Manhattan DA Cy Vance Says The Only Solution To Device Encryption Is Federally-Mandated Backdoors

from the picking-up-the-torch-the-FBI-accidentally-dropped dept

Because no one has passed legislation (federal or state) mandating encryption backdoors, Manhattan DA Cy Vance has to publish another anti-encryption report. An annual tradition dating back to 2014 -- the year Apple announced default encryption for devices -- the DA's "Smartphone Encryption and Public Safety" report [PDF] is full of the same old arguments about "lawful access" and evidence-free assertions about criminals winning the tech arms race. (h/t Riana Pfefferkorn)

You'd think there would be some scaling back on the alarmism, what with the FBI finally admitting its locked device count had been the victim of software-based hyperinflation. (Five months later, we're still waiting for the FBI to update its number of locked devices.) But there isn't. Vance still presents encryption as an insurmountable problem, using mainly Apple's multiple patches of security holes cops also found useful as the leading indicator.

The report is a little shorter this year but it does contain just enough stuff to be persuasive to those easily-persuaded by emotional appeals. Vance runs through a short list of awful crime solved by device access (child porn, assault) and another list of crimes unsolved (molestation, murder) designed to make people's hearts do all their thinking. While it's certainly true some horrible criminal acts will directly implicate device encryption, the fact of the matter is a majority of the locked phone-centric criminal acts are the type that won't make headlines or motivate lawmakers.

More than a third of these cases involve minor crimes like theft and check kiting. Another 20% is comprised of "sex crimes," which encompasses prostitution -- a crime where law enforcement sometimes chooses to believe the device itself is an "instrument of crime," never mind what other evidence might be hidden inside it.

So, more than half the crime involving locked phones isn't the sort of stuff that suggests encryption backdoors are the key to making New York City a safer place to reside. The stuff Vance throws in about unlocked devices producing exonerating evidence is a dodge. It's meant to show how granting law enforcement carte blanche access would be a net benefit for the public. But the examples given use stuff like cell site location info and social media app data -- things that could be obtained from third parties without having to go through the locked phone.

Then there's the other part of this argument Vance leaves completely undiscussed: if someone's phone contains exonerating evidence, it's very likely they'll provide officers with this evidence voluntarily, either by unlocking the device or handing over the relevant info/files. Using the very small percentage of cases where exonerating evidence may be recovered from locked phones as an argument for mandated backdoors is incredibly disingenuous.

And that's all this "report" is: a petition for federally-legislated encryption backdoors.

III. Federal Legislation Remains the Only Answer

[...]

For the reasons advanced in each of our prior Reports, national legislation of the sort we have proposed remains the most rational and least intrusive means to require device manufacturers to comply with lawful court orders in serious criminal cases upon a finding of probable cause.

"Most rational and least intrusive." I guess creating new security holes in millions of personal devices isn't "intrusive." And if this wasn't enough of a laugher, Vance ends his report with this sentence:

[O]ur Office stands willing to assist Congress and all relevant stakeholders in the effort to find a more rational balance among the interests of device makers, consumers and law enforcement in the regulation of smartphone encryption.

When your conclusion is that the only solution is federally-mandated encryption backdoors, you cannot honestly assert you're seeking to "balance" the interests of everyone involved. The only interest served by mandated backdoors is law enforcement's. Portraying device encryption as a threat to public safety is intellectually dishonest. Vance's own numbers undercut his threat level claims and his repeated failure to even generate serious discussion among federal legislators shows it's probably time for the Manhattan DA to retire his annual alarmism.

Filed Under: backdoors, cy vance, encryption, going dark, law enforcement, moral panic, privacy, security

Motel 6 Agrees To Pay $7.6 Million Settlement For Sending Guest Lists To ICE

from the come-for-the-limited-amenities!-stay-for-the-unprovoked-roustings! dept

Motel 6 franchise owners suddenly decided it was their job to play part-time cop/immigration officer and use their paying customers as grist for the laughably-named criminal justice system. One branch began faxing guest lists to the local PD without any prompting from the recipient agency. Another decided anyone who didn't look American (guess what that means) should be reported to ICE.

This drew the attention of the internet. It also drew the attention of the Washington state attorney general. Finally, it drew the attention of the federal court system, but not for the reasons these self-appointed posse members expected. The chain was hit with a class action lawsuit alleging privacy violations related to the unprompted reporting of Hispanic guests to ICE.

This is going to cost the motel chain some of its light money, as Reuters reports.

Motel 6 will pay up to $7.6 million to Hispanic guests to settle a proposed class-action lawsuit claiming that it violated their privacy by regularly providing guest lists to U.S. Immigration and Customs Enforcement (ICE) agents.

The chain (of course) admitted no liability nor agreed that it had engaged in unconstitutional activities. Instead, it mumbled something about "recognizing the seriousness of the situation" and that it would, at some point in the near future, respect the privacy of its guests.

The respect will be mandatory if the full settlement is approved by the court.

