Palantir Presentations Show How The LAPD Is Able To Turn Tons Of Garbage Data Into Ineffective Policing

from the money-for-nothing dept

Palantir is raking in millions. It's your surveillance provider, whether you -- the valued customer target -- had any say in the matter or not. Data comes in from all over and Palantir helps law enforcement make sense of it. Haystacks are useless. "Drilling down" -- to use official Palantir parlance -- is everything. Whether it's ICE or your local PD, Palantir is turning data into arrests… or at least stops/frisks and low-level harassment.

Palantir gives law enforcement something roughly aligned with predictive policing. Predictive policing has given itself a bad name over the years by relying on dirty data supplied by cops who target minorities under the bigoted assumption that that's where the crime is. Palantir doesn't use that term but its analytics provide the same outcome: garbage results from garbage data.

And there's oh so much data. Everything cops own gets fed into the system: millions of license plate photos from ALPRs, every piece of detritus generated by police reports, gang databases that think residents are gang members because they happen to live in gang territory, etc. And it adds in everything else: state license plate databases, regional crime center reports, the bullshit crafted by DHS-led "fusion centers." Everything goes in and Palantir helps craft what comes out.

Documents obtained by BuzzFeed show how much crafting Palantir does and how much minute detail its software allows officers to fiddle with. It's not cheap, but agencies like the Los Angeles Police Department feel it's worth it.

Palantir is expensive, and police departments often struggle to afford it. Between 2015 and 2016, the LA Mayor’s Office of Public Safety got the money to pay for Palantir from the federal government — specifically, from the Federal Emergency Management Agency’s Urban Areas Security Initiative (UASI) Program, which gives cities technology to "prevent, protect against, mitigate, respond to, and recover from acts of terrorism."

It’s unclear if the LAPD always used federal UASI money to pay for Palantir, or if it only used federal money in those years. But purchase orders show that Palantir software upgrades and user licenses cost hundreds of thousands to millions of dollars.

Do law enforcement agencies get what they pay for? Well, that depends on who you ask. The LAPD thinks it's a sound investment. Critics say it's nothing more than the public paying their public servants to spy on them in granular detail. Whatever it is, it's profitable for Palantir and very, very popular within the LAPD.

Palantir is no small thing within the LAPD. Almost 5,000 people, more than half of all LAPD officers had accounts on Palantir, according to an “LAPD Palantir Usage Metrics” document. The same document says that in 2016, those officers ran 60,000 searches in support of more than 10,000 cases.

Starting with little more than an alias or a distinctive tattoo, LAPD officers can begin rebuilding a person's life as compiled by the Department's numerous data inputs. Searching by sex, race, and distinctive markings, officers running searches can access names, email addresses, warrants, mugshots, physical addresses, personal relationships, employers, and anything else that may get swept into the mix.

Here's a very broad overview of how it works:

For the LAPD, Palantir swallowed up the contents of several major databases that were previously spread across public safety agencies throughout Los Angeles and the state, including incident reports, arrests, citations, license plate reader data, field interviews, recovered vehicles, warrants, booking photos, and data from the California Law Enforcement Telecommunications System, and the county’s Community Health Services data. Palantir algorithmically organizes this data, determining possible links between the people within it (e.g., “Sally was interviewed by police in a report about Fred”) and makes it searchable.

But is all this data getting the job done? The LAPD has been using Palantir's software for more than a decade. The Department killed off its predictive policing software earlier this year, citing its cost. But it could have just as easily cited its inability to do much more than subject overly-harassed residents to more harassment by mistaking past crime results for future criminal activity.

What about Palantir? Its decade at the LAPD doesn't appear to have had much of an impact. Violent crime rates in 2019 are about the same as they were in 2009. While homicide and robbery have declined slightly, aggravated assault has increased. (So have the number of rapes reported, but that may have more to do with more rape victims coming forward than an increase in rapes.) The numbers for non-violent crime are better, with big reductions in burglary and vehicle thefts.

