If You Think The Reason Internet Companies Snarf Up Your Data Is Because Their Services Are Free, Allow Me To Introduce You To The Telcos

from the free-is-not-the-problem dept

It's been a few years since this kind of argument has come up, but it's one that we've had to swat down a few times in the past: it's the argument that somehow if a company offers a service for free, it means that they'll absolutely snarf up all your data, and that requiring services be paid for directly by users somehow would fix that. This is easy to debunk in multiple directions and yet it still pops up here and there.

The latest is from the technology columnist for the Wall Street Journal, Christopher Mims (whose work I usually enjoy). His latest (possibly paywalled) piece is called, Why Free Is Too High a Price for Facebook and Google with the subhead reading: "Most of the ills traced to these companies are a direct consequence of their no-cost business models." Here's the crux of the argument:

In fact, most of the ills traced to these companies are a direct consequence of their “free” business models, which compel them to suck up our personal data and prioritize user growth over the health and privacy of individuals and society, all so they can sell more advertisements. They make money from the attention and in some cases the hard work—all those status updates, videos and likes are also a kind of uncompensated labor, if you think about it—of their most devoted users.

Of course, it seems rather easy to point out why that's wrong with two examples. First we pay for other services such as our broadband and mobile data providers and they are so much worse on the privacy front, it's not even remotely comparable. It's not as if magically paying for the service has stopped AT&T or Verizon from being horrific on the privacy front. The snarfing up of data doesn't go away if you pay for services.

Second, there are businesses that have been built on giving away free tools without having to snarf up your data. Indeed, that's actually how Google succeeded for much of its early history. It didn't need to know everything about you. It just needed to know what you were searching for. And that was massively successful. It's true that, over time, Google has moved away from that, but others (like DuckDuckGo) have stepped into that space as well. DuckDuckGo is free, and I don't see Christopher Mims concerned that they are magically "compelled to suck up our personal data."

As the saying goes, correlation is not causation. Just because Google and Facebook offer both free services and collect a lot of data, does not in any way mean that one automatically leads to the other (or that removing the "free" part lessens the data sucking).

Much of the rest of the piece is quite a thoughtful look at questions around big tech and antitrust -- which I appreciate -- but then it jumps back into these inevitable claims about "free" including the positively bizarre suggestion that free services undermine democracy. Seriously:

When an online service must be paid for solely through advertising, the company’s overriding incentive is to increase engagement with it: Users see and click on more ads. This drives all sorts of unexpected outcomes. Owing to its engagement-maximizing algorithms, Facebook appears to bear, by its own admission, some responsibility for a genocide in Myanmar.

Other well-documented ills that may have been exacerbated by Facebook include the erosion of global democracy, the resurgence of preventable childhood diseases and what the company itself acknowledges may be wide-ranging deleterious effects on the mental health of millions.

On YouTube, Google’s engagement-maximizing algorithm has been recommending material that denies the Holocaust, Sandy Hook and other tragedies, as well as white-supremacist content and other forms of hate speech, a policy the company on Wednesday pledged to redress. Over the years, YouTube has been criticized for other practices, from driving viewers to the internet’s darkest corners to pushing questionable content on children. Meanwhile, the globally dominant Google search engine has had a hard time avoiding accusations of bias in its results.

Except, once again, this seems like a correlation/causation error. Indeed, there's a strong argument that these "wide-ranging deleterious effects" on mental health or democracy are the kinds of things that would create long term problems for these companies (which does, indeed, appear to be the case). Any company that takes a longer term view of things would recognize that if the platforms optimize in a manner that creates serious problems for the world, that can't be good for long term business, and they can and should correct. Indeed, that's exactly what these companies have been struggling to do over the last couple of years. And it's got nothing to do with their services being "free."

There are plenty of reasonable questions to ask about the power and position of Google and Facebook. And there are reasonable debates to be had about antitrust and the impact of these services on the globe. But tying "free" into the equation without any evidence that that's the problem (and, in fact, with tons of evidence to suggest "free" has nothing to do with any of it) doesn't seem particularly productive.

Filed Under: business models, data, free, privacy, subscriptions

The Future Of School Safety Includes Round-The-Clock Surveillance Of Students

from the Big-Brother-101 dept

To go to school is to be surveilled, on campus and off. The average school hosts a number of cameras, and the average school administration is always looking for more ways to keep tabs on students, even after they've gone home.

