Of Flawed Mobile Phone Tracking Data

from the but-how-many-more-to-come? dept

A few weeks ago, Techdirt wrote about Denmark reviewing 10,000 court verdicts because of errors in mobile phone tracking data that was offered as evidence in those cases. At that time, it wasn't clear how many of the group were affected by the unreliable data. However, the Guardian reports that 32 people have already been freed. Given the large number of cases involved, it seems unlikely that many have been reviewed in such a short space of time. If that's the case, it is possible that quite a few more verdicts will be overturned, and more people released. Companies providing mobile phone services in Denmark are naturally keen to distance themselves from this mess. Jakob Willer, speaking on behalf of the country's telecoms industry association, said it was not their job to provide evidence:

"We should remember: data is created to help deliver telecom services, not to control citizens or for surveillance," Willer said. He conceded it could be valuable to police, but insisted its primary purpose was to facilitate communication between users.

That's an important point. If the authorities wish to use this kind of data they need to take into account that it was never designed to track people, and therefore has limitations as evidence. Fortunately, Denmark's embarrassing discovery that an unknown number of over 10,000 verdicts may be based on unreliable evidence has been something of a wake-up call for the country's lawyers. Karoline Normann, the head of the Danish law society's criminal law committee, told Agence-France Presse:

"This situation has changed our mindset about cellphone data. We are probably going to question it as we normally question a witness or other types of evidence, where we consider circumstances like who produced the evidence, and why and how."

It's troubling that it didn't occur to the legal profession to do that before. Just because information comes from high-tech sources doesn't mean it is infallible or that it can't be challenged.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: csli, denmark, evidence, location info, location tracking, privacy

Twitter Stands Up For Devin Nunes' Parody Accounts: Won't Reveal Who's Behind Them

from the good-for-twitter dept

A couple weeks ago, we noted that the judge in Virginia presiding over Devin Nunes' bullshit censorial lawsuit against Twitter, some parody Twitter accounts, and political strategist Liz Mair, had demanded that Twitter reveal to the judge who was behind the two parody accounts (for "Devin Nunes' Cow" and "Devin Nunes' Mom.") As we pointed out at the time, this request was highly unusual. Yes, the judge was in the process of determining if the case did not belong in Virginia, so he wanted to know if the people behind the accounts were based in Virginia, but there are ways to do that that protect the anonymity of the account holders (anonymity being a 1st Amendment right). Specifically, he could have just asked whether or not the account holders appeared to be based in Virginia.

We also wondered if Twitter would refuse the request -- as it has done in the past. And the answer is yes. Twitter has told the judge it won't comply, but did say that neither of the account holders lived in Virginia -- which should satisfy the only legal reason why the judge might want to know who they were.

Twitter on Wednesday told the judge it does not intend to disclose the names of the authors of accounts known as Devin Nunes’ Cow and Devin Nunes’ Mom, according to documents obtained by McClatchy.

“Defending and respecting the user’s voice is one of our core values at Twitter,” a Twitter spokesperson said in response to questions about the court filing. “This value is a two-part commitment to freedom of expression and privacy.”

Twitter in a message to other defendants in the case said it told the judge that the authors of the accounts do not live or work in Virginia....

[....]

“Undersigned counsel has been in contact with lawyers who have advised Twitter that they represent, respectively, the user or users of the @DevinCow account and the user or users of the @DevinNunesMom account,” the letter states. “Each of those counsel has authorized me to inform the Court, through this letter, that their respective client or clients do not reside or work in Virginia and never used the account while physically present in Virginia.”

This is good to see, though it remains to be seen how the judge feels about Twitter pushing back on his request. Again, the whole case is ridiculous and should be thrown out for a whole variety of reasons. But it's already worrisome that the judge thought it was fine to unmask the parody account holders, even if he promised that he would keep the identities secret.

Filed Under: anonymity, devin nunes, devin nunes cow, free speech, jurisdiction, privacy
Companies: twitter

The DMV Is Selling Your Data To Vast Array Of Third Parties

from the dysfunction-junction dept

Another day, another data privacy scandal. This time the focus is on the Department of Motor Vehicles, which has been busted selling DMV user data to a laundry list of third parties, without always making such financial relationships or data transfers clear to patrons. Some of the data wound up being sold to the usual suspects (auto insurance companies being the most obvious), but much of it is routinely sold to more dubious third-party outfits and private investigators. And while some of the data is in bulk and "anonymized," we've long noted that doesn't mean what you think it does.

The collection and sale of sensitive user data is particularly problematic for those dealing with stalkers or other jackasses:

"The selling of personally identifying information to third parties is broadly a privacy issue for all and specifically a safety issue for survivors of abuse, including domestic violence, sexual assault, stalking, and trafficking," Erica Olsen, director of Safety Net at the National Network to End Domestic Violence, told Motherboard in an email. "For survivors, their safety may depend on their ability to keep this type of information private."

Granted all of this is perfectly legal due to the Driver's Privacy Protection Act (DPPA), a 90's law that critics say is in dire need of an update. That law was created in response to a series of abuses of DMV data, including the 1989 murder of actress Rebecca Schaeffer, after her killer obtained her home address from the DMV. And while the law was intended to stop the abuse of DMV data, it contained (surprise!) plenty of loopholes making it okay to sell this data to a wide variety of individuals, including PIs, bail bondsmen, and consumer credit reporting agencies.

While the data sold can vary from state to state, it generally includes names, addresses, zip codes, dates of birth, phone numbers, and email addresses. The documents obtained by Motherboard show that the Wisconsin DMV, for example, has personal data sales relationships with more than 3,100 different entities. The practice is, unsurprisingly, hugely profitable:

"DMVs are making a lot of money from the sale of this data. The Rhode Island DMV made at least $384,000 selling personal data between 2015 and this year, according to a spreadsheet obtained by Motherboard. When asked how much the Wisconsin DMV made from selling driver records, a spokesperson wrote in an email "Per these 2018 DMV Facts and Figures, $17,140,914 was collected in FY18 for driver abstract fees." Examining that document shows that Wisconsin's revenue for selling driver records has shot up dramatically since 2015, when the sale drew in $1.1 million. The Florida Department of Highway Safety and Motor Vehicles made $77 million in 2017 by selling data, a local outlet found."

Most DMVs say that they inform customers (in fine print) that their data may be sold, and that they've cut off access to data by firms that they've found to have abused the access. But given the wild west nature of US privacy law (read: we don't have many and the ones we do have are riddled with issues and loopholes), there's not much of a mechanism to confirm this data isn't being abused, or that DMVs are doing a particularly good job of dealing with issues when the data is being access by malicious parties. In response to the investigation, Presidential hopeful Bernie Sanders demanded more comprehensive oversight:

"The DMV should not use its trove of personal information as a tool to make money. While the internet has been an enormous source for good, all that convenience and connection has come with a price: our privacy has been invaded in an unprecedented way, in a manner that would have been unthinkable even 20 years ago. Nobody—from agencies like the DMV to large corporations like Facebook and Google—should be profiting from sharing or selling personal information without meaningful consent. Congress must get serious about ending practices that violate the privacy of ordinary Americans.

Granted it's hard to reform US privacy law when a broad coalition of industries are using every lobbying trick in the book to prevent said reform from taking place. And while a lot of companies publicly state they want a new privacy law, what they really mean is for Congress to pass another flimsy, loophole-filled law their lawyers wrote, that will primarily serve to pre-empt more comprehensive state and federal privacy proposals.

Filed Under: data, dmv, privacy, selling data