New EARN IT Act Creates An Insane New Dilemma: Either Encrypt All Or Spy On All

from the this-seems-counterproductive dept

Last week, as predicted, the Senate Judiciary Committee voted unanimously to replace the original EARN IT Act, with a new one. As part of the markup, they also voted to approve Senator Patrick Leahy's amendment which some might read to say that EARN IT cannot be used to block encryption -- but the reality is a lot more complicated. As I'll explain, this new bill is terrible in a different way than the old bill: it will create a new dilemma in which internet services will either feel compelled to encrypt everything or in which the only way you'll be able to use any internet service is if you hand over a ton of personal information to the service provider -- potentially putting your privacy at extreme risk.

First lets acknowledge an oddity about this new bill. Both bills involve the creation of a commission to come up with "best practices" in trying to stop "child sexual abuse material" or CSAM (the concept formerly known as child porn). In the old bill, if sites didn't follow the commission's best practices, they could lose their Section 230 protections. This resulted in fears that the commission would outlaw encryption as a "best practice." The new bill retains the commission, but for no recognizable purpose. Instead, it does away with the pretense and just says that a bunch of sites should lose Section 230 protections no matter what. It seems quite odd to first say "we need a commission to determine best practices" and then on a second pass say that before the commission has done anything we're just going to make massive changes to Section 230 based on... nothing at all. No evidence saying that this would create better outcomes. No evidence that Section 230 is a problem with regards to CSAM. Just... nothing.

Specifically, the new bill makes a change to Section 230 that looks similar to the change that was made with FOSTA, saying that you don't get 230 protections if you advertise, promote, present, distribute, or solicit CSAM. But here's the thing: CSAM is already a federal crime and all federal crimes are already exempted from Section 230. On top of that, it's not as if there are a bunch of cases anyone can trot out as examples of Section 230 getting in the way of CSAM prosecutions. There's literally no evidence that this is needed or will help -- because it won't.

As we've detailed before, the real scandal in all of this is not that internet companies are facilitating CSAM, but that the DOJ has literally ignored its Congressional mandate to go after those engaged in CSAM production and distribution. Congress tasked the DOJ with tackling CSAM and the DOJ has just not done it. The DOJ was required to compile data and set goals to eliminate CSAM... and has just not done it. That's why it's bizarre that EARN IT is getting all of the attention rather than an alternative bill from Senators Wyden, Gillibrand, Casey and Brown that would tell the DOJ to actually get serious about doing its job with regards to CSAM, rather than blaming everyone else.

But digging into the details, the real problem here is that, as structured, the new EARN IT Act would be a disaster in trying to achieve the goals the sponsors have set out for it. First off, thanks to the addition of Senator Leahy's Amendment, some may see the bill as one that effectively requires encryption to avoid liability for CSAM. Even that's not totally clear, however. While you can read Leahy's amendment to say that encryption is protected, the actual structure of the final bill punts many issues to state law, and that means having to comply with 50 different state laws. Some, like Illinois, have lower standards for the mens rea regarding CSAM, and the worry is that we won't know whether or not offering end-to-end encryption would be seen as violating state laws until long and costly cases go through their lengthy process.

Either way, this weird CSAM carveout from Section 230 is somewhat equivalent to the moderator's dilemma that other attempts to change Section 230 create. Because most of those other reforms put in place a "knowledge" standard, it gives many sites a reason to never look at the content on their platform. In this case, due to the explicit call out saying that encryption isn't impacted, that would effectively say that if you want to keep 230 protections, you should encrypt absolutely everything. Which, ironically, is the exact opposite of what Attorney General Bill Barr has been asking for.

But, as with the moderator's dilemma, there's also a flipside (if you don't want to ignore everything, then you have to greatly restrict what you allow through). Under the new EARN IT, the flipside is that the government more or less says that you are now responsible for being able to track and identify anyone on your service who is not using encryption -- meaning you would need to carefully verify every user of your platform. No more simple signups. No more anonymity. And, incredibly, this would mean that sites would need to collect a ton of data on every user. Want to use this new service? First submit your phone number, driver's license, etc.

At a time when people are saying they trust big internet companies less and less with their data, why would Senators Graham, Blumenthal, Feinstein, and Hawley (HAWLEY!?!?) be encouraging websites to collect even more (and more intrusive) data on all their users?

Since this is somewhat different than the traditional moderator's dilemma, it might be called the "censor's dilemma" or possibly the "middleman's dilemma," in that this is even more tied to the government's demand that websites block certain content entirely, which puts them in the role of a government middleman or censor (which, not coincidentally, would raise serious constitutional issues with the EARN IT Act turning private entities into state censors).

Either way it is difficult to see how these two outcomes are what Congress (or, for that matter, the DOJ) actually wants:

• Much greater encouragement for websites to encrypt everything
• Much greater encouragement for websites to demand much more personal and private information on users.

And yet, thanks to Congress' standard bungling, that's what we have with the current EARN IT Act. And while it might be nice if the law actually did encourage more encryption, don't pin your hopes on that. As noted above, it's not entirely clear that it really does lead to that outcome, and we might not know until after a whole bunch of litigation. Furthermore, if that is is the end result, it will almost certainly lead to a different kind of backlash and support for even worse laws that seek to blow up encryption through other methods.

