FTC's Latest Fine Of YouTube Over COPPA Violations Shows That COPPA And Section 230 Are On A Collision Course

from the this-could-be-an-issue dept

As you probably heard, earlier this week, the FCC fined Google/YouTube for alleged COPPA violations in regards to how it collected data on kids. You can read the details of the complaint and proposed settlement (which still needs to be approved by a judge, but that's mostly a formality). For the most part, people responded to this in the same way that they responded to the FTC's big Facebook fine. Basically everyone hates it -- though for potentially different reasons. Most people hate it because they think it's a slap on the wrist, won't stop such practices and just isn't painful enough for YouTube to care. On the flip side, some people hate it because it will force YouTube to change its offerings for no good reason at all and in a manner that might actually lead to more privacy risks and less content for children.

They might all be right. As I wrote about the Facebook fine and other issues related to privacy, almost every attempt to regulate privacy tends to make things worse, in part, because people keep misunderstanding how privacy works. Also, most of the "complaints" about how this "isn't enough," are really not complaints directed at the FTC, but at Congress, because the FTC can only do so much under its current mandate.

Separately, since this fine focused on COPPA violations, I'll separately note that COPPA has always been a ridiculous law that makes no real sense -- beyond letting politicians and bureaucrats pretend they're "protecting the children" -- while really creating massive unintended consequences that do nothing to protect children or privacy, and do quite a bit to make the internet a worse place.

But... I'm not even going to rehash all of that today. Feel free to dig into the past links yourselves. What's interesting to me is something specific to this settlement, as noted by former FCC and Senate staffer (and current Princeton professor), Jonathan Mayer: the FTC, in this decision, appears to have significantly changed its interpretation of COPPA, and done so in a manner that is going to set up something of a clash with Section 230. What happened is a little bit subtle, so it requires some background.

The key feature of COPPA -- and the one you're probably aware of whether or not you know it -- is that it has specific rules if a site is targeting children under the age of 13. This is why tons of sites say that you need to be over 13 to use them (including us) -- in an attempt to avoid dealing with many of the more insane parts of COPPA compliance. Of course, in practice, this just means that many people lie. Indeed, as danah boyd famously wrote nearly a decade ago, COPPA seems to be training parents to help their kids lie online -- which is kinda dumb.

Of course, the key point under COPPA is not actually the "under 13" users, but rather whether or not a website or online service is "directed to children under 13 years of age." Indeed, in talking about it with various lawyers, we've been told that most sites (including our own) shouldn't even worry about COPPA because it's obvious that such sites aren't "directed to children" as a whole and therefore even if a few kids sneak in, they still wouldn't be violating COPPA. In other words, the way the world has mostly interpreted COPPA is that it's not about how whether any particular piece or pieces of content are aimed at children -- but whether the larger site itself is aimed at children.

This new FTC settlement agreement changes that.

Basically, the FTC has decided that, under COPPA, it no longer needs to view the service as a whole, but can divide it up into discrete chunks, and determine if any of those chunks are targeted at kids. To be fair, this is well within the law. The text of COPPA clearly says in definitional section (10)(A)(ii) that "a website or online service directed to children" includes "that portion of a commercial website or online service that is targeted to children." It's just that, historically, most of the focus has been on the overall website -- or something that is more distinctly a "portion" rather than an individual user's channel.

Except, that under the law, it seems that it should be the channel operator who is held liable for violations of COPPA under that channel, rather than the larger platform. In fact, back in 2013, the last time the FTC announced rules around COPPA it appears to have explicitly stated, that it would apply COPPA to the specific content provider who was directed at children and not at the general platform they used. This text is directly from that FTC rule, which went through years of public review and comment before being agreed upon:

... the Commission never intended the language describing ‘‘on whose behalf’’ to encompass platforms, such as Google Play or the App Store, when such stores merely offer the public access to someone else’s child-directed content. In these instances, the Commission meant the language to cover only those entities that designed and controlled the content...