But the Palantir-enabled LASER (Los Angeles Strategic Extraction and Restoration) program doesn't appear to have done anything a system utilizing less always-on surveillance could have accomplished. Garbage data gave cops garbage to work with, resulting in a lot of attention being paid to people who weren't causing any problems.

Out of the 637 Chronic Offenders identified by the LAPD, 44% were never arrested for a violent or gun-related crime, despite LASER's attempt to target violent crime. And 10% of Chronic Offenders had zero contacts with police — meaning zero arrests and zero mentions in field interviews. Per LASER’s guidelines, 100% of Chronic Offenders should have already been arrested for a violent crime.

[...]

It also couldn't find evidence that LASER reduced crime. The report said that in 6 out of the 13 LASER Zones, violent crime rates were “the same as, or worse than, those for non-LASER Zones.”

LASER is now dead, thanks to budget issues, COVID-19, and an oversight report the LAPD couldn't credibly contradict. But LASER is still very much alive, doing business under a less memorable name. And it's still powered by Palantir. It's called "Data-Informed, Community-Focused Policing." It sounds friendly, but it's worse than its predecessor.

The new plan formally expands the surveillance that began under LASER. Under LASER, the LAPD said people who were arrested for violent or gun-related crimes could be surveilled. Now, people suspected of nonviolent property crimes can also be.

And for being cutting edge, it clings to some really old fashioned ideas. The presentation for the new LASER says crime can be prevented by "physical maintenance and general upkeep" of property. Broken windows policing is back. And it's got a shiny, high-tech sheen thanks to Palantir.

Filed Under: data, lapd, predictive policing
Companies: palantir

ICE Is Hauling In More Data Than Ever And Palantir Is Helping It Turn Data Into Detainments

from the surveillance-state-adds-surveillance-capitalism dept

ICE has gotten bigger and bolder under the Trump Administration. The minimal constraints placed on it by previous administrations have been removed, allowing the agency to gorge on data and engage in widespread surveillance. Billions of dollars and an untold amount of tech are being thrown at a "problem" that isn't even criminal. Living in this country while undocumented is a civil violation, but ICE (and the Administration) treats it as one of the most severe threats to the nation.

America is apparently going to be made great by tossing out those aspiring to be Americans, or at the very least just trying to escape the horrors or poverty of their native countries. To ensure ICE can remove as many people as possible, the agency has tapped into national ALPR databases, run facial recognition searches against drivers license databases, and hooked up with a tech company nearly as reviled as ICE is.

But that's not the full extent of ICE's surveillance/deportation efforts. As Alvaro M. Bedoya reports for Slate, the agency is leveraging everything it can get it hands on to ensure a steady flow of undocumented immigrants out of this country.

In 2017, breaking with prior practice, ICE started to use data from interviews with scared, detained kids and their relatives to find and arrest more than 500 sponsors who stepped forward to take in the children. At the same time, ICE announced a plan for a social media monitoring program that would use artificial intelligence to automatically flag 10,000 people per month for deportation investigations. (It was scuttled only when computer scientists helpfully indicated that the proposed system was impossible.)

And it's not enough for immigrants to steer clear of the entities that may help them get ejected from the country. ICE is all over anything that might lead it to more deportees.

Many immigrants avoid contact with any government agency, even the DMV, but they can’t go without heat, electricity, or water; ICE aimed to find them, too. So, that same year, ICE paid for access to a private database that includes the addresses of customers from 80 national and regional electric, cable, gas, and telephone companies.

There's a private company weaving this massive amount of data into usable intel for ICE. Palantir provides the software that analyzes data, builds profiles, and makes sense of ICE's massive data stash. The company even fills in any blanks ICE might have by adding in information purchased from data brokers.