The move towards pervasive surveillance of off-campus activities is generally justified with the meaningless assertion that if it stops one person from shooting up a school (or just shooting themselves), it's all worth it. Two articles based on public records requests -- both written by Benjamin Herold of Education Week -- show there's a surveillance state being built one school district at a time. (h/t Amelia Vance)

Documents obtained by Education Week via open-records requests show that over the past year, state agencies have discussed the possibility of sharing a breathtaking amount of data. That included more than 2.5 million records related to Floridians who received involuntary psychiatric examinations, records for over 9 million people placed in foster care, diagnosis and treatment records for substance abusers, unverified criminal reports of suspicious activity, reports on students who were bullied and harassed because of their race or sexual orientation, and more.

This database is currently on hold as education officials try to figure out how much of this incredibly sensitive info they can share with other agencies, much less collect in the first place. But once these details are ironed out, the rollout will continue, urged along by Governor Ron DeSantis, who has publicly expressed his frustration that schools aren't placing students under round-the-clock surveillance quickly enough.

It's not just medical, psychiatric, and criminal records. This program also seeks to hoover up as much data as it can from students' social media accounts and internet activities. The data-sharing concerns are being mitigated by a loophole in federal privacy laws. The Family Educational Rights and Privacy Act (FERPA) prohibits sharing of much of this info, but provides an exception for "school officials." Schools want to hand this information to law enforcement and law enforcement officers in schools (usually referred to as "school resource officers") are the loophole districts are using to circumvent FERPA's protections.

While the collected documents listed above are concerning enough in their implications -- that implication being that schools consider at-risk students to be "threats" -- the addition of social media to the mix increases the number of students viewed as threats because algorithms and haystacks tend to ignore important things like context or frame of mind. The software being sold to schools may expedite the collection of posts containing flagged terms but they're completely useless when it comes to doing more human things, like recognizing humor or sarcasm.

Relying on flagged terms means school security contractors are sorting through tons of garbage data. One company's software flagged all of the following as potentially threatening:

Tweets about the movie “Shooter,” the “shooting clinic” put on by the Stephen F. Austin State University women’s basketball team, and someone apparently pleased their credit score was “shooting up.”

A common Facebook quiz, posted by the manager of a local vape shop.

A tweet from the executive director of a libertarian think tank, who wrote that a Democratic U.S. senator “endorses murder” because of her support for abortion rights.

And a post by one of the Brazosport district’s own elementary schools, alerting parents that it would be conducting a lockdown drill that morning.

“Please note that it is only a drill,” the school’s post read. “Thank you for your understanding. We will post in the comment section when the drill is over.”

The software also flagged this tweet, posted by a 31-year-old comic book artist who happened to be tweeting from inside Social Sentinel's geofence:

If you can't read/see the tweet, it says:

Cat #1: pwease feed me thank you

Me: ha, cute.

Cat #2: IF YOU DON'T FEED ME RIGHT NOW I'M CALLING THE POLICE I CAN'T BELIEVE YOU'D TREAT ME LIKE THIS I AM DISAPPOINTED I DIDN'T RAISE YOU TO BE LIKE THIS

Me: I would die for you.

It's a tweet about the artist's relationship with her cats and any human being would immediately recognize it as having nothing to do with self-harm. But there's no room for nuance in automated keyword searches.

The head of Social Sentinel says people shouldn't worry about the collateral damage. Instead, they should be thankful all this surveillance could theoretically prevent a student from harming themselves or others.

“If you’re responsible for the safety and security of a school, you have to pay attention to the places where harm is being foreshadowed,” said Gary Margolis, the CEO of Social Sentinel, which claims “thousands” of K-12 schools in 30 states are using its service.

Margolis said it’s unfair to focus on the false positives that may slip through a company’s monitoring system. Any harms pale in comparison to the benefits of what is caught.

That might mean something if meaningful things were actually being caught. But the filters searching for harmful material, threatening posts, and other concerning content are being used as a dragnet to sweep up students who do nothing more than use certain flagged words in benign ways. Monitoring company Gaggle flagged 3,000 incidents in Michigan schools over a six-month period. 2,500 of those were minor violations like profanity.

It's not just a Michigan problem. It's a Gaggle problem.

The experiences of other K-12 Gaggle clients help illuminate such concerns.

Evergreen Public Schools in Washington state, for example, started using the company’s service this school year. Between September and mid-March, the system flagged more than 9,000 incidents in the 26,000-student district.

The overwhelming majority—84 percent—were for minor violations, such as profanity.

These programs are deployed under a number of faulty assumptions, not the least of which is students have zero expectation of privacy. Students still have rights, even if they're somewhat diminished when they're on campus. They also assume this pervasive surveillance will result in safer schools, even though there's no evidence that points to this conclusion. Companies and schools may be assuming the courts will back up these efforts when fighting lawsuits, but it seems unlikely many judges will agree that striving for school safety justifies widespread untargeted surveillance of minors.