In short: the EARN IT Act is bad. At best it might encourage more encryption, but it would also create a whole host of unintended consequences, including much less privacy and no more anonymity on many websites. It's difficult to see how that accomplishes any of the goals of the bill's supporters.

Filed Under: censor's dilemma, data, dilemma, earn it, earn it act, encryption, lindsey graham, middleman's dilemma, moderator's dilemma, patrick leahy, privacy, richard blumenthal, verification

UK Information Commissioner Says Police Are Grabbing Too Much Data From Phones Owned By Crime Victims

from the losing-the-tech-race,-eh? dept

The UK's Information Commissioner's Office (ICO) has taken a look at what law enforcement officers are hoovering up from citizens' phones and doesn't like what it sees. The relentless march of technology has enabled nearly everyone to walk around with a voluminous, powerful computer in their pocket -- one filled with the details and detritus of everyday living. And that relentless march has propelled citizens and their pocket computers right into the UK's regulatory void.

The ICO's report [PDF] doesn't just deal with the amount of data and communications UK cops can get from suspects' phones. It also deals with the insane amount of data cops are harvesting from devices owned by victims and witnesses of criminal acts. Left unaddressed, the lack of a solid legal framework surrounding mobile phone extractions (MPEs) will continue to lead law enforcement officers to believe they can harvest everything and look for the relevant stuff at their leisure.

Very few people would consent to this sort of intrusive search, but some aren't aware of how extensive these searches are. Those that are aware are less likely to come forward to help further an investigation, even if they're a victim of a crime.

Large volumes of data are likely to include intimate details of the private lives of not only device owners but also third parties (eg their family and friends). In other words, it is not just the privacy of the device owner that is affected, but all individuals that have communicated digitally with that person or whose contact details have been added by the owner. This presents considerable risks to privacy through excessive processing of data held on or accessed through the phone.

Left unexplained, or in cases where it is not necessary or justified, this intrusion into individuals’ privacy presents a risk of undermining confidence in the criminal justice system. People may feel less inclined to assist the police as witnesses or to come forward as a victim, if they are concerned that their and their friends’ and families’ private lives will be open to police scrutiny without proper safeguards…

Privacy is paramount when dealing with those not suspected of committing criminal acts. Standard MPE practice appears to ignore this crucial element, which only heightens distrust of law enforcement agencies. But privacy concerns are being swept aside in favor of efficiency. Why do things the right way when it's so much easier to do them this way?

PI [Privacy International] published a report calling for an urgent review of the use of MPE by the police, (“Digital stop and search: how the UK police can secretly download everything from your mobile phone” 15). It raised questions over the lawful bases for carrying out extractions, the lack of national and local guidance, and the authorisation process. [...] PI were also concerned that the use of MPE kiosks (‘self-service’ devices used by police forces to download and analyse the contents of individuals’ mobile phones) is becoming more common and forming part of ‘business as usual’ for officers, despite a lack of governance, oversight and accountability in their use.

But if law enforcement officers don't get what they want, there's a good chance crime victims won't get what they want. Here's where things get extremely unpleasant. It's not that crime victims feel this way. It's what's actually happening. When investigators aren't given consent to perform MPEs on crime victims' phones, there's a chance law enforcement will just decide to stop pursuing the investigation.

Here's what Big Brother Watch discovered after obtaining records from multiple police forces in England and Wales:

It found officers had asked for the complainant's mobile phone data in 84 sexual assault cases.

And every one of the 14 of those in which the complainant had declined had then been dropped by police.

The report calls for a long list of improvements and reforms, with an eye on safeguarding the privacy of crime victims and witnesses. ICO says all extractions should be logged and audited routinely. Investigators should be made aware that it's almost impossible to comply with data privacy laws when performing MPEs due to the amount of data/communications present on the average phone -- much of which "belongs" to other people who have communicated with the victim/witness.

It won't be enough to establish guidelines under the current legal framework. ICO says new laws must be put in place to make it explicit what can and can't be obtained with phone searches and when they can be lawfully carried out. This law would also need to set time constraints on examinations of extracted data, as well as the length of time it can be stored once obtained.

For now, the UK's legal framework is more limited than law enforcement's powers. The ICO's report aims to change that. Unfortunately, this will move at the speed of bureaucracy while tech continues to move at the speed of innovation. It's impossible to play catch-up at this speed. I say it's time to hit law enforcement with some broadly-written legislation -- you know, the sort of stuff the normals are forced to deal with all the time. Maybe that will slow the roll of data extraction until the government as a whole has time to address all the nuances.

Filed Under: data, ico, phones, police, privacy, uk

Privacy Concerns Lead To Deletion Of All Data Collected By Norway's Contact Tracing App

from the not-enough-infections-is-a-nice-problem-to-have dept

In the early days of the coronavirus outbreak -- a few months ago, in other words -- there was a flurry of activity around contact tracing apps. Desperate to be seen to be doing something -- anything -- governments around the world rushed to announced their own digital solutions to tracing people who have been in the proximity of infected individuals. There are now over 40 in various stages of development. After the initial excitement, it's striking how quiet things have gone on the contact tracing front, as projects struggle to turn politicians' promises into useful programs. Some of the apps are beginning to emerge now, and we're likely to hear more about them over the next few weeks and months. For example, there's been an interesting development in Norway, one of the first to release its smartphone app, Smittestopp ("infection stop"), back in April. As the Guardian reports:

On Friday, the [Norwegian] data agency Datatilsynet issued a warning that it would stop the Norwegian Institute of Public Health from handling data collected via Smittestopp.