Palantir doesn't like to talk about its work with ICE. Bedoya points out the company's most recent securities filing makes no mention of ICE or the company's assistance in tracking down undocumented immigrants. It prefers to discuss its military customers and its supposed commitment to keeping this country safe. When asked directly about ICE, Palantir has downplayed its involvement. This is how Palantir's CEO, Alex Karp, spins things.

When criticized, Karp has described Palantir’s work for ICE as “limited,” “a de minimis part of our work”—strange things for American contractor to say about its second-largest U.S. government client.

This toxic partnership has done little to damage Palantir's reputation -- at least as far as investors are concerned. Its work with ICE targets what many consider to be unimportant people: immigrants who are in the country illegally. If the company is good at what it does and customers like ICE are happy and willing to sign multi-million dollar contracts, any moral and legal qualms shareholders might have will be papered over with money.

Filed Under: big data, data, deportation, dhs, ice, immigration, trump administration
Companies: palantir

If We're So Worried About TikTok, Why Aren't We Just As Worried About AdTech And Location Data Sales?

from the you're-not-being-consistent dept

We've noted a few times how the TikTok ban is largely performative, xenophobic nonsense that operates in a bizarre, facts-optional vacuum.

The biggest pearl clutchers when it comes to the teen dancing app (Josh Hawley, Tom Cotton, etc.) have been utterly absent from (or downright detrimental to) countless other security and privacy reform efforts. Many have opposed even the most basic of privacy rules. They've opposed shoring up funding for election security reform. Most are utterly absent when we talk about things like our dodgy satellite network security, the SS7 cellular network flaw exposing wireless communications, or the total lack of any meaningful privacy and security standards for the internet of broken things.

As in, most of the "experts" and politicians who think banning TikTok is a good idea don't seem to realize it's not going to genuinely accomplish much in full context. Chinese intelligence can still glean this (and much more data) from a wide variety of sources thanks to our wholesale privacy and security failures on countless other fronts. It's kind of like banning sugary soda to put out a forest fire, or spitting at a thunderstorm to slow its advance over the horizon.

Yet the latest case in point: Joseph Cox at Motherboard (who has been an absolute wrecking ball on this beat) discovered that private intel firms have been able to easily buy user location data gleaned from phone apps, allowing the tracking of users in immensely granular fashion:

"A threat intelligence firm called HYAS, a private company that tries to prevent or investigates hacks against its clients, is buying location data harvested from ordinary apps installed on peoples' phones around the world, and using it to unmask hackers. The company is a business, not a law enforcement agency, and claims to be able to track people to their "doorstep."

This, of course, comes on the heels of countless scandals of this type, where app makers, telecoms, or other companies collect and monetize your sensitive location data with zero meaningful oversight and little to no transparency, selling it to any nitwit with a nickel. The global adtech location surveillance market is such a complicated mess, even experts and journalists have a hard time tracking what data is being collected and who it's being sold to:

"The news highlights the complex supply chain and sale of location data, traveling from apps whose users are in some cases unaware that the software is selling their location, through to data brokers, and finally to end clients who use the data itself. The news also shows that while some location firms repeatedly reassure the public that their data is focused on the high level, aggregated, pseudonymous tracking of groups of people, some companies do buy and use location data from a largely unregulated market explicitly for the purpose of identifying specific individuals."

Do folks hyperventilating about TikTok not realize Chinese intelligence can also access this data? If so, why haven't I seen equal histrionics in relation to location data from folks like Josh Hawley? This massive, international network of telecoms, adtech vendors, and data brokers are engaged in wholesale, largely unaccountable surveillance of vast swaths of human beings. And yet, outside of a few lawmakers like Ron Wyden, countless lawmakers and regulators who've risked embolism with their TikTok outrage have been utterly silent when it comes to the threats posed by companies like HYAS:

"HYAS differs in that it provides a concrete example of a company deliberately sourcing mobile phone location data with the intention of identifying and pinpointing particular people and providing that service to its own clients. Independently of Motherboard, the office of Senator Ron Wyden, which has been investigating the location data market, also discovered HYAS was using mobile location data. A Wyden aide said they had spoken with HYAS about the use of the data. HYAS said the mobile location data is used to unmask people who may be using a Virtual Private Network (VPN) to hide their identity, according to the Wyden aide."