But that's not what the FTC is doing here. And so it appears that the FTC is changing the definition of things, but without the required comment and rulemaking process. Here, the FTC admits that channels are "operators" but then does a bit of a two-step to say that it's YouTube who is liable.

YouTube hosts numerous channels that are “directed to children” under the COPPA Rule. Pursuant to Section 312.2 of the COPPA Rule, the determination of whether a website or online service is directed to children depends on factors such as the subject matter, visual content, language, and use of animated characters or child-oriented activities and incentives. An assessment of these factors demonstrates that numerous channels on YouTube have content directed to children under the age of 13, including those described below in Paragraphs 29-40. Many of these channels self-identify as being for children as they specifically state, for example in the “About” section of their YouTube channel webpage or in communications with Defendants, that they are intended for children. In addition, many of the channels include other indicia of child-directed content, such as the use of animated characters and/or depictions of children playing with toys and engaging in other child-oriented activities. Moreover, Defendants’ automated system selected content from each of the channels described in Paragraphs 29-40 to appear in YouTube Kids, and in many cases, Defendants manually curated content from these channels to feature on the YouTube Kids home canvas.

Indeed, part of the evidence that the FTC relies on is the fact that YouTube "rates" certain channels for kids.

In addition to marketing YouTube as a top destination for kids, Defendants have a content rating system that categorizes content into age groups and includes categories for children under 13 years old. In order to align with content policies for advertising, Defendants rate all videos uploaded to YouTube, as well as the channels as a whole. Defendants assign each channel and video a rating of Y (generally intended for ages 0-7); G (intended for any age); PG (generally intended for ages 10+); Teen (generally intended for ages 13+); MA (generally intended for ages 16+); and X (generally intended for ages 18+). Defendants assign these ratings through both automated and manual review. Previously, Defendants also used a classification for certain videos shown on YouTube as “Made for Kids.”

That's a key point that the FTC uses to argue that YouTube knows that its site is "directed at" children. But here's the problem with that. Section 230 of the Communications Decency Act, specifically the often forgotten (or ignored) (c)(2) is explicit that no provider shall be held liable for any moderation actions, including "any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable." One way to do that is... through content labeling policies, such as those that YouTube used and described by the FTC.

So here, YouTube is being found partially liable because of its content ratings, which is being shown as evidence that it's covered by COPPA. But, CDA 230 makes it clear that there can't be any such liability from such a rating system.

This won't get challenged in court (here) since Google/YouTube have agreed to settle, but it certainly does present a big potential future battle. And, frankly, given the way that some courts have been willing to twist and bend CDA 230 lately, combined with the general "for the children!" rhetoric, I have very little confidence that CDA 230 would win.

Filed Under: cda 230, coppa, ftc, moderation, privacy, section 230
Companies: google, youtube

Facebook And Twitter Hope To Fix California's Troubled Privacy Law With...Misleading Ads?

from the you're-not-helping dept

With the federal government doing little to pass a real privacy law for the modern era, states have begun rushing into the void. That's unfortunately resulting in some state privacy laws that are a lacking in the...quality department. That's been particularly true in California, where the government recently passed the new California Consumer Privacy Act. While the law may be well intentioned, we've noted how the rushed bill has plenty of problems that need fixing if it's ever going to actually work. Murky definitions and drafting errors leave the bill a bit of a muddled mess, with the potential to even undermine other, existing laws.

While all sides of the debate have descended upon the California legislature in a bid to try and fix the bill's language, Silicon Valley lobbying giants have been busy running some highly misleading ads in a bid to try and soften the bill. Under the banner of "Keep the Internet Free," the Google, Twitter, Facebook, and Microsoft-backed Internet Association has been running ads trying to claim that the bill would result in users having to pay errant fees just to use the internet:

"The FREE websites and apps you use every day could start costing you,” announced one such ad on Twitter.

“Using the internet shouldn’t hurt your wallet,” began another that predicted browsing the Web could someday seem like paying at the pump for gasoline."