Filed Under: privacy, school safety, surveillance

New York State's Privacy Law Would Be Among The Toughest In The US

from the this-will-get-messy dept

A few years ago, you might (or might not) recall that telecom lobbyists convinced Congress to kill some fairly modest FCC privacy rules before they could even take effect. The rules would have required that broadband providers transparently disclose what consumer data is being collected and sold, and to which companies. It also required that consumers opt in to the sharing of more sensitive financial or location data. Those rules, had they survived, would have gone a long way in protecting consumers from the endless location data scandals that have plagued the industry in the two years' since.

In the wake of obvious federal apathy to crafting meaningful privacy rules for the location data and social media age, numerous states have begun crafting their own privacy rules... with mixed results. California's privacy proposal, for example, is well intentioned but has been criticized for being a bit rushed and overcooked. ISPs have been quick to breathlessly complain about the rise of such state efforts, ignoring that they likely wouldn't be happening if they hadn't lobbied to crush the FCC's privacy rules.

This week New York State joined the fun, and has been pushing for a new law (S5642) that experts say is significantly tougher than California's proposal:

The New York bill, as it’s currently written, departs from the California model in significant ways. While the California law leaves enforcement to the state’s attorney general, the New York Privacy Act would give New Yorkers the right to sue companies directly over privacy violations, possibly setting up a barrage of individual lawsuits. Industry groups vehemently opposed a similar provision—also known as a private right of action—in California, and they succeeded in driving it out of the bill when it was finally signed into law last year. And while California’s law applies only to businesses that make more than $25 million annual gross revenue, the New York bill would apply to companies of any size.

Privacy wonks say there are several problems with the bill as written, including the continued insistence on so-called "right to be forgotten" restrictions, which we've noted usually come with a high potential for abuse by malicious third parties. Another contentious issue is the bill's decision to classify companies as “data fiduciaries,” barring them from using data in a way that benefits their companies but harms the end user:

The concept, alternately known as an "information fiduciary," was coined by Yale Law School professor Jack Balkin, who has been promoting the idea since 2014 as one solution to data privacy issues. "To deal with the new problems that digital businesses create, we need to adapt old legal ideas to create a new kind of law—one that clearly states the kinds of duties that online firms owe their end users and customers," Balkin and his coauthor, Harvard professor Jonathan Zittrain, wrote in The Atlantic. "The most basic obligation is a duty to look out for the interests of the people whose data businesses regularly harvest and profit from."

The idea has critics in and outside of industry, including Lina Khan, one of the leading modern voices on antitrust reform. She's been arguing for a while that the requirement conflicts with existing laws, like in Delaware, which require that companies maximize returns for shareholders:

"A fiduciary with deeply divided loyalties teeters on the edge of contradiction," Khan and her fellow Columbia Law professor David Pozen wrote in March. "Insofar as the interests of stockholders and users diverge, the officers and directors of these companies may be put in the untenable position of having to violate their fiduciary duties (to stockholders) under Delaware law in order to fulfill their fiduciary duties (to end users) under the new body of law that Balkin proposes."

Clearly, crafting a useful state or federal privacy law is going to be a steep uphill climb. In part because of well-intentioned errors and overreach on the part of the states or Congress, but also because you'd be hard pressed to find a meaningful privacy proposal that industry actually agrees with. Even the best crafted privacy law would inform, educate, and empower consumers to opt out of data collection and monetization. Given that would cost countless companies billions of dollars, they're going to fight tooth and nail against pretty much any proposal with teeth, regardless of proclaimed public support.

That puts consumers in a precarious position. Numerous industries are now pushing for federal privacy laws that sound good on the surface, but are largely filled with loopholes and designed to do just one thing: preempt tougher state and federal laws. And with a long line of sectors all lobbying in unison (telecom, Silicon Valley, marketing, advertising, healthcare) against any meaningful law whatsoever, getting anything of substance passed on either the federal or state level is going to prove problematic (part of the reason the FCC acted unilaterally on privacy and net neutrality in the first place).

As a result, it's likely we're going to just keep seeing a percussive array of massive privacy scandals until a consensus and solution is forged by necessity and outrage. But it remains entirely unclear when that's actually going to happen in a Congress flooded with industry campaign contributions. It's a wide open question just how stupid our repeated privacy scandals are going to get before the United States figures out that having absolutely no real privacy rules of the road isn't likely to work.