Either you care about U.S. data security and privacy or you don't, and I'm beginning to suspect that most of the folks who think TikTok poses an existential threat to the republic aren't engaging in a good faith understanding of the actual problem. With no privacy rules, transparency, or consistency we're a sitting duck for malicious actors, be they state-sponsored hackers, sex offending jackasses, or U.S. law enforcement officers out over their skis.

Want to genuinely shore up U.S. security and privacy problems? Pass a simple but meaningful privacy law for the internet era. Fund election security reform. Shore up our communications network security. Stop hamstringing and defunding privacy regulators at the FTC. Mandate transparency in the adtech market. Create some unified standards for the privacy dumpster fire that is the internet of things. Hyperventilating over a single Chinese-owned teen dancing app, then acting as if you've cured cancer is dangerous, counterproductive, and aggressively stupid in full context.

Filed Under: adtech, data, data brokers, location, location data, privacy
Companies: tiktok

Tim Wu Joins The Ban TikTok Parade, Doesn't Clarify What The Ban Actually Accomplishes

from the fluff-and-nonsense dept

I've mentioned a few times that I don't think the TikTok ban is coherent policy.

One, the majority of the politicians pearl clutching over the teen dancing app have been utterly absent from other privacy and security debates (say like U.S. network security flaws or the abuse of location data). In fact, many of them have actively undermined efforts to shore up U.S. privacy and security, whether we're talking about the outright refusal to fund election security improvements, or repeated opposition to even the most basic of privacy laws for the modern era. Let's be clear: a huge swath of these folks are simply engaged in performative, xenophobic politics and couldn't care less about U.S. privacy and security.

Two, banning TikTok doesn't actually accomplish much of anything. It doesn't really really thwart Chinese intelligence, which could just as easily buy this data from an absolute ocean of barely regulated international adtech middlemen, obtain it from any one of a million hacked datasets available on the dark net, or steal it from the, you know, millions upon millions of "smart" and IOT devices we attach to our home and business networks with no security and reckless abandon. In full context of the U.S., where privacy and security standards are hot garbage, the idea that banning a Chinese teen dancing app does all that much is just silly.

That said, I remain surprised by the big names in tech policy who continue to believe the Trump administration's sloppy and bizarre TikTok ban accomplishes much of anything. Case in point: Columbia law professor Tim Wu, whose pioneering work on net neutrality and open platforms I greatly admire, penned a new piece for the New York Times arguing that a "ban on Tiktok is overdue." Effectively, Wu argues that because China routinely bans U.S. services via its great firewall, turnabout is fair play:

"For many years, laboring under the vain expectation that China, succumbing to inexorable world-historical forces, would become more like us, Western democracies have allowed China to exploit this situation. We have accepted, with only muted complaints, Chinese censorship and blocking of content from abroad while allowing Chinese companies to explore and exploit whatever markets it likes. Few foreign companies are allowed to reach Chinese citizens with ideas or services, but the world is fully open to China’s online companies."

Wu proceeds to insist that refusing to behave like China and ban their products in retaliation is somehow a sucker's bet:

"Some think that it is a tragic mistake for the United States to violate the principles of internet openness that were pioneered in this country. But there is also such a thing as being a sucker. If China refuses to follow the rules of the open internet, why continue to give it access to internet markets around the world?"

This being 2020, I suppose I'm not surprised to see the guy who invented the idea of net neutrality advocate that the United States begin behaving more like one of the most repressive countries on the planet in regards to technological openness. The piece doesn't spend much time (read: none whatsoever) pondering what becomes of the millions of young U.S. content creators who'll suddenly lose their platform or be shoveled off to Facebook's dull TikTok clone.