And while California's proposal certainly has numerous problems, any claim it's going to result in the internet being turned into some kind of pay-to-play hellscape is just nonsense. Sacramento-area users who actually click on the ad are directed to a website that further tries to suggest the new bill will suddenly have users paying to access social media in much the same way they have to pay to buy gasoline:

This obviously isn't the Internet Association's first foray into misleading privacy lobbying. Silicon Valley worked hand in hand with the telecom sector early on to try and stall California's privacy law efforts, pushing ads and talking points claiming that a state-level privacy law would embolden extremists, endanger children, and litter the internet with annoying popups, none of which was actually true. This was after telecom and Silicon Valley worked hand in hand to kill some fairly modest (and far better written) FCC privacy rules back in 2017.

Granted, Silicon Valley giants have some very good reasons to oppose the California bill, given it's rushed and sloppy language could easily result in steeper additional operational costs and numerous unforseen headaches.

At the same time, it's oddly understated that these companies would much prefer it if no privacy law were passed at all, and if a bill is passed, they'd prefer it be loaded with so many loopholes as to be largely useless. Even if the bill lacked troubling language, no major company actually wants to suddenly face million/billion dollar losses due to restrictions on data monetization or behavioral ads, and the combined lobbying firepower of the telecom, tech, insurance, healthcare, and marketing industries makes passing any privacy law with teeth a steep uphill climb.

The problem in California is the bill is slated to go live (warts and all) on January 1, though actual enforcement isn't expected until at least next summer. Efforts by privacy advocates to strengthen the bill have stalled, so their focus now is simply keeping the tougher portions of the bill intact:

"After two failed bids to strengthen the 2018 law, data-privacy advocates say their goal for the year is simply to keep the Privacy Act intact.

"We’re basically looking to hold the line on everything." said Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, a San Francisco-based group that advocates for stronger consumer protections online. "We’re watching for gut-and-amends and the usual shenanigans on the floor."

In contrast, the tech sector's goal is to try and weaken the definitions of what's collected, how it can be shared, and who it can be sold to. And while the industry certainly has plenty of other of legitimate reasons to oppose the bill as currently written, further muddying the waters with additional layers of misleading advertising isn't likely to help their cause.

Filed Under: ads, california, ccpa, lobbying, misleading ads, privacy
Companies: facebook, google, internet association

The Conflict Between Social Media Transparency And Bad Privacy Laws Is Going To Get Worse

from the what-a-mess dept

For years I've been arguing that we're bad at regulating privacy because too many people think that privacy is a "thing" that needs to be "protected," rather than recognizing that privacy is always a series of tradeoffs. As I've pointed out a few times now, part of the problem that many people reasonably have about how internet companies are dealing with our "privacy" is the lack of transparency from those companies, making it difficult (or impossible) to accurately weigh the costs and benefits of the tradeoff choices.

It often comes down to a question of "is it worth sharing this data, in order to get this service." But to make that determination, it helps to know which data exactly, how it's being used, how it's being secured, what the likelihood is of it getting spread more widely and what the potential downstream impacts might be to me if that data does get spread more widely. If there was an accurate way to understand that, then we'd have a better sense of whether or not it's worth giving up that data in exchange for the service. But, many internet companies (from the big ones on down) are notoriously bad about providing that information, meaning that we can't make an informed decision about whether or not the tradeoffs are worth it.

And that's a big part of the reason users get so concerned whenever there's a privacy scandal. It's because that information wasn't provided to us. People didn't realize that Facebook would be enabling people to share the data of all of our friends with a sketchy corporation who might use it to suppress votes. People didn't realize that Facebook would take phone numbers provided for security purposes and use them to push advertisements and friend notifications to our phones.

But... since very few people seem to recognize that privacy is a "set of tradeoffs," too many of the regulations try to treat it as "a thing" and require companies to "protect" it -- even if that doesn't mean very much. And, even worse, trying to force companies to "protect" privacy can actually interfere with the necessary transparency that would allow individuals to better understand their privacy tradeoffs.