Datatilsynet said the restricted spread of coronavirus in Norway, as well as the app's limited effectiveness due to the small number of people using it, meant the invasion of privacy resulting from its use was disproportionate.

There are two important points there. One is about the balance between tackling COVID-19, and protecting privacy. In this case, the Norwegian data protection authority (NDPA) believes that the benefit is so small that the harm to privacy is unjustified. The other is that when the infection rate is low, as is the case in Norway, which has reported fewer than 250 deaths from coronavirus so far, people may not see much point in using it. Professor Camilla Stoltenberg, Director-General at the Norwegian Institute of Public Health, is unhappy with Datatilsynet's move:

We do not agree with the NDPA's evaluation, but now we will delete all data and put work on hold following the notification. This will weaken an important part of our preparedness for increased transmission because we are losing time in developing and testing the app. Meanwhile, we have a reduced ability to combat ongoing transmission. The pandemic is not over. There is no immunity in the population, no vaccine, and no effective treatment. Without the Smittestopp app, we will be less equipped to prevent new local or national outbreaks

It's worth noting that Stoltenberg admits that "the work involved in getting the app to work optimally has taken longer than planned, partly because there are few people who are infected". As the number of COVID-19 cases continues to fall in some countries, those developing contact tracing apps there may encounter similar problems.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: contact tracing, covid-19, data, deletion, norway, privacy

Florida Government Decides To Fire Its Data Chief Rather Than Be Honest About Its COVID Numbers

from the 'we've-found-a-cure-that's-worse-than-the-disease!' dept

We were promised no more deaths by May 15th, but that hasn't happened. With no one 100% sure what the best options are going forward, this is how states are handling the task of (lol) cautiously "reopening." A long press conference held by the Trump administration said states could reopen if they hit a number of checkpoints, including a certain amount of testing and a plateau/drop in positive cases.

A number of states appear to have stopped listening after the word "reopen." Whether or not they've hit the CDC's checkpoints does not appear to matter. A collective shrug about deaths and infections was issued by a number of governors, some of whom are (justifiably) tired of gun-toting residents showing up at the state house to protest their lack of access to haircuts and house parties.

When the data doesn't match the narrative, there's only one thing to do: fuck up the data. And the person who's compiling it. Florida has lots of sunny beaches that are currently too empty to satisfy sun junkies who wish to take advantage of the lengthy shorelines contained in America's Penis. COVID stats weren't exactly lending themselves to the "it's fine" narrative the governor wanted to push. So, the state government did some pushing of its own.

Late last Friday, the architect and manager of Florida's COVID-19 dashboard — praised by White House officials for its accessibility — announced that she had been removed from her post, causing outcry from independent researchers now worried about government censorship.

[...]

Citing "reasons beyond my division’s control," Jones said her office is no longer managing the dashboard, is no longer involved in publication, fixing errors or answering questions "in any shape or form."

She warned that she does not know what the new team's intentions are for data access, including "what data they are now restricting."

The means of impartial COVID stat reporting have been seized. Power to the (powerful) people! The dashboard that used to provide an easy-to-understand breakdown of the state's infection and death rates is being replaced with something that aligns more closely with the aura of sunny healthiness the state government wants to project. Dance through the droplets or whatever. Want to check the state's new math? Well, you can fuck right off, apparently.

When [researchers] tried requesting the previously available underlying data, DOH officials said that because the data are "provisional" no such requests would be considered until May 2021.

Yet the state regularly publishes provisional data, including for infectious diseases such as influenza.

Here's the governor's literally unbelievable defense of his indefensible actions: when someone asks for time off, they're clearly asking to be fired and for their work to be destroyed.

When first asked about Jones' dismissal, [Governor Ron] DeSantis on Monday called it a "nonissue." He said he understood from an email she sent her supervisor that "she was tired and needed a break."

He then went on to claim -- after being given a few days to compose his thoughts -- that this firing was due to "repeated insubordination" rather than the researcher just being tired. "Insuboridination" apparently means publishing actual COVID stats rather than manipulated data that provides post hoc justification for the state government's reopening plans.

The state is now open. Whether or not that's good for residents and visitors remains to be seen. The state has taken control of a narrative. Since the real numbers aren't aligned with the state's official OPEN FOR BUSINESS pitch, the state apparently felt its only option was to fire the person compiling the data.

Now, residents and visitors will have only the state-approved numbers to rely on. Let's hope they don't. If this turns into another pandemic nightmare that the state could have avoided by being honest, citizens are going to start wondering why government entities are immunized against manslaughter charges. And those who demanded at gunpoint that the government take the brakes off the state economy are welcome to discover firsthand why an overabundance of caution is preferable to caution that's been carried off by the wind.

This is a state that has decided to lie to everyone, starting with itself. Govern yourself accordingly.