I don't agree, but at least understand why retaliation is the default instinct for so many folks on this subject given China's longstanding behavior. My problem, again, is that Wu's piece lacks any mention of what this singular ban of a teen dancing app actually accomplishes. So we ban TikTok, then what? Do we ban every single Chinese-made "smart" television in the country (TCL has a 16.5% market share)? Every single IOT device? Every crappy Chinese-made router? All global adtech? They're all technically the same type of threat, and if you're freaking about one of them, shouldn't you be advocating for a ban of all of them?

Many TikTok hyperventilators would immediately say, "yes!" We're to ignore that American governance can't even currently tie its own shoes, much less help its citizens obtain food, shelter, and aid during an avoidable health crisis. A ban on all domestic Chinese hardware, software, adtech, apps, and services (something you'd need to do to truly follow this retaliatory logic to its ultimate conclusion) is likely impossible. Context matters. And in full context, American security and privacy standards are a dumpster fire, TikTok is among the very least of our worries, and a much broader view of our security and privacy problems is necessary.

If we genuinely wanted to protect U.S. consumer data from bad actors, we'd be funding a major expansion in election security reform. We'd stop kneecapping and under-funding our privacy regulators. We'd pass a basic privacy law for the internet era. We'd hold adtech, telecom, and "big tech" companies genuinely accountable for violating consumer trust. We'd shore up the integrity of our communications networks. We'd help develop and implement security standards for IOT devices. We'd build a coherent framework of policy that protects consumers and businesses from all threats, not just Chinese apps.

To be abundantly clear we aren't doing this. We're not even anywhere close to doing this. Instead, we've spent the last month freaking out over a teen dancing app (when we weren't busy trying to ruin encryption). Despite the growing list of big policy names that somehow think this proposal makes sense, I still don't see the point.

Filed Under: apps, bans, china, data, great firewall, tim wu
Companies: bytedance, tiktok

Google Warns Australians That The Government's Plan To Tax Google To Give Money To Newspapers Will Harm Search & YouTube

from the a-bad-deal dept

Earlier this year we noted that the Australian government was setting up a you're-too-successful tax on Google and Facebook which it planned to hand over to media organizations. We should perhaps call it the "Welfare for Rupert Murdoch" tax, because that's what it is. Murdoch, of course, owns a huge share of media operations in Australia and has been demanding handouts from Google for years (showing that his claimed belief in the free market was always hogwash).

In response, Google has now released an open letter to Australians pointing out that this plan to tax Google to funnel money to Murdoch will have massive unintended consequences. In particular, Google argues, under the law, Google would be required to give an unfair advantage to big media companies:

You’ve always relied on Google Search and YouTube to show you what’s most relevant and helpful to you. We could no longer guarantee that under this law. The law would force us to give an unfair advantage to one group of businesses - news media businesses - over everyone else who has a website, YouTube channel or small business. News media businesses alone would be given information that would help them artificially inflate their ranking over everyone else, even when someone else provides a better result. We’ve always treated all website owners fairly when it comes to information we share about ranking. The proposed changes are not fair and they mean that Google Search results and YouTube will be worse for you.

Even more to the point, in a cynical demand for "transparency" the law would actually create privacy problems for Australians by forcing Google to cough up info on its users to Australian media businesses:

You trust us with your data and our job is to keep it safe. Under this law, Google has to tell news media businesses “how they can gain access” to data about your use of our products. There’s no way of knowing if any data handed over would be protected, or how it might be used by news media businesses.

Australia's "competition watchdog" who was tasked with creating this legislation in the first place claimed that the letter was "misinformation."

“Google will not be required to charge Australians for the use of its free services such as Google Search and YouTube, unless it chooses to do so.”

The ACCC also reiterated that Google will “not be required to share any additional user data with Australian news business unless it chooses to do so”, as is outlined in the code.

“The draft code will allow Australian news businesses to negotiate for fair payment for their journalists’ work that is included on Google services,” the watchdog added.