Case in point: a year and a half ago, Facebook agreed to support a new scholarly project to share a bunch of data with a bunch of academics in the interest of transparency. The project was dubbed Social Science One, and was funded by a bunch of big philanthropic foundations. Yet, a recent article in Buzzfeed points out that a year and a half later, Facebook still hasn't delivered most of the promised data to the waiting academics. Indeed, a follow up article notes that the big list of powerful foundations funding the whole project have now threatened to pull their funding if Facebook doesn't share the data by the end of September.

A key issue? Various attempts to regulate privacy.

A Facebook spokesperson acknowledged that some data originally promised will not be delivered, but said this is due to concerns about privacy, security, and the need to comply with regulations such as Europe’s GDPR privacy legislation. They said useful data has already been provided to researchers, and some teams are using it.

And this makes sense. Given how everyone (perhaps reasonably!) beat up on Facebook for sharing data in the past, you know that if it provides data for the Social Science One project, and somehow some of that data becomes public or is misused, Facebook will be vilified again (and, perhaps, held liable by various regulators. If it wants to provide transparency, it might have to violate privacy. But, of course, that does harm to our actual privacy, because then the public doesn't get to learn about the actual tradeoffs.

And, indeed, if anything bad happens with this data, you know that many media outlets will quickly blame Facebook, even if they're the same people now yelling about Facebook failing to deliver this data to researchers.

That's not to say that Facebook is entirely blameless here. It seems to have left everyone -- funders and academics alike -- pretty much in the dark over what was happening. That, alone, seems like a real lack of transparency on an issue where the company should have been very transparent. And some may rightly argue that there could be ulterior motives as well. If Facebook realized that this level of transparency was going to make the company look bad (as it very well might!) perhaps that's contributing to the stalling as well.

Either way, it's a no win situation. Facebook's failure to share the data after promising to, is a problem and it deserves to be criticized over it. At the same time, the privacy concerns are quite real as well. And, honestly, the very same journalists who are mocking Facebook over failing to live up to this promise, are likely the first in line who will attack the company should the data sharing lead to some sort of leak of private info.

This is why I'm so concerned with almost every current legislative approach to dealing with privacy. Over and over again it seems to set up conditions that are actually worse for real privacy and transparency, and which put the companies in much greater control. Setting up situations where you put transparency and privacy into conflict when they don't need to be, is not going to lead to good solutions for anyone. It puts both transparency and privacy at risk.

Filed Under: data sharing, gdpr, privacy, trade-offs, transparency
Companies: facebook, social science one

Millions Of Biometric Records Collected By Companies And Governments Left Exposed On The Web

from the one-stop-shopping-for-identity-thieves dept

One of the many problems with collecting biometric data is you need to have someplace safe to store it. Sure, you could lock it away in something disconnected from the net, but then it's not much use to the dozens of private companies and government agencies that want access to the data they've collected. So, back on the web it goes, where it can be prodded for weaknesses by security researchers and malicious hackers alike.

We can only hope the security researchers got there first.

The fingerprints of over 1 million people, as well as facial recognition information, unencrypted usernames and passwords, and personal information of employees, was discovered on a publicly accessible database for a company used by the likes of the UK Metropolitan police, defence contractors and banks.

The data breach was discovered by vpnMentor researchers, who were performing their usual port scans and checking familiar IP blocks for weaknesses. They found a big one at BioStar 2, the third-party platform that provides access to the biometric databases maintained by over 5,700 companies and government agencies. Only minimal precautions were taken to protect BioStar's data from outside threats -- and even that minimal effort was easily thwarted.

The team discovered that huge parts of BioStar 2’s database are unprotected and mostly unencrypted. The company uses an Elasticsearch database, which is ordinarily not designed for URL use. However, we were able to access it via browser and manipulate the URL search criteria into exposing huge amounts of data.