Filed Under: information fiduciaries, new york, privacy, privacy laws

Facebook's Triple Woes Over Cambridge Analytica Data Harvesting Scandal

from the privacy?-what-privacy? dept

Earlier this week, Techdirt wrote about a defeat for Facebook in the Irish courts. In fact, the case in question is not about Facebook itself, but about transatlantic data transfers. Facebook will certainly have some problems if the EU's top court goes on to rule against the Privacy Shield framework -- the real issue here -- but it won't be alone. Moreover, if that were the company's only problem, it probably wouldn't cause Mark Zuckerberg to lose much sleep. However, it is far from his only headache. Recently, no less than three decisions specifically about Facebook were handed down, all related to the by-now infamous Cambridge Analytica data harvesting scandal, and all going the wrong way for Zuckerberg.

As Bloomberg reports, a San Francisco federal judge indicated he won’t dismiss lawsuits brought against Facebook on behalf of tens of millions of users. They blame the company for allowing their private information obtained from their friends' accounts to be shared with Cambridge Analytica:

U.S. District Judge Vince Chhabria is overseeing dozens of suits alleging users have no real control over their personal information, and that the company has repeatedly misled users to continue mining it.

The suits have a long way to go before users stand a chance of claiming billions of dollars in damages. Chhabria isn't addressing the merits of the complaints, only deciding whether the allegations are legally sufficient to proceed. The next step will be for users to seek internal information from the company to back up their claims.

Reuters says that Facebook suffered a similar fate in Washington, D.C.:

A U.S. judge on Friday denied Facebook Inc.'s request to dismiss a lawsuit by the Washington, D.C. attorney general over the social media giant's improper sharing of 87 million users' data with British political consulting firm Cambridge Analytica.

The U.S. capital city sued Facebook in December, accusing it of misleading users because it had known about the breach for two years before disclosing it and had allowed third-party app makers to access user information without their consent.

Around the same time, a court in Delaware was also ruling against Facebook in connection with Cambridge Analytica, reported here by Forbes:

A court in Delaware sided with Facebook shareholders who are suing the company for access to internal information that might show wrongdoing relating to the company's various privacy issues. The investors want access to emails and other documents relating to Facebook providing Cambridge Analytica with data on some 87 million users.

It's important to note that in all three cases, the rulings are preliminary, simply allowing things to proceed to a full trial. But we do have a sneak peek of what one of Facebook's main arguments might be. Speaking before the judge in San Francisco, a lawyer for Facebook claimed as follows:

"There is no invasion of privacy at all, because there is no privacy," on Facebook or any other social media site, company attorney Orin Snyder told U.S. District Judge Vince Chhabria.

A month before that interesting statement, Mark Zuckerberg was telling everyone that "The future is private". Given what one of his lawyers is now insisting in court, that seems to imply that Facebook's social network is not the future.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: class action, data sharing, lawsuits, privacy
Companies: cambridge analytica, facebook

Singapore's Fake News Law Is Also An Internet Surveillance Law

from the hidden-bonus-track dept

It appears the fake news law passed in Singapore isn't just a critic-targeting, speech-chilling piece of legislation passed under the cover of providing citizens with a more trustworthy social media experience. It's also a handy vehicle for increased domestic surveillance, as Jennifer Daskal reports for the New York Times.

The law could be used to require any company that operates as an “internet intermediary” — including search engines, social media companies, and messaging services — to keep records of what users view. But it doesn’t stop there. While it’s unclear how the new law will be enforced, it even appears to leave room for the government to require encrypted messaging services like WhatsApp or iMessage to identify who said what to whom.

What this has to do with policing "fake news" is anyone's guess. But "fake news" laws are never really about tracking down and removing fake news. They're about controlling what people see online and providing a handy kill switch for anything governments don't want to see passed around the internet.

The law allows the government to demand removal of content that undermines the government's official narratives. This isn't a loophole or an unexpected side effect. It's the point of the law. Any minister can issue a content removal demand if they see something they feel "undermines democratic processes or society."

Removal demands are supposed to be the last resort. The first response to alleged fake news is the issuance of a correction notice -- again, as demanded by the Singaporean government. This is far less draconian than demanding removal of content, but this response method has its own set of problems. The law requires more than the appending of a correction to alleged fake news. It also requires tech companies to ensure everyone who viewed the alleged fake news is informed of the correction. This will result in the creation and maintenance of web tracking infrastructure solely for the benefit of the government.

Correction notices effectively require websites to track those who post, look at and might be influenced by or attracted to a “false” statement. They can be ordered to identify all those who looked at the infringing material even before it was labeled troubling. They must then send out correction notices to these prior viewers, or risk hefty fines and even jail time.