Of course, if you look at the details of the draft code, it's actually the ACCC that is spreading misinformation here, and Google's concerns seem entirely substantiated. First, it's notable that the ACCC flat out says that the law is designed specifically just to impact Facebook and Google, though other companies could be added if bureaucrats in Austalia decided those companies got too big. This is astounding in its own way. In the US Congress isn't supposed to create laws that explicitly are designed to deal with a single company, but Australia has no apparent problem with that. Similarly, this kind of law would violate the 1st Amendment. That's because it's set up to benefit news organizations -- but only news organizations that the Australian government deems to "adhere to appropriate professional editorial standards." In other words, if the government doesn't like you, you might not qualify.

But the details in the draft also very much support Google's publicly stated concerns. It would require Google (and Facebook) to give these specially privileged news organizations all sorts of information (some of it quite crazy):

• give news media businesses at least 28 days’ notice of:
  • algorithm changes likely to materially affect referral traffic to news;
  • algorithm changes designed to affect ranking of news behind paywalls; and
  • substantial changes to display and presentation of news, and advertising directly associated with news, on digital platform services;
• give news media businesses clear information about the nature and availability of user data collected through users’ interactions with news on their services;
• publish proposals to appropriately recognise original news on their services;
• provide flexible user comment moderation tools for news media businesses; and
• allow news media businesses to prevent their news being included on any individual digital platform service

First off, the idea that Google would need to alert media orgs to any algorithmic change is crazy. At the very least, it gives those organizations the ability to game the system. As Google said, it gives an unfair advantage.

Second, giving news businesses "clear information about the nature and availability of user data" is an issue. While the draft proposal tries to suggest that this doesn't violate privacy because it's not giving the news orgs the actual underlying user data, just (effectively) the metadata of what is collected, that's not at all accurate either. As we've discussed in the past regarding government surveillance, the metadata about the data can be just as, if not more, valuable.

I know it's trendy to hate on Google, but this proposal in Australia is downright insane. It truly is welfare for Rupert Murdoch because he's jealous of the success of Google and Facebook, and that's just nuts.

Filed Under: algorithms, australia, data, google tax, journalism, news, news aggregation, news industry, rupert murdoch, search
Companies: google

The Idea That Banning TikTok Thwarts Chinese Intelligence In Any Way Is Ridiculous

from the sitting-at-the-kid's-table dept

As we've noted a few times, not much about the Trump administration's ban of TikTok makes coherent sense. Most of the biggest TikTok pearl clutchers in the GOP and Trump administration have actively opposed things like basic US privacy laws or even improving election security, and were utterly absent from efforts to shore up other privacy and problems, be it the abuse of cellular location data or our poorly secured telecom infrastructure. It's a bunch of xenophobia, pearl clutching, and performative politics dressed up as serious adult policy that doesn't even get close to fixing any actual problems.

And yet, many reporters and internet experts keep parroting the idea that banning TikTok somehow "protects U.S. consumers" or "prevents the Chinese government from obtaining U.S. consumer data." You're to ignore that Americans install millions of Chinese-made "smart" TVs, fridges, and poorly secured IOT gadgets on home and business networks with reckless abandon. Or that international corporations not only sell access to consumer data to any nitwit with a nickel, they often leave it unencrypted in the cloud. Or that the U.S. has no privacy law for the internet era, and corporations routinely see performative wrist slaps for privacy and security incompetence.

The idea that Chinese intelligence, with zero scruples and an unlimited budget, "needs" TikTok access to spy on Americans' data in this environment is just silly nonsense. Any yet, here we are.