Not only were the researchers able to see all of this sensitive data, they were also able to change it. Thanks to the list of unencrypted administrator usernames and passwords, researchers were able to add themselves to accounts and utilize stored privileges to examine BioStar 2's databases more thoroughly.

vpnMentor contacted BioStar 2 several times but was ignored repeatedly by its personnel. The only entity that was remotely helpful was the company's French branch, which was apparently instrumental in getting the breach closed. Even so, it still took eight days for BioStar to fix the hole in its system after being notified. vpnMentor didn't publish its findings until after this, but no one can say for sure how long this breach was accessible prior to its discovery by vpnMentor.

Names and passwords are certainly being changed in the wake of this discovery. But this breach was full of biometric info linked to other personally identifiable information held by BioStar 2's customers. Fingerprints and other biometric markers can't be changed. These are inextricably tied to whatever other sensitive information was collected by multiple entities -- much of which was stored in unencrypted form.

Suprema and BioStar 2 will probably take security more seriously in the future, but the damage is done. The fact that the marketing team is issuing statements on the breach rather than someone with direct knowledge of the situation isn't exactly reassuring. Neither is the issued statement, which suggests the company would have rather kept the breach buried, rather than be honest and direct with its users.

Suprema’s head of marketing, Andy Ahn, told the Guardian the company had taken an “in-depth evaluation” of the information provided by vpnmentor and would inform customers if there was a threat.

“If there has been any definite threat on our products and/or services, we will take immediate actions and make appropriate announcements to protect our customers’ valuable businesses and assets,” Ahn said.

In other words, customers will only be informed of the breach if they've been targeted by criminals or malicious hackers. The rest of their customers aren't on the "need to know" list. Fortunately for its out-of-the-loop customers, vpnMentor has made the disclosure the company spent eight days not making.

Filed Under: biometric records, fingerprints, privacy, security
Companies: biostar 2

As The NSA Declares Phone Record Program Dead, Trump Administration Asks For A Permanent Reauthorization

from the learn-how-to-read-a-room,-dudes dept

The NSA decided to abandon its phone data collection earlier this year, stating that it was having all sorts of technical issues collecting only the stuff it was asking for. In the good old days prior to the enactment of the USA Freedom Act, the NSA simply asked for everything. "Reasonable articulable suspicion" now guides the record collection -- something that appears to be too tricky for the NSA to wrap its collective collection powers around.

It's not all the NSA's fault. The telcos now hold the records and only hand over what's asked for when the NSA approaches them. Easier said than done, apparently, as over-collection continues and the NSA seems unable to prevent collecting records it's not actually trying to correct.

But it's also the NSA's fault because it's had plenty of time to get used to the new rules and develop better practices/software to sort through collected data. Of course, the NSA has also hinted the program is of limited usefulness and has seemed willing to give it up for years now, especially if the token sacrifice saves other, far more intrusive programs from the Congressional chopping block.

Is it really shut down, though? That's been a tough question to answer. The NSA did recommend the program be shut down and claims it's just gathering dust at the moment, but there's been nothing definitive delivered to its oversight. Until now. Charlie Savage reports for the New York Times that there's finally official confirmation of the program's (possibly temporary) demise. Exiting Director of National Intelligence Dan Coats' unclassified letter makes it clear the NSA has shut down the program indefinitely.

“The National Security Agency has suspended the call detail records program that uses this authority and deleted the call detail records acquired under this authority,” Mr. Coats wrote. “This decision was made after balancing the program’s relative intelligence value, associated costs, and compliance and data integrity concerns caused by the unique complexities of using these company-generated business records for intelligence purposes.”

This isn't really good news, though. The current administration has other ideas for the program -- and a few other collection authorities -- that would excuse them permanently from periodic review.

In a letter to Congress delivered on Thursday and obtained by The New York Times, the administration urged lawmakers to make permanent the legal authority for the National Security Agency to gain access to logs of Americans’ domestic communications, the USA Freedom Act.

Not sure if Dan Coats is just a team player or he actually believes the NSA can power through its technical struggles and finally get this phone record thing nailed down. Savage reports Dan Coats is on board with plans to permanently reauthorize the program under the theory that technical advances will make this program useful again at some undetermined point in the future.