Once companies are retaining records on all Singaporean users to comply with the fake news law, they won't be able to credibly claim they don't have these records if the government starts demanding them for other reasons. It will sweep in more than just new sources and social media sites. It will also cover anywhere else "fake news" might be posted, which includes comment threads and review sites.

Intentionally or not, the Singapore government has used fake news to create an internet surveillance program. The best part is it won't cost the government a cent to run it. It will be performed free-of-charge by tech companies who will still be on the hook for fines if the government decides they're not fighting fake news well enough.

Filed Under: fake news, internet, privacy, singapore, surveillance

Facebook Fails To Block EU Court Case That Could Rule Against Most Transatlantic Data Flows

from the privacy-shield-not-looking-so-doughty dept

Last August, we wrote about the latest development in an important case moving through the EU's legal system. At risk is the huge volume of data that flows from the EU to the US, currently authorized by the Privacy Shield scheme. The original complaint was brought by that indefatigable defender of privacy, Max Schrems. Given the importance of the outcome, the Irish High Court referred the case to the EU's top court, the Court of Justice of the European Union (CJEU). It posed eleven quite searching questions that it asked the CJEU judges to rule on.

Schrems's specific complaint concerns Facebook, which took the unusual step of appealing against the High Court's decision. The received wisdom was that this was not an option, but the Irish Supreme Court disagreed, and said it would consider the appeal. Facebook alleged that the questions sent by the High Court to the CJEU contained factual errors that were serious enough to require the request to be thrown out. The Irish Supreme Court has now handed down its judgment (pdf) -- against the appeal. Ireland's Chief Justice explains why:

having analysed each of the remaining heads of appeal, I am satisfied that in each category it is more appropriate to characterise the criticisms which Facebook seeks to make of the judgment of the High Court as being directed towards the proper characterisation of underlying facts rather than towards those facts themselves. In those circumstances, I would not propose making any order overturning any aspect of the High Court judgment. If there had been an actual finding of fact as such, rather than a characterisation of facts, which I considered was not sustainable on the evidence before the High Court in accordance with Irish procedural law, I would have been happy to propose an order overturning that fact. However, it does not seem to me that any such matter has been established on this appeal.

In his press release on the decision (pdf), Schrems writes:

Facebook likely again invested millions to stop this case from progressing. It is good to see that the Supreme Court has not followed Facebook's arguments that were in total denial of all existing findings so far. We are now looking forward to the hearing at the Court of Justice in Luxembourg next month.

That hearing is something Facebook really wanted to stop. Afterwards, the CJEU will rule whether the Privacy Shield framework should suffer the same fate as its predecessor, Safe Harbor. If it is ruled invalid, it will be a big headache not just for Facebook, but for the many US companies that depend upon Privacy Shield to make the transfer of personal data about EU citizens legal under the region's strict data protection laws.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, eu, ireland, max schrems, privacy, privacy shield
Companies: facebook

If Facebook's Privacy Practices Anger You, AT&T Shouldn't Get A Free Pass

from the ill-communication dept

Recent privacy conversations have tended to fixate almost exclusively on Facebook and its seemingly-bottomless pit of privacy scandals. But we've noted more than a few times how telecom has somehow been excluded from these conversations, despite behavior that's historically been as bad...or worse. From hoovering up and selling your location data to every Tom, Dick, and Harry on the internet, to trying to charge consumers even more money just to protect their own private data, telecom has a long, thirty-year history just packed with playing fast and loose with your private browsing, location, and other data.

And yet while the newswires are routinely now flooded with stories about how we need to break up Facebook, telecom has oddly gotten a pass. Telecom lobbyists just convinced the US government to effectively neuter FCC oversight authority over ISPs, all while these same ISPs call for heavier regulation of Silicon Valley giants they want to compete with in the online video ad space. That this might just be all one connected problem appears to be a concept that has escaped the thinking of far too many purported experts in the antitrust and tech policy worlds.

Telecom giants are particularly problematic because they not only own the conduit to the home, they increasingly own the services and content flowing over those connections, providing endless anti-competitive opportunities. As companies like AT&T and Comcast keep making very clear, they not only want to dominate wireless and fixed broadband, they want to be the next Google or Facebook. Fortune recently did a deep dive into AT&T's ambitions, highlighting how the company's data collection and tracking ambitions are every bit as problematic as Facebook:

"Say you and your neighbor are both DirecTV customers and you’re watching the same live program at the same time,” says Brian Lesser, who oversees the vast data-crunching operation that supports this kind of advertising at AT&T. “We can now dynamically change the advertising. Maybe your neighbor’s in the market for a vacation, so they get a vacation ad. You’re in the market for a car, you get a car ad. If you’re watching on your phone, and you’re not at home, we can customize that and maybe you get an ad specific to a car retailer in that location.”