It's all even more absurd when you consider the scope and complexity of global adtech markets. As Gizmodo's Shoshana Wodinsky recently explored, international adtech is a complex, unaccountable monster. This orgy of consumer tracking, behavioral data, and "anonymized" (read: not actually anonymous at all) datasets is so complex, even folks that cover the sector have a hard time understanding it. Thinking we can control what data the Chinese government is gleaning from this tangled web -- or that even selling TikTok to Microsoft somehow "fixes" anything -- is an act of hubris in full context:

"Over time, what’s become very, very clear is that while, say, Google and Facebook and TikTok are ultimately at the whims of local regulators, the same can’t be said about the digital Rube Goldberg machine of platforms, subsidiaries and shady third-parties these companies use to churn our data into massive profits. Our current digital economy, to a certain degree, depends on global ties that are built to run far deeper than any ban or buyout could ever hope to touch.

Or, to put it more bluntly: If Trump’s real concern is keeping the data of our squeaky clean American phones out of the clutches of that dirty, no-good communist adversary China, then Microsoft buying TikTok won’t do shit—our data is making its way from U.S. companies to servers in China constantly, regardless of who owns TikTok."

Thinking a ban of one Chinese teen dancing app addresses any of this is just absurd. Similarly, the idea that our defunded, understaffed, and kneecapped privacy regulators at the FTC can actively track or manage any of this (without serious reform, more staff, and a bigger budget) is equally silly:

As Wodinsky notes, if this market is so large that journalists, experts, and privacy and security regulators can't ferret out where your data winds up and who is actively cashing in on access to it, the idea that banning or selling TikTok is some mystical foil for one of the most powerful intelligence-gathering governments on the planet is a bizarre pipe dream:

"The wonderful world of digital advertising is built on black boxes inside of black boxes inside of black boxes. This means that there’s a good chunk of people who work at these companies who likely can’t tell you exactly where your name, your phone number, your precise location, or other personal data might actually end up."

And yet if you read numerous press reports and analyst insights into the TikTok fracas, they'll fail utterly to include any of this as essential context, which in turn lets the Trump administration pretend that this political tap dance is actually helpful internet policy.

Filed Under: china, data, espionage, surveillance
Companies: tiktok

Congressional Reps Want To Know Why The California DMV Is Making $50 Million A Year Selling Driver Data

from the time-to-start-cutting-the-public-in-on-the-scam dept

Congressional legislators -- apparently caught off guard by one state's revenue stream -- are asking the California Department of Motor Vehicles a $50 million question: why the hell are you selling residents' personal data?

A group of nearly a dozen lawmakers led by member of Congress Anna Eshoo wrote to the California Department of Motor Vehicles (DMV) on Wednesday looking for answers on how and why the organization sells the personal data of residents. The letter comes after Motherboard revealed last year that the DMV was making $50 million annually from selling drivers' information.

As Karl Bode noted last year when covering this revelation, this sale of data is codified. The Driver's Privacy Protection Act doesn't do much to protect drivers' privacy. It may prevent abuse of this data by government employees but none of that affects private sector access where the real money is made.

The data from the California DMV is sold to a variety of data brokers. The public records request that resulted in this windfall of transparency about the DMV's windfall of actual money didn't name any of its customers. But did show a steady increase in revenue over the five years the records covered.

The letter [PDF] signed by nine members of Congress -- including California Congressional rep Ted Lieu -- asks the DMV a lot of pointed questions about its practice of profiting off data Californians are forced to hand over in exchange for licenses. It asks the questions the records obtained by Motherboard left unanswered. First off, the legislators want to know who this data is being sold to.

What types of organizations has the DMV disclosed drivers’ data to in the past three years? In particular, has the DMV sold or otherwise disclosed data to debt collection agencies, private investigators, data brokers, or law enforcement agencies?

Has the DMV ever disclosed drivers’ photos to federal, state, or local law enforcement agencies or given such agencies access to a database of drivers’ photos?

What specific fields of personal information have been sold or disclosed to third parties by the DMV in the past three years?

Have Social Security numbers or driver’s license photos ever been disclosed?