Filed Under: cdc, covid-19, data, florida, guidelines, rebekah jones, reopening, ron desantis, transparency

Now The Washington Post Misleadingly Complains About Google & Apple Protecting Your Privacy Too Much

from the oh-come-on-guys dept

Both the NY Times and the Washington Post have been among the most vocal in attacking internet companies like Google and Facebook, claiming that they're bad regarding your privacy. Yet, like with France (who fined Google for its privacy practices, but then got mad at the company over the privacy-protecting features of its COVID contact tracing API), the Washington Post has a very, very weird article complaining about Google and Apple's project because it's too protective of people's privacy. We've talked in the past about how the API (jointly developed between Apple and Google) was designed from the ground up to be privacy protective. And you know damn well that if the API wasn't developed as such there would be huge articles in the Washington Post and elsewhere decrying this API as a threat to everyone's privacy. Yet here, the complaint is that it's too protective, because these companies simply can't win.

John Gruber, over at Daring Fireball, has an excellent post explaining just how spectacularly bad the Washington Post article is, but we'll do our own treatment as well.

The crux of the article is that some "health officials" are annoyed that the API won't share data with them directly, but is more designed to alert individuals themselves if they may have come into contact with someone who turns out to be COVID-19 positive.

But as the tech giants have revealed more details, officials now say the software will be of little use. Due to strict rules imposed by the companies, the system will notify smartphone users if they’ve potentially come into contact with an infected person, but it won’t share any data with health officials or reveal where those meetings took place.

Local health authorities in states like North Dakota, as well as in countries such as Canada and the United Kingdom, say they’ve pleaded with the companies to give them more control over the kinds of information their apps can collect. Without the companies’ help, some worry their contact tracing systems will remain dangerously strained.

But Apple and Google have refused, arguing that letting the apps collect location data or loosening other smartphone rules would undermine people’s privacy.

Now, a good news report would explain why it's important for Google and Apple's API to protect people's privacy -- and maybe even highlight how lots of people, including some at the Washington Post, have frequently hammered Google and Apple over privacy concerns. Hell, just a few weeks ago, one of the very same reporters on this article, Drew Harwell, was bylined on an article saying that most Americans wouldn't want to use apps based on the API because they don't trust Google and Apple's privacy protections. Though, of course, even that headline was misleading. That headline said "Most Americans are not willing or able to use an app tracking coronavirus infections. That's a problem for Big Tech's plan to slow the pandemic." Yet, they have to do some funny math to make that "most" work, because the actual data said that 50% said they would use it, and among those who had phones, 59% said they'd be comfortable with the app informing others they had COVID-19.

So just a few weeks earlier, the same Washington Post, and one of the same reporters, was crowing about how people wouldn't trust Apple and Google with their contact tracing apps due to privacy concerns. Then they publish this other piece saying that health officials are steamed that the companies are doing too much to protect people's privacy. They can't win.

The article then quotes a very confused professor (tragically, from my own alma mater):

But Helen Nissenbaum, a professor of information science and director of the Digital Life Initiative at Cornell University, called Apple and Google’s use of privacy to defend their refusal to allow public health officials access to smartphone technology a “flamboyant smokescreen.” She said it was ironic that the two companies had for years tolerated the mass collection of people’s data but were now preventing its use for a purpose that is “critical to public health.”

“If it’s between Google and Apple having the data, I would far prefer my physician and the public health authorities to have the data about my health status,” she said. “At least they’re constrained by laws.”

Basically all of this is wrong or bullshit, and a good reporter would have either (a) immediately pointed out that this is bullshit or (b) not published the bullshit. First off, it's not a "flamboyant smokescreen." Google and Apple very clearly put a lot of thought into the privacy features of this API. Second, they're not "preventing its use" for something "critical to public health". The entire point of the API is to make use of this data in a way that helps deal with the crisis. And this is new data, not the data they've "mass collected." On top of that, despite Nissenbaum's insinuations to the contrary, none of this is new. It's how Google and Apple work. Both have long histories of fighting back to make sure that government agencies can't access your private data without a very clear legal basis to do so.

Most importantly, though, Google and Apple don't have the data. That's part of the "privacy protection" here -- and anyone would know that if they looked at anything that Google and Apple have put out about this API. The data stays on your phone. It's based on your phone, and then the individuals get to make the choice of whether or not to share the data. The FAQ from Apple and Google make this all very clear:

In keeping with our privacy guidelines, Apple and Google will not receive identifying information about the user, location data, or information about any other devices the user has been in proximity of.

And, if the users decide, then the necessary information can be shared with public health officials:

If a user chooses to report a positive diagnosis of COVID-19 to their contact tracing app, the user’s most recent keys to their Bluetooth beacons will be added to the positive diagnosis list shared by the public health authority so that other users who came in contact with those beacons can be alerted.

It seems like both Nissenbaum and the Washington Post owe people a rather large apology.

Next up, there's a quote from Matt Stoller, who has built up a cottage industry making ignorant statements about big internet companies (and cheering on Senator Josh Hawley's anti-internet nonsense). While I've come to expect nonsense from Stoller, the quote he gives the Post is beyond the pale:

“They are exercising sovereign power. It’s just crazy,” said Matt Stoller, the director of research at the American Economic Liberties Project, a Washington think tank devoted to reducing the power of monopolies. Apple and Google have “decided for the whole world,” he added, “that it’s not a decision for the public to make. … You have a private government that is making choices over your society instead of democratic governments being able to make those choices.”

Again, nearly everything Stoller says here is wrong. Gruber's summary of it covers this better than anything I would say:

This quote is what’s crazy. Again, this guy Stoller clearly has no idea what he’s talking about. Apple and Google deciding how their operating systems work, in compliance with all existing laws, all around the world, is not “exercising sovereign power”. No one here is alleging that Apple or Google are doing anything even vaguely illegal. They’re not toeing some sort of line, they’re not taking advantage of any sort of loopholes.