Such targeting has caused privacy headaches for Yahoo, Google, and Facebook, of course. That’s why AT&T requires that customers give permission for use of their data; like those other companies, it anonymizes that data and groups it into audiences—for example, consumers likely to be shopping for a pickup truck—rather than targeting specific individuals. Regardless of how you see a directed car ad, say, AT&T can then use geolocation data from your phone to see if you went to a dealership and possibly use data from the automaker to see if you signed up for a test-drive—and then tell the automaker, “Here’s the specific ROI on that advertising,” says Lesser. AT&T claims marketers are paying four times the usual rate for that kind of advertising."

To make this work, AT&T needs to collect your TV viewing data, your daily location data, a significant database on your interests, data from third parties (car dealers), and your daily internet clickstream habits, a fusion of previously siloed datasets that even Verizon executives worried would be a bridge too far.

The problem, of course, is that AT&T has an absolutely terrible track record on privacy, and that's before you factor in that the company is effectively bone-grafted to the NSA. And yet you probably haven't seen many articles recently arguing for the breakup of AT&T. Only a few journalists seem to be even remotely keyed into the idea that myopically focusing on Facebook is a problem when AT&T's planning an even broader fusion of video, location, clickstream, and other data to track you on an unprecedented scale:

"If this was a story about Mark Zuckerberg and Facebook, this scheme would cause a week-long outrage cycle. It is outrageous, especially when you consider that AT&T also routinely hands over customer information to the government, is under investigation for illegally selling customer location data to shady third parties, and is generally about as protective of your data as a hotel front desk guarding a bowl of mints."

Again, telecom lobbyists and hired policy guns have convinced the government there should be no meaningful oversight of telecom despite it being rife with natural monopolies. At the same time, they're repeatedly (often somewhat covertly) driving much of the call to heavily regulate Silicon Valley. Yet somehow, folks angry with Facebook's privacy practices are often oddly oblivious to telecom's equally-problematic ambitions. Casual treatment of your private data isn't something exclusive to Facebook, and if we're going to solve modern privacy problems, a broader view that includes telecom is going to be essential.

Filed Under: privacy, surveillance, telcos, tracking
Companies: at&t

One Year Into The GDPR: Can We Declare It A Total Failure Yet?

from the click-here-to-pretend-we-respect-your-privacy dept

Tomorrow will represent a full year since the GDPR went into effect. In the run-up to the GDPR, we called out many of the problems with the regulation which, while well-intended, did not seem to deal well with the nature of the internet, speech, or what privacy actually means. In the year since, we've posted numerous stories highlighting the negative consequences of this poorly considered law.

Whenever we do that, however, many of the law's defenders insist that these unintended consequences are a small price to pay for either protecting our privacy or reining in the internet giants. So, it does seem worth investigating whether or not the GDPR has done either of those things. And, so far, the evidence is sorely lacking. Indeed, on the question of dominance, we pointed out late last year that the early returns suggested that the GDPR had only made Google more dominant, which hardly seems like a way to punish the company.

And now that we have more results, it seems more and more people are realizing that the GDPR has been an utter failure. As CNBC notes in its evaluation of the law, it's hard to see how the GDPR has resulted in any benefits to the public. Instead, it's just created a big mess:

...one year later, GDPR hasn’t lived up to its potential.

Among some consumers, GDPR is perhaps best known as a bothersome series of rapid-fire, pop-up privacy notices. Those astronomical fines have failed to materialize. The law has created new bureaucracies within corporations, and with those, tension and confusion. And it’s unclear if the EU data authority that oversees the law is adequately staffed to handle its demands.

In short, from the user side especially, all the GDPR has done is made people constantly need to click on annoying privacy and cookie notices that they don't read and don't find useful at all. This shouldn't have been a surprise. We've pointed out for many years that the entire concept of a privacy policy is backwards. It creates a situation where no one actually reads it, and it doesn't do much to protect anyone's privacy. I head someone recently note that they should really be called "data exploitation policies," and that, at least, would be a bit more accurate. But still wouldn't get anyone to read them or better protect anyone's privacy.

And, as Politico has pointed out, it appears that not only has the GDPR made the big tech companies more dominant, it's now laid out the rules of the road by which they can introduce even more privacy-destroying offerings:

New forms of data collection, including Facebook’s reintroduction of its facial recognition technology in Europe and Google’s efforts to harvest information on third-party websites, have been given new leases on life under Europe’s General Data Protection Regulation, or GDPR.