In addition to the phone record collection, the administration also was a permanent reauthorization of other business record collections, authority to wiretap "lone wolf" suspected terrorists with no ties to foreign powers, and its infamous roving wiretaps that follow the suspects, rather than their phones.

The NSA and its programs are barely subject to oversight as it is. This would further insulate four surveillance programs -- one wholly domestic -- from even a rote appraisal of their use and abuse. And for all the talk about how much trouble the phone record collection is, the outgoing Intelligence Director thinks it's wise to just leave it idling in the driveway until the next time the NSA wants to take it out for a spin.

Filed Under: 215 renewal, bulk records, business records, dan coats, mass surveillance, nsa, privacy, section 215, surveillance

NYPD Used Reverse Warrants To Round Up Proud Boys Members Suspected Of Beating Antifa Members

from the bringing-Google's-data-slurping-to-a-hashtag-war dept

The first documented case of the NYPD using reverse warrants to find criminal suspects has been revealed. It made its appearance in perhaps the most 2019 of cases: the trial of two members of the Proud Boys facing assault charges for allegedly attacking members of Antifa.

Reverse warrants work this way: law enforcement agencies approach tech companies with geographic coordinates, asking for phone data for all phones within the geofenced area during a certain time frame. Using this data, law enforcement works its way backwards to probable cause, sifting through records to find what phones were in the area when the alleged crime was committed.

Obviously, this is a highly-imperfect way to track down suspects. For one, GPS data collected by companies like Google isn't exactly precise. For another, "fenced-in" areas will always contain numerous people who aren't criminals or even suspects, but the data turns them all into suspects until investigators sort them out. The more heavily-trafficked an area is, the more likely the chance officers will pursue the wrong phones/people.

This case was made a bit trickier by the victims' unwillingness to cooperate with the investigation. As George Joseph reports for Gothamist, the lack of victims to question nudged the NYPD towards deploying the legally-dubious tactic.

The use of this surveillance technique has not been confirmed in New York City until now. An investigator for the Manhattan DA revealed it during testimony last week in a case involving a politically-charged assault from last year.

The defendants are members of the Proud Boys, a group of pro-Trump rightwing extremists who allegedly beat up four leftist protesters, believed to be associated with Antifa, outside an Upper East Side event last October. The four protesters refused to cooperate with police, and authorities were unable to identify them.

According to the New York Times' account of this trial, the victims are evoked repeatedly in the court, despite no one knowing their names. This oddity has lead to the composition of sentences no one has ever read before.

The four who were assaulted refused to talk with the police. They were identified in an indictment only as Shaved Head, Ponytail, Khaki and Spiky Belt. Their whereabouts are unknown.

The two accused Proud Boys members are using the general perception of Antifa as violent to argue these attacks -- which were caught on video -- were actually acts of self-defense. The manhunt for the Proud Boys suspects may have taken the NYPD a bit longer, but the same Antifa that aggravated its own assault also provided law enforcement with plenty of useful information.

“There was a tremendous amount of what we call ‘doxxing,’” the detective, Thomas Mays, testified, using a slang term for the practice of disclosing personal information online. “Names that were given for the individuals.”

However you may feel about this comeuppance of the still-presumed-innocent Proud Boys members, the fact that the NYPD used this tactic successfully should be more than a bit chilling. Here's what the NYPD demanded from Google.

According to the investigator’s testimony, authorities were looking for location records from “Google’s Android platform and Google-based apps, such as Google Maps, [that] utilize location service[s].” The warrant requested records from multiple sites, including where the conflict broke out on 82nd Street and other locations where participants in the clash may have been that evening.

New York City is home to a densely-packed 8.6 million people. Throwing up geofences almost anywhere in the city is bound to return hundreds, if not thousands, of records that have nothing to do with the crime being investigated. At that point, the data is in the NYPD's hands and residents are at the mercy of investigators' haystack-sorting skills.