And if Apple and Google did what Stoller and Nissenbaum seem to want them to do — track location data of every person you’re in contact with and report that data automatically to government health officials, they almost certainly would be breaking all sorts of laws around the world. The whole point of Europe’s well-intentioned but overzealous GDPR law — 88 dense pages in PDF — is, quoting from its preamble, “Natural persons should have control of their own personal data.” That’s exactly the point of Apple and Google’s system — and seemingly exactly the opposite of what every source in this Post story thinks Apple and Google should do.

Honestly, it's not at all difficult to imagine that if Google and Apple's API was automatically handing data over to the government, you'd see Stoller and Nissenbaum still complaining and suddenly they'd be all concerned about the companies "exercising sovereign power" to "mass collect people's data" and just "handing it over to the government." Again, this is a no win situation, in which the companies are being shat upon as if they're doing the wrong thing when it's clear they've bent over backwards to make sure they were doing the right thing and giving as much power and control as possible to the end user.

Basically every quote in this piece is utter nonsense -- the kind of nonsense that a reporter should be explaining why it's wrong or not publishing. But here it is all published as if these people are making good points. Here's the next one:

“Every minute that ticks by, maybe someone else is getting infected, so we want to be able to use everything we can,” said Vern Dosch, the contact-tracing liaison for North Dakota. “I get it. They have a brand to protect. I just wish they would have led with their jaw.”

Huh? What "brand" are they protecting here? The brand that says... they're going to help out by building a big system that others can build on and use for free, and that actually protects people's privacy? I honestly don't get what what Dosch is even saying here. Of course government officials want every piece of data, and this system is designed to help them get more data, but also to protect privacy. And I honestly have no clue what "led with their jaw" even means here.

It's only twenty six paragraphs in that the article mentions how "some privacy advocates have applauded the companies’ stance around anonymity and security concerns," but then it shits on that almost immediately:

But some parts of the U.S., including Apple and Google’s home state, say the restrictions have rendered the apps effectively useless. In California, epidemiologists in charge of contact tracing are ignoring the Apple-Google approach and have decided the best course for contact tracing is to train thousands of people to do the work.

Which "apps" are they even talking about? This is an API, not an app, and it's not even out yet, so these "apps" can't be useless yet. They don't exist. And the fact that California epidemiologists are focusing on training human contact tracers is... meaningless? No one has said that this API should replace human contact tracers. The idea has always been that it's another tool -- not a replacement. And then we get another ridiculous quote:

“The limitations of those kind of apps are extensive,” said Mike Reid, an assistant professor of medicine at the University of California at San Francisco, who is leading the effort to train contact tracers in the state. “I don’t think they have an important role to play for most of the population.”

The contact tracers, he said, will be using software made by Salesforce and Accenture to help reach patients by phone and are trained on how to protect sensitive patient information.

“We go to pains to minimize the amount of data we take from people and we ask consent from people we’re talking to on the phone. We go to considerable lengths to ensure there are strong technical controls to ensure the anonymization of our platforms,” he said. “Can you say the same thing about these big tech companies? I’m not sure.”

Um. Dude. Did you not even bother to read the details of the API that you're commenting on, about which you say you're "not sure" if the data is minimized or that there are strong technical controls to make sure the data remains anonymous? Because half of this very article is all about how other health professionals are annoyed that the apps are doing too much to protect the data.

And, honestly, how is it that these reporters are using quotes that are in direct conflict with other quotes in the article (the API keeps things too private, who knows if the big companies will keep things private...) as if they're making the same argument.

This is just bad, bad reporting.

With the Apple and Google approach, “We’ve overcompensated for privacy and still created other risks and not solved the problem,” said Ashkan Soltani, the former chief technologist of the Federal Trade Commission. “I’d personally be more comfortable if it were a health agency that I trusted and there were legal protections in place over the use of the data and I knew it was operated by a dedicated security team.”

I know and like Ashkan, and have quoted him in the past, but this... is just a bizarre quote in its own right. Google and Apple have two of the best "dedicated security teams" around. Meanwhile the federal health agency, Health & Human Services, has a history of getting hacked, including some sort of hack as the pandemic began (exactly what happened still has not been made clear).

But some public health experts believe the push toward unproven virus-tracing apps has wasted time and missed the point. Tom Frieden, the former director of the Centers for Disease Control and Prevention now working with the health organization Vital Strategies, said the proximity-tracing system as proposed by Apple and Google has “been largely a distraction.”

“There are very serious questions about its feasibility and its ability to be done with adequate respect for privacy, and it has muddied the water for what actually needs to happen,” Frieden said in an interview Wednesday. “This was an approach that was done with not much understanding and a lot of overpromising.”

This quote may be the most accurate of the bunch, but in its own way misleading as well. I haven't seen anyone "overpromising." The people involved in the project and supportive of it have argued that it might be an additional useful tool beyond everything that everyone else is doing. I haven't seen how it's "muddied the waters" for what others need to do.

Honestly, we don't really know how useful the apps built on this API will or won't be. There are reasons to be skeptical of their usefulness, but if you wanted to understand why, you wouldn't get help from this article, which really just seemed like an attempt by the reporters to collect as many disjointed anti-Google and Apple quotes as possible and put them all together in an article that is incredibly misleading and not even internally consistent.