Smaller firms — whose fortunes were of special concern to the framers of the region’s privacy revamp — also have suffered from the relatively high compliance costs and the perception, at least among some investors, that they can’t compete with Silicon Valley’s biggest names.

“Big companies like Facebook are 10 steps ahead of everyone else, and 100 steps ahead of regulators,” declared Paul-Olivier Dehaye, a privacy expert who helped uncover Facebook’s Cambridge Analytica scandal. “There are very big questions about what they’re doing.”

This entire approach is backwards and silly. If we want to have better control over our privacy we're not going to do it through demanding better privacy policies, or confusing data protection laws. We need to create the incentives to put the actual control of the data back into the hands of the users. And that doesn't just mean a right to download your info. It means that you have full control over your data and get to control what apps and services can access it and for what reasons. That's not the world we have today, and nothing in the GDPR gets us any closer to it.

And the answer is not "more enforcement." That just locks in the big companies even more and continues to present the roadmap to "follow" the rules, or to work the refs. Instead, if we moved to a system of protocols instead of platforms we could decouple the data from the service, putting real control of the data back in the hands of end users. Then things like privacy policies and GDPR enforces wouldn't matter so much, because we'd have direct control over our data.

Instead, all we have is a massive law that has harmed startups, entrentched big companies, failed to protect privacy and just served to annoy most users.

The reality is that many people, in order to save time, simply click “OK” on the never-ending stream of pop-ups and most everyone I spoke to confess that they just move on when unable to access the desired website. Or, as one Twitter user told expressed, “I read a lot fewer articles in US papers/magazines.”

And, sure, there have been a few fines of internet companies, but as recent GDPR complaints show, there does not appear to be any way to actually fully comply with the GDPR, which makes it a particularly useless law. If you can't actually comply, if it's not actually protecting privacy, and it's just annoying users and creating more bureaucracy, what good is it?

Meanwhile, Alec Stapp has collected a ton of stories and examples of the GDPR's negative impact. It notes much of the stuff above, but also highlights just how damaging it's been to innovation on the whole:

Startups: One study estimated that venture capital invested in EU startups fell by as much as 50 percent due to GDPR implementation. (NBER)

Mergers and acquisitions: “55% of respondents said they had worked on deals that fell apart because of concerns about a target company’s data protection policies and compliance with GDPR” (WSJ)

Scientific research: “[B]iomedical researchers fear that the EU’s new General Data Protection Regulation (GDPR) will make it harder to share information across borders or outside their original research context.” (POLITICO)

So now that we've had a year, can we admit that the GDPR has been a total failure by almost every possible measure? Supporters of the law will say to give it more time, or to say we need to "improve" the rules, but it should be obvious by now that the entire approach is the problem, not the implementation.

Filed Under: censorship, competition, compliance, data protection, dominance, eu, free speech, gdpr, privacy, tech

San Francisco Is The First City In The World To Restrict Government Use Of Facial Recognition Technology. Hopefully It's Not The Last.

from the keep-it-going dept

We welcome the city of San Francisco’s decision to ban the use of AI-enabled facial recognition technology by police and other municipal agencies. Facial recognition technology is prone to misidentification and biased targeting, particularly among members of vulnerable communities. It also opens the door to intrusive surveillance -- beyond the scope of existing technology. Until the technology improves to avoid such harms, its use should be heavily restricted. And even with improvements, the public must confront tough questions about how closely governments should monitor their behavior.

Regrettably, global trends are headed in a reverse direction from San Francisco’s decision. From Azerbaijan to Singapore, governments are enthusiastically embracing facial recognition technology. Led by China, such systems are becoming increasingly ubiquitous. Facial recognition has been incorporated into smart city platforms. Cities are placing them on public lampposts and integrating them into security operations centers. While there is greater public awareness of China’s surveillance strategy – particularly its establishment of artificial intelligence-powered facial recognition repression in Xinjiang -- few realize that numerous other countries are developing facial recognition capabilities as well.

This is particularly problematic in countries that lack basic rule of law protections and are already committing major human rights abuses. In countries such as Kazakhstan, Turkey, and Zimbabwe, facial recognition is a dangerous tool that further augments those governments’ arsenals of digital repression by giving them an enhanced capacity to deploy targeted monitoring in public places, to track and harass dissidents and opposition figures at will, and to suppress democratic political activity.