To make matters worse, if the use of reverse warrants in Minnesota is any indication, judges aren't being given enough information to make judgment calls on the mass harvesting of phone records in search of a suspect. In most cases, all they get are geographic coordinates that tell them next to nothing about the size -- or population density -- of the area targeted. And yet (or perhaps despite this), these warrants are being approved in minutes, suggesting judges are simply trusting the cops know what they're doing with all their highly-technical toys.

In the end, these warrants are surveillance dragnets that grab everyone located inside the coordinates. And it's left up to the discretion of these blue-suited fisherman to determine which of these hundreds of fish gets tossed back into the suspicion-free ocean. Reverse warrants aren't really warrants. Warrants require probable cause. Reverse warrants require only guesswork and faith.

Filed Under: 4th amendment, antifa, nypd, privacy, proud boys, reverse warrant
Companies: google

The GDPR Is A Wide Open Vulnerability For Identity Fraud And Scams

from the how-does-this-help-privacy-again? dept

We've spent the last year and a half or so pointing out that, while it may have been well-intentioned, there are all sorts of consequences -- whether intended or not -- to the EU's General Data Protection Regulation (GDPR), including giving more power to the giant internet companies (when many argued the GDPR was necessary to curb their power), censorship of media, and a way for the rich and famous to harass people. But, of course, some might argue that those are worthy trade-offs if it did a better job protecting people's privacy.

About that... Last year, we pointed out that one consequence of the GDPR was that, in making it easy to "download" your data, it could open up serious privacy consequences for anyone who has their accounts hacked. In that story, we talked about someone having their Spotify account hacked, and having all the data downloaded -- a situation that might not be that impactful. However, last week, at Black Hat, James Pavur, a PhD student at Oxford, explained how he exploited the GDPR to access a ton of private info about his fiancee.

In a presentation at the Black Hat security conference in Las Vegas James Pavur, a PhD student at Oxford University who usually specialises in satellite hacking, explained how he was able to game the GDPR system to get all kinds of useful information on his fiancée, including credit card and social security numbers, passwords, and even her mother's maiden name.

"Privacy laws, like any other infosecurity control, have exploitable vulnerabilities," he said. "If we'd look at these vulnerabilities before the law was enacted, we could pick up on them."

In other words, in giving more "protection" over data, the EU has also opened up a new vulnerability. Here's how it worked:

Over the space of two months Pavur sent out 150 GDPR requests in his fiancée's name, asking for all and any data on her. In all, 72 per cent of companies replied back, and 83 companies said that they had information on her.

Interestingly, five per cent of responses, mainly from large US companies, said that they weren’t liable to GDPR rules. They may be in for a rude shock if they have a meaningful presence in the EU and come before the courts.

Of the responses, 24 per cent simply accepted an email address and phone number as proof of identity and sent over any files they had on his fiancée. A further 16 per cent requested easily forged ID information and 3 per cent took the rather extreme step of simply deleting her accounts.

That last one is kind of fascinating. What companies delete the accounts of people making a GDPR request? At least some of the companies required login info, but Pavur noted that in one case, he told the company he'd forgotten the login... and they gave him the data anyway.

"An organisation she had never heard of, and never interacted with, had some of the most sensitive data about her," he said. "GDPR provided a pretext for anyone in the world to collect that information."

This could be fixed, and one could argue that companies handing out this info without real proof of ID are, themselves, in violation of the GDPR. But, given that the GDPR is so strict -- you have a very short time frame to return the info or face massive fines), the incentive structure is designed to ignore those formalities and just fork over the information -- even if it's right into the hands of a scammer.

Filed Under: data, downloads, fraud, gdpr, privacy

Ring Is Teaching Cops How To Obtain Doorbell Camera Footage Without A Warrant

from the twist:-Amazon-will-just-give-it-to-them-if-no-one-cooperates dept

To be part of your local law enforcement's surveillance network, all you need is a little tech from Amazon. Amazon's Ring doorbell/camera is being handed out to cops, who can then give them to citizens with the implication the recipients of this corporate/government largesse will deliver recordings upon request.