Filed Under: api, contact tracing, data, helen nissenbaum, journalism, matt stoller, privacy, tradeoffs
Companies: apple, google

AT&T Provided FCC Bunk Broadband Availability Data Across 20 States

from the driving-blind dept

We've noted repeatedly that despite a lot of talk from U.S. leaders and regulators about the "digital divide," the United States doesn't actually know where broadband is available. Historically the FCC has simply trusted major ISPs -- with a vested interest in downplaying coverage and competition gaps -- to tell the truth. The FCC's methodology has also long been flawed, considering an entire area to be connected if just one home in a census tract has service. The results are ugly: the FCC's $350 million broadband availability map all but hallucinates broadband availability and speed (try it yourself).

As pressure mounts on the agency to finally improve its broadband mapping, the scope of the problem continues to come into focus. Like this week, when AT&T was forced to acknowledge that the company provided the FCC with inaccurate broadband availability data across 20 states, impacting some 3,600 census blocks:

"AT&T disclosed the error to the FCC in a filing a week ago. The filing provides "a list of census blocks AT&T previously reported as having broadband deployment at speeds of at least 25Mbps downstream/3 Mbps upstream that AT&T has removed from its Form 477 reports." The 78-page list includes nearly 3,600 blocks."

You'll recall that last year, Ajit Pai tried to claim that his "deregulatory agenda" (read: gutting oversight of an uncompetitive and hugely unpopular business sector) resulted in some amazing broadband expansion. Only later was it revealed that much of this growth either was triggered by things Pai's FCC had nothing to do with (like fiber build-out requirements affixed to AT&T's 2015 merger with DirecTV by the previous FCC), or a broadband mapping blunder by a small provider by the name of BarrierFree, which overstated its footprint to the FCC by a cool 1.5 million locations.

AT&T insists this latest error was caused by a "software bug," and while relatively small in the scope of AT&T's overall service area, consumer groups are a little curious how it could have gone unnoticed for the better part of two years:

"Aside from one even bigger error by an ISP called BarrierFree last year, Turner said he hasn't "seen any other ISP reporting error like this before" and that "it is curious that the [AT&T] error may have gone unnoticed for 2-plus years."..."While relatively small errors like this don't end up changing conclusions about national trends, it certainly can impact the FCC decisions about where to spend—and where to not spend—scarce subsidy funds," Turner said. "AT&T should be quite a bit more forthcoming about the exact nature of this error and how it discovered it, so that other ISPs can be sure they're not making similar errors."

While there's no evidence of intentional under-reporting by AT&T, the timing is curious all the same.

After several decades of complaints, pressure has mounted on the FCC and Congress to actually do something as states vie for additional deployment subsidies. That culminated in the recent passage of the Broadband Deployment Accuracy and Technological Availability (DATA) Act, which mandates the FCC to use more accurate geolocation and crowdsourced data to create more accurate maps and actually verify where broadband's available before doling out billions in subsidies or issuing policy (fancy that!).

It will take years to complete, the FCC has warned they can't afford to finish it without more funding, and the industry, which has spent years lobbying against mapping improvements for obvious reasons, could still find ways to either scuttle the effort or make access to the data difficult. Still, baby steps and all that. There are at least indications that the "what US broadband competition problem?" telecom policy set finally realizes this is a problem that needs fixing, even if truly better broadband maps are still several years away.

Filed Under: broadband, broadband map, data, digital divide, fake data, fcc
Companies: at&t

FCC Still Doesn't Know Where Broadband Is As It Eyes $9 Billion In New Subsidies

from the can't-fix-what-you-don't-understand dept

Despite what you might think, the U.S. government doesn't actually know where broadband is really available, which is kind of a problem when you consider the FCC doles out billions annually in subsidies to expand and improve service.

Later this month, the Pai FCC is expected to sign off on a new plan (pdf) that would dole out $9 billion in funding to help shore up fifth generation (5G) wireless coverage to rural areas. Consumer groups and academics have long argued, however, that the FCC's broadband availability maps have only a fleeting relationship to reality. That concern was mirrored by the Competitive Carriers Association, a coalition of largely small and mid-sized carriers, which issued a statement warning the FCC that it shouldn't be throwing billions in subsidies around without having an accurate understanding of the problem the agency is trying to fix:

"Unfortunately, the FCC is publishing eligibility maps that bear little relationship to where there is or is not actually coverage. The analysis itself notes that the maps released today may bear little resemblance to the areas actually available for funding in an auction, which is extremely concerning. At a time when everyone is recognizing the importance of bridging the digital divide, the FCC seems intent on moving forward with spending $9 billion without bothering to measure the scope of the problem they are purporting to solve.

This approach does nothing to help ensure that unserved and underserved areas have access to robust mobile broadband services. Instead of further analysis on what areas could be eligible, the FCC should focus on implementing the Broadband DATA Act to make data-driven decisions about what areas should receive funding for the next decade of mobile deployment."

And this is the industry saying this. Activists, consumer, groups, and other experts have been using more colorful and direct language to complain about this problem for the better part of two decades now.