But even in democracies like the United States, government use of facial recognition technology, in its current form, corrodes civil rights and civil liberties because its errors disproportionately impact vulnerable communities. Astudy published earlier this year by MIT’s Media Lab, for instance, found that Amazon’s facial recognition software, which the company has peddled to police departments and Immigration and Customs Enforcement, more frequently misidentified an individual’s gender if they were female or dark-skinned.

Concerned about such disparities, San Francisco’s decision prohibits municipal agencies from using facial recognition technology except at federal facilities like the airport. Taken under the Stop Secret Surveillance ordinance, municipal agencies must also seek approval for any new surveillance technology they want to acquire. The decision passed 8-1 with overwhelming public support.

Even for a state like California that prides itself on trailblazing legislation (among many ‘firsts’, California led the way in requiring that corporate boards include women and enacting a greenhouse gas cap-and-trade program), San Francisco’s decision is extraordinary. Most of the current commentary points out that San Francisco is the first American city to ban government use of facial recognition technology. However to our knowledge, it’s not just the first American city to do so-- it’s the first city in the world; a feat made only more remarkable by the city’s position as the seat of technological innovation -- a rare instance of Silicon Valley putting values ahead of profits.

San Francisco’s decision also has important international implications. Facial recognition surveillance remains relatively nascent in most countries. While governments are interested in expanding their use of it, few states are deploying facial recognition at scale…yet. The world still has an opportunity to institute global safeguards and norms to shape how governments use facial recognition.

San Francisco’s ban is receiving widespread attention. We sincerely hope that this attention will lead to technological innovations that fix facial recognition’s bias problem and, notwithstanding such improvements, a healthy public discourse about facial recognition’s repressive potential.

Charlotte Stanton is a fellow in the technology and international affairs program and the director of the Silicon Valley office of the Carnegie Endowment for International Peace. Steven Feldstein is a non-resident fellow in Carnegie’s democracy, conflict, and governance program and the Frank and Bethine Church Chair of Public Affairs and Associate Professor in the School of Public Service at Boise State University.

Filed Under: bans, facial recognition, police, privacy, san francisco, searches

After Five-Year Legal Battle, Top Judges Rule That The UK's Spying Activities Can Be Challenged In Ordinary Courts

from the if-at-first-you-don't-succeed dept

The digital rights group Privacy International has won a major victory against UK government surveillance after a five-year legal battle. One of the many shocking revelations of Edward Snowden was that the UK security and intelligence services break into computers and mobile phones on a massive scale. Privacy International challenged this "bulk" surveillance at the UK's Investigatory Powers Tribunal (IPT), the "judicial body which operates independently of government to provide a right of redress for anyone who believes they have been a victim of unlawful action by a public authority using covert investigative techniques". In February 2016, the IPT dismissed Privacy International's challenge, ruling that:

the UK government may use sweeping 'general warrants' to engage in computer hacking of thousands or even millions of devices, without any approval from by a judge or reasonable grounds for suspicion. The Government argued that it would be lawful in principle to use a single warrant signed off by a Minister (not a judge) to hack every mobile phone in a UK city -- and the IPT agreed with the Government.

In May 2016, Privacy International challenged the IPT's decision in the UK High Court, which agreed with the UK government's position that Tribunal decisions were not subject to judicial review. So Privacy International turned to the Court of Appeal, in February 2017. In November 2017, the Court of Appeal dismissed the move, finding in favor of the UK government once more. Undeterred, the digital rights group applied for and was granted permission to appeal to the UK's Supreme Court, which has now ruled that IPT decisions can indeed be challenged in the courts (pdf). Caroline Wilson Palow, Privacy International's General Counsel, explains why that's important:

Today's judgment is a historic victory for the rule of law. It ensures that the UK intelligence agencies are subject to oversight by the ordinary UK courts. Countries around the world are currently grappling with serious questions regarding what power should reside in each branch of government. Today's ruling is a welcome precedent for all of those countries, striking a reasonable balance between executive, legislative and judicial power.

The hope is that other countries will take note of the UK Supreme Court ruling, and follow suit by allowing judicial oversight of national surveillance activities. Privacy International intends to take advantage of the new judgment immediately to tackle the UK's bulk surveillance revealed by Snowden:

Today's ruling paves the way for Privacy International's challenge to the UK Government's use of bulk computer hacking warrants. Our challenge has been delayed for years by the Government's persistent attempt to protect the IPT's decisions from scrutiny. We are heartened that our case will now go forward.

As well as a welcome result in itself, Privacy International's ultimate victory after a string of legal defeats is a useful reminder that persistence and patience are important virtues for activists.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: courts, ed snowden, privacy, spying, surveillance, uk
Companies: privacy international