Motel 6 also agreed to a two-year consent decree barring it from sharing guest data with immigration authorities absent warrants, subpoenas, or threats of serious crime or harm.

I guess the feeling must be that two years of not screwing paying customers out of their privacy will result in the creation of good habits. That seems unlikely to have a permanent effect, so it would have been nice to see this consent decree govern the chain's behavior in perpetuity, but you take what you can get.

This isn't necessarily Motel 6's fault -- at least not at the corporate level. There's no indication the chain's owner, G6 Hospitality, ever instructed franchise operators to engage in these activities. These appear to have been initiatives specific to some Motel 6 locations in Arizona. They were uncovered by the Phoenix New Times's examination of court records and confirmed by Motel 6 employees who said they "just pushed a button" to send guest lists to ICE.

These freelance ICE operative have screwed the Constitutional pooch so badly their parent company will be paying out the equivalent of ~110,000 overnight stays. Whatever discomfort they caused their guests will hopefully pale in comparison to the heat they're feeling now.

The proposed order [PDF] is embedded below.

Filed Under: 4th amendment, guest lists, ice, motels, privacy
Companies: motel 6

Marsha Blackburn Continues To Be Rewarded For Screwing Up The Internet

from the rooting-against-your-self-interests dept

You'd be hard pressed to find a bigger telecom sector crony than Tennessee Representative Marsha Blackburn. Blackburn has long made headlines for her support of SOPA, attacks on consumer protections like net neutrality and the FCC's broadband privacy rules. She's also come out in favor of turning ISPs into censors, and has been first in line to support giant ISP-backed protectionist state laws hampering competition. AT&T is routinely one of Blackburn's top donors, and her home state of Tennessee remains one of the least connected states in the nation as a direct result.

Even in our current hyper-tribalistic, post-truth reality, you'd have a hard time arguing that Blackburn has been anything but terrible for the health of the internet and consumer rights. Yet somehow, Blackburn just keeps getting rewarded for giving consumers the tech policy equivalent of a giant middle finger.

Shortly after her attacks on net neutrality (Blackburn absolutely adores the idea of letting the biggest companies buy an unfair market advantage from ISPs) Blackburn was promoted to head the Communications and Technology subcommittee. And this week, Blackburn successfully jumped from the House to the Senate, beating challenger and former Tennessee Governor Phil Bredesen to nab the Senate seat vacated by departing Tennessee Senator Bob Corker. Her win was, unsurprisingly, heralded as a big win for the public welfare by the state's political apparatus:

"Marsha Blackburn demonstrated the type of conservative leadership Tennessee voters want in Washington,” National Republican Senatorial Committee Chairman Cory Gardner said in a statement Tuesday evening. “We want to congratulate Senator-elect Blackburn on a hard-fought victory and look forward to her working in the U.S. Senate to confirm conservative judges, push pro-growth reforms and advocate for policies that improve the lives of all Tennesseans."

It's another example where blind partisan fealty tends to trump common sense, resulting in people who can only see in red or blue cheerfully voting against their own best self interests in what winds up being little more than a self-immolating, facts-optional game of team sports. As we've noted constantly, issues like net neutrality really aren't partisan, since an overwhelming bipartisan majority of Americans support this and other basic checks on monopoly power. ISPs and lawmakers just like to frame such tech issues as partisan, as sowing division hinders consensus and helps stall meaningful change and reform.

Last minute efforts by Taylor Swift apparently didn't help convince Tennessee voters that Blackburn's not their ally. Neither did Consumer groups efforts to educate Tennessee voters about Blackburn's continued tendency to screw them; an effort that at one point involved crowdfunding billboards posted in Blackburn's home district:

With Blackburn how holding a more powerful position in the Senate, Tennessee voters (and the rest of us) can look forward to more of the same. Blackburn is always AT&T's first stop when the company wants to shovel some law its lobbyists wrote into the legislative bloodstream. That was made clear when Blackburn pushed both a fake net neutrality bill and a fake privacy bill, both with only one real goal: to prevent tougher state or federal laws from being passed. As giant ISPs continue their relentless assault on both competition and federal and state oversight, expect Blackburn to play an essential, starring role.

On the plus side, a freshly-reconstituted House filled with more net neutrality supporters should slow any telecom-industry efforts to pass wishlist legislation, while providing something vaguely resembling oversight for the Ajit Pai FCC. Still, it's incredible to watch politicians like Blackburn routinely sell out the majority of her constituents on tech policy, then watch those same constituents happily root against their own best self interests by giving her an endless series of promotions.

Filed Under: broadband, competition, marsha blackburn, net neutrality, privacy, tennessee
Companies: at&t

Senator Wyden Releases Draft Of Privacy Rules That Silicon Valley Probably Won't Like Very Much

from the but-will-it-help? dept

As I've pointed out repeatedly, we're really really bad at regulating "privacy" in large part because most people don't understand privacy -- and it means different things to different people. And, so far, most attempts at regulating privacy have created massive negative consequences, while doing very little to actually protect privacy. The ones most making the news are the GDPR in the EU (though reaching well outside of the EU), which is a total mess and California's unmitigated disaster of a privacy bill that was passed in an insane rush to stop an even worse privacy law from being on the ballot. And, of course, all of this comes against the backdrop of various companies doing a horrifically bad job of protecting the public's private information.