Granted, terrible U.S. broadband maps are a feature, not a bug. Bigger ISPs have routinely lobbied to kill any efforts to improve data collection and analysis, lest somebody actually realize the telecom market is a broken mono/duopoly whose dysfunction reaches into every aspect of tech. Bad maps not only help hide a lack of competition and high prices (two subjects the current FCC can't even acknowledge, much less fix), but they help obscure the billions we've thrown at carriers to build sometimes duplicative network assets that often don't fix the problems the money was assigned for.

Fortunately the recently passed Broadband Data Act should help improve mapping somewhat, requiring the FCC explore and adopt measures to shore up accuracy via crowdsourcing and other data. Carriers will now be penalized under law for falsifying data, and the use of broader data sources (rather than just taking a carrier's word for it, the norm for 20 years) should certainly help. But like many starved regulators, the FCC lacks the funding to actually implement the act at present, and even ideally it could be years before the better data is put to policy use. Bigger carriers are also trying to exclude 5G from the improvements.

In the interim, we'll continue doing what we've always done, flinging about billions in subsidies without actually fully understanding the scope of the problem we're trying to fix. That was always a problem, but it's a far more pressing one now that many folks understand the essential nature of decent, affordable broadband connectivity.

Filed Under: 5g, broadband, broadband data act, competition, coverage maps, data, fcc, rural coverage

How Much Data Does Clearview Gather On People? The Answer (Sadly) Will Not Surprise You.

from the hoovering-up-your-entire-online-presence-using-this-1-simple-trick! dept

Clearview's facial recognition app links to a database of 4 billion pictures. And those photos are linked to all the data that got scraped up with them, culled (without permission) from sites like Facebook, Instagram, LinkedIn… pretty much anywhere people post photos and personal information.

There's no opting-out of this collection either, even as Clearview packages and sells access to this scraped data to law enforcement agencies in the US, as well as government agencies in countries known for their human rights abuses. Fun, fun, fun and all just a click away from exploitation by anyone with an account. That includes demo accounts operated by the super-rich and law enforcement officers told to test drive the software by running searches on friends and family members.

How much does Clearview gather on the average person? It's tough to tell. Asking Clearview directly -- at least in most of the US -- will get you nothing. However, California's privacy law (the California Consumer Privacy Act) mandates the disclosure of gathered personal data to requesters. That's what Thomas Smith of OneZero did. And here's what he got back.

The depth and variety of data that Clearview has gathered on me is staggering. My profile contains, for example, a story published about me in my alma mater’s alumni magazine from 2012, and a follow-up article published a year later.

It also includes a profile page from a Python coders’ meetup group that I had forgotten I belonged to, as well as a wide variety of posts from a personal blog my wife and I started just after getting married.

The profile contains the URL of my Facebook page, as well as the names of several people with connections to me, including my faculty advisor and a family member (I have redacted their information and images in red prior to publishing my profile here).

Based on the request process -- which involved some emailing back and forth before Clearview asked Smith to upload a photo of himself to run against its database -- Smith estimates it only took about a minute or so for Clearview to run the search and retrieve his profile.

No one knows how often Clearview crawls the web to gather new info, but what's already been gathered is impressive enough. Unfortunately, there's no one vetting this data, so it's up to end users to figure out what's right and what's wrong. The end users are (most often) law enforcement agencies, who don't really place a premium on ensuring innocent people don't get swept up in their secondhand surveillance nets.

Perhaps most worrying is the fact that some of Clearview’s data is wrong. The last hit on my profile is a link to a Facebook page for an entirely different person. If an investigator searched my face and followed that lead (perhaps suspecting that the person was actually my alias), it’s possible I could be accused of a crime that the unknown, unrelated person whose profile turned up in my report actually did commit.

Or vice versa. The negative possibilities are endless. And all of this starts with a photo of someone's face. No other input is needed. Clearview's algorithm -- which hasn't been independently tested or examined -- does the rest.

And there's more bad news. As Smith points out, Clearview's proprietary system is just it standing on looking over the shoulders of tech giants. If Clearview can do this, anyone similarly motivated can do it. One homegrown surveillance company crashing and burning from negative press just clears the way for more competitors. The bag is open and the cat is long gone. It was gone long before Clearview drifted into the public eye. A large number of companies offer social media monitoring services and plenty of other surveillance tech companies routinely scrape publicly-available data for their government agency users.

The difference is Clearview packaged its offering in an app and handed it out to whoever wanted to take a look at it. If Clearview goes down, something else will take its place. For now, it's the most visible villain. But it's not the only one. And as long as it operates, residents of California (as well as European residents under the GDPR) can demand Clearview show them how much of their data it's gathered. So, those who can should take advantage of that to let others know this is a very real threat to their privacy, not just some theoretical threat that should only cause concern for criminals.

Filed Under: data, data collection, facial recognition, privacy
Companies: clearview, clearview ai

Don't Panic, But Do Reflect: Lessons From The Iowa Democrat Debacle

from the don't-throw-in-the-towel dept

As I write this post, party officials in Iowa are still trying to figure out the results of last night's Democratic Caucus, while pundits and political opponents have wasted no time in tearing into the Democratic Party, technology, and the very idea of democracy itself. Although there is plenty of reason for criticism, much of what there has been overwrought. Professor Ed Felten's twitter thread here provides plenty of useful perspective on this:

Nevertheless, there are many lessons to draw from last night's Iowa caucus mess, but first and foremost is this one: don't panic.