Every Ring installed is another contributor to this ad hoc network of cameras -- something both cops and Amazon have access to. Amazon is looking to corner two markets at one time, roping in both the public and private sectors with an eye on dominating both. The added bonus -- at least as far as Amazon is concerned -- is its Neighbors app. Neighbors allows people to report suspicious things to other neighbors, as well as law enforcement. Unsurprisingly, early adopters have tended to report the existence of brown people in their neighborhoods more often than anything else.

The whole process is guided by Amazon's heavy hand. Government agencies participating in the Ring handouts are given talking points, pre-written press releases, and contractual obligations to promote the product they're giving away. Recently-obtained documents show Amazon has even crafted scripts for police officers and press relations staff to use when questioned by citizens.

But there's even more to this partnership than everything you see above. Lucas Ropek of GovTech reports cops have an Amazon-enabled workaround if Ring recipients aren't willing to turn over footage without a warrant.

If the community member doesn’t want to supply a Ring video that seems vital to a local law enforcement investigation, police can contact Amazon, which will then essentially “subpoena” the video.

“If we ask within 60 days of the recording and as long as it’s been uploaded to the cloud, then Ring can take it out of the cloud and send it to us legally so that we can use it as part of our investigation,” [Fresno County Sheriff's Office public information officer Tony Botti] said.

So much for asserting your rights. The only way to shut law enforcement out completely and demand they actually get a warrant supported by probable cause is to store all recordings locally. (It appears only a subpoena is needed to obtain footage from Amazon.) Very few people will be taking those steps. And, as Tony Botti points out, most people "play ball" and allow cops to collect footage without a warrant.

If the implicit obligation of "repaying" a government agency for giving you a free doorbell camera isn't persuasive enough, Amazon is crafting scripts for law enforcement to use to talk people out of their Constitutional rights. Thanks to even more public document requests, the pitches are now public. Caroline Haskins has more details at Motherboard.

Emails obtained from police department in Maywood, NJ—and emails from the police department of Bloomfield, NJ, which were also posted by Wired—show that Ring coaches police on how to obtain footage. The company provides cops with templates for requesting footage, which they do not need a court warrant to do. Ring suggests cops post often on Neighbors, Ring’s free “neighborhood watch” app, where Ring camera owners have the option of sharing their camera footage.

"I have noticed you have been posting alerts and receiving feedback from the community,” a Ring representative told Bloomfield police. “You are doing a great job interacting with them and that will be critical in increasing the opt-in rate.”

“The more users you have, the more useful the information you can collect,” the representative added.

“Seems like you wasted no time sending out your video Request out to Ring Users which is awesome!!” a Ring “Partner Success Associate” told Maywood police.

This guidance is supposed to create a perverse circle of life that ditches Constitutional niceties in favor of keeping cops awash in doorbell footage and Amazon well ahead of the pack in the doorbell camera market.

Ring's PR partners encourage law enforcement agencies to increase their social media presence. (There are scripts for that as well.) While engaging with local residents, agencies should also be pushing the Neighbors app. This gives cops more credits to trade in for more cameras to give to more people. Everyone receiving a camera is nudged by the app to post footage publicly. Cops will be online more often to encourage further sharing of recordings.

Once this feedback loop is engaged, people will be nudged towards thinking there are no legal barriers between police officers and their camera footage. When the cops ask for footage they haven't seen yet, homeowners will likely feel there's no difference between posting footage to Neighbors or handing it over to law enforcement.

While many people do install security cameras at their homes, they seldom do so with the intent of becoming an unofficial extension of a government agency's surveillance network. The pitches and scripted pushes accompanying the Ring rollout suggest Amazon believes this is nothing more than the evolution of snitch tech. It has repeatedly shown it prefers to ingratiate itself to government agencies at the expense of the millions of customers who helped it become the retail behemoth it is. And those are the people Amazon is leaving behind in its quest to dominate a market very few consumers wanted to see it entering.

Filed Under: iot, police, privacy, ring
Companies: amazon