The legislators also want to know if this data is being shared with ICE and other federal agencies for the purposes of locating undocumented immigrants. It also asks if Californians can ask to opt out of the data sales/sharing and whether the agency would honor any of these requests.

The legislators note that they're concerned about this practice they probably should have already been aware of -- especially the two California assembly members who also signed the letter.

[W]e’re troubled by press reports about the California DMV’s disclosure of vast quantities of data which could enable invasive biometric policing and be a symptom of a deeper privacy malady. [...] What information is being sold, to whom it is sold, and what guardrails are associated with the sale remain unclear.

The DMV has already answered some of these questions... sort of. In a statement to Motherboard, the DMV said the $50 million/year it makes on data sales only offsets the cost of "administering its requester program." It denies selling information to marketers. It did not deny selling info to data brokers or other common customers for DMV data, like credit reporting agencies.

"The DMV takes its obligation to protect personal information very seriously. Information is only released according to California law, and the DMV continues to review its release practices to ensure information is only released to authorized persons/entities and only for authorized purposes. For example, if a car manufacturer is required to send a recall notice to thousands of owners of a particular model of car, the DMV may provide the car manufacturer with information on California owners of this particular model through this program," the statement added.

"Only released according to California law." That's the problem. The law allows the DMV to sell data to private companies. It takes a few purchases to add up to $50 million. Handing out info to car manufacturers for recalls is probably something the DMV does for a minimal cost, if it even charges anything for it. The DMV's statement sounds good but really says nothing. No one will really know what happens to the data the DMV collects until it starts handing over detailed answers to these questions from Congress.

Filed Under: anna eshoo, california, data, dmv, privacy, selling data, ted lieu

DNA Company Accidentally Exposes Opted Out Users' Data To Law Enforcement

from the apparently-the-software-does-not-approve-of-your-decision dept

A couple of years ago, investigators in California used a DNA matching service to track down the so-called "Golden State Killer." Uploading a sample of the suspected serial murder's DNA, they were able to identify distant relatives of the suspect. Using these sentient clues, investigators eventually worked their way back to the suspected killer, who had eluded authorities for years.

Shortly after this made news, GEDmatch informed users that law enforcement had never approached the company directly to acquire this information. Instead, investigators created an account and uploaded samples, bypassing anything GEDmatch might have had in place to limit use by government agencies. GEDmatch said the only way customers could ensure their DNA info wouldn't be obtained by law enforcement was to not use the service at all.

A month later, it went a step further. It opted all users out of allowing law enforcement to access their DNA data. Users were allowed to opt in if they were comfortable with the government digging through their information. This somewhat solved the problem. But law enforcement has been known to create faux profiles to search DNA data, so opting out isn't guaranteed to stop cops from accessing this info.

Unfortunately, something recently went very wrong with GEDmatch's database.

[U]sers reported Sunday that those settings had changed without their permission, and that their DNA profiles were made available to law enforcement searches.

Users called it a “privacy breach.” But when reached, the company’s owner declined to say if the issue was caused by an error or a security breach, citing an ongoing investigation.

This incident/error opted everyone in to law enforcement access. The company still isn't sure what happened. The statement issued by the CEO says the problem is "resolved" but the company has taken the site offline until it can determine what actually happened.

The site is still down as of the time of writing (July 20th). GEDmatch hasn't offered any further statement on the matter, either. It also has refused to say whether any law enforcement requests to the service were received or responded to while everyone was temporarily opted in.

The larger problem remains, however. GEDmatch's default is opt out, which is best for its users. But it's unclear whether GEDmatch polices its service for bogus accounts possibly be used by… well, police. GEDmatch only requires an email address for registration. It says you must link a "real name" to uploaded DNA data but nothing in its terms of service indicates this name must be verified before the site can be searched for matches. This means opting out is only as good as the law enforcement agencies using the service. If they can't be trusted then GEDmatch probably can't be trusted either.

Filed Under: data, data breach, dna, law enforcement, privacy, surveillance
Companies: gedmatch