The biggest reason not to panic is that only the technology supporting the tabulation of the results broke. Whereas the systems for recording the results appear to be working just fine: there was paper, instruments for marking the paper, and (eventually) a way to transmit the recorded results to a place where they could all be added together. Sure, it will take a bit longer to add up all the results for the night, but that's ok. Because there's a paper trail we can still know what they are.

That said, there are still some cautionary lessons we as Americans can learn from the experience, not just for primaries and caucuses but for every election for every office, no matter how partisan, run in America.

First, of all the things elections need to be optimized for, speed is not one of them. And should not be one of them. The most important thing elections need is accuracy. While, sure, it would certainly be nice to have accurate results also quickly (and perhaps caucus officials thought the perceived convenience of the app would help towards that end), adding to the list of things it might be nice for election results to be tends to take away from what election results MUST be. And it is not worth the compromise. Which we can understand if we take a moment to think about the consequences if something does go wrong, as something almost always will. The reality is that if election results are delayed, we can still cope. As it is, in general elections results are often not certified until weeks or even months later. There is rarely a legitimate governance need requiring us to know electoral outcomes within hours of polls closing. We can wait a while, and it would probably behoove us to all expect to wait a while, because it's our hunger for instant gratification that is creating pressure to rely on tabulation systems that are not optimized for what we can't live without: accurate results we can all believe in. Ultimately nothing else matters, and we should be dubious about any voting solution that offers to deliver anything other than that.

Next is a lesson that applies to more than just elections, which is that just adding tech does not magically make everything better. Often, and as this situation illustrates, it can instead make things worse. Which is not to say that there is no room for technological innovation at all. The world would not be a better place if it were artificially locked into a 20th, or even 19th, century technological environment. Certainly there is a role for technology to play, and for technology innovation. However, not all new technology is necessarily an improvement over what came before. Sometimes what we already had was perfectly fine, or at least good enough for what we needed. And even if a new innovation might someday be better, it won't necessarily be right away. In the case of the Iowa caucus, it appears they replaced the traditional tried-and-true telephonic support for reporting results with a brand new cell phone driven app, and it is not apparent why. True, sometimes older systems can have their own quirks and imperfections and things we might want to be better, and it's not a bad thing to want to improve them. But where systems have at least been proven and reliable, any innovation needs to at least be able to deliver that same degree of trustworthiness before it can be considered a replacement, much less an improvement. No technology is magic; no innovation will suddenly solve all of our problems. Even the technology that is now regarded as proven and reliable was once new and untested itself. It takes a lot of time and a lot of work to get a technology to a point where we can depend on it for our most important functions, like elections. Expecting any new technology to immediately be able to be an adequate substitute for what came before, let alone an improvement, is therefore a mistake.

Next, paper matters. Again, the most important thing we need any electoral system to deliver is accuracy. Having a paper record helps deliver it. First, it affords redundancy. Even if our digital systems were perfect and bug-free, it would still be a good idea to have a back-up analog record. But especially while our digital technology is still evolving so rapidly and is still so decidedly NOT bug-free, it is critical to have a way to validate the results it gives us. Even when we think technology is working properly we still need to be able to audit it to make sure it is, and paper lets us do that. And then in those instances, like this one, when the technology has come up short, as it is still very much prone to do, paper means that we can still get what we need: accurate results of how people voted.

There is also one more critical lesson for now, and it's one mentioned above: something will always go wrong, and so, by anticipating that something will go wrong, we can make it ok when it does. The more complex the system, the more likely something will go wrong. But on the other hand, a system complex enough to have problems is also complex enough to contain solutions.

Elections are complex systems, so there are plenty of opportunities for hiccups. Which is not to say that we want hiccups; naturally we should try to minimize them. The issue though is that no matter how much you try to eliminate them, hiccups will still happen, so what we need to do is be ready. And that means at least two things: one, that we design our systems to have the resiliency needed to overcome those hiccups. For instance, in the case of Iowa, the results could not be transmitted to a central accounting system via the app, and that was a problem. But because there was a paper record they will be able to overcome the problem.

And it means something else, which goes back to the first point made in this post: don't panic. Don't rush to throw away faith in our electoral systems when things go wrong, because it is almost a near certainty that something will go wrong. But just because something has gone wrong does not mean it's the end of the world. Yet if, instead of allowing our systems to self-correct, we instead jump immediately to panic, we create a new problem. The reason we need accurate election results is because we need to be able to believe in them. It won't matter how accurate they are though if we simply refuse to.

When things go wrong, as they are wont to, we need to take a deep breath and give them a chance to right themselves, which is what will happen in Iowa since they have paper records. Furthermore, as the saying goes, never attribute to malfeasance what can be more readily explained by incompetence. What happened in Iowa was the result of a poor deployment of a technological solution. It was not a conspiracy. It was not the Russians. It was plain old human error to have so heavily depended on this untested mobile app system. And the good news is that we can deal with these sorts of bad decisions. Sure, there are plenty of things we can and should do to minimize these sorts of problems and improve our electoral systems, like better fund and train local election authorities, end reliance on unproven new technologies for supporting elections, ensure we always have paper records, reinforce the franchise, and so on. But there's no point in attacking our own democracy with distrust. Especially when it is so likely so misplaced.

Filed Under: apps, caucuses, data, election security, elections, iowa, voting, voting security