Given all of that, it is inevitable that Congress will, at some point, attempt to pass some sort of privacy bill. And, it seems likely that it will be a disaster. In the last year or so, Senator Ron Wyden, who historically has been seen (unfairly and inaccurately) as an "ally" of Silicon Valley companies is now the first to throw his hat into the ring, releasing a discussion draft of the bill (you can also see a one pager about the bill and a section by section breakdown -- all also embedded below).

Above, I mentioned that it's been unfair to argue that Wyden was a booster of Silicon Valley companies. If you look at his history, he has always been focused mainly on being an ally of the users of the internet. Many times, those two things align, but when they do not, Wyden has repeatedly taken the side of the users, not the companies. And that is the case here, for the most part. Over the last year, Wyden has been on a bit of a rampage in basically telling the companies that they've had decades to do the right thing in regards to protecting their own users, and they have failed to do so.

Reading the new bill in that context puts things into perspective. The key parts of the bill, as described in the one-pager are as follows:

1. Establish minimum privacy and cybersecurity standards.
2. Issue steep fines (up to 4% of annual revenue), on the first offense for companies and 10-20 year criminal penalties for senior executives.
3. Create a national Do Not Track system that lets consumers stop third-party companies from tracking them on the web by sharing data, selling data, or targeting advertisements based on their personal information. It permits companies to charge consumers who want to use their products and services, but don’t want their information monetized.
4. Give consumers a way to review what personal information a company has about them, learn with whom it has been shared or sold, and to challenge inaccuracies in it.
5. Hire 175 more staff to police the largely unregulated market for private data.
6. Require companies to assess the algorithms that process consumer data to examine their impact on accuracy, fairness, bias, discrimination, privacy, and security.

A lot of the bill is really in giving the FTC more resources and power to go after companies for failing to protect the privacy of users. And, I think putting some level of pressure on companies to take these issues more seriously could really help.

I think there's a lot in the bill that is carefully thought out and worthwhile, but I still have a number of significant concerns. The headlines around this bill have focused on the fact that it includes potential jail time of 10 to 20 years for senior execs who sign off on annual "data protection reports" to the FTC, in which those reports "knowingly" misrepresent information (it also includes GDPR-esque fines of 4% of gross revenue, even for first time offenders). I do think there's value in creating real punishment for company execs that knowingly misrepresent information concerning the privacy of their users, but I do worry how much this might impact the willingness of good people -- especially potential chief privacy and chief information security officers -- to agree to take these jobs with large companies. While the "knowingly" part of the requirement is important, I can envision quite intense legal battles over the level of knowledge such execs had in signing off on these documents. Yes, this would get them to take those issues seriously and go over such documents carefully. But, I do worry that this could scare off many good people from taking these jobs.

Similarly, the fact that these massive fines apply to the very first offense could be seen as problematic as well. It's great to say that even one mistake is one too many, but is that realistic? It is not easy to seal off every possible vector of attack. There are always new attacks. And, as it stands right now, there are only a few companies who have the resources and ability to really harden their systems to this level -- and this bill could lock in those providers and leave out the ability of smaller companies to challenge them in the market (there is a limited safe harbor for smaller companies, but as soon as a company reaches a reasonable size, the rules apply to them).

I also do wonder about the "minimum privacy and cybersecurity standards" that the FTC will be authorized to detail. Again, on its face, this sounds like an okay idea, but there are a lot of devils in those details. Too often "standards" like this, if not properly constructed, could limit potential innovations or business models that wouldn't actually negatively impact people's privacy, but won't be allowed out of a fear for violating these standards.

While I am supportive of bringing back the concept of a Do Not Track system, I find the requirement for companies to "offer a paid version of their product or service, for which they can charge no more than they would have made by sharing the user's data" potentially a complete mess (the bill has a lot of conditions on this that might limit the problems, but it's not clear why this is necessary in the bill). Again, that's something that sounds nice in theory, but would require a pretty big shift for many companies -- which would mean a lot of new costs that it's unclear they can even attempt to recoup. It also has the potential of cutting off a number of new business models, as there are potential businesses where such a setup wouldn't even make any sense. Again, conceptually, this idea could make sense for companies, but requiring it could have significant consequences.

A final major concern: it does not appear that this bill would pre-empt state efforts, like California's giant mess of a privacy bill (and any other attempts by other states). That also seems like something any federal bill should include to avoid a patchwork of impossible to follow laws in every single state.

That's not to say there aren't parts of the bill that are worthwhile -- and the intent behind it is well meaning. Companies do need to clean up their act and recognize what a mess they've caused. I do like the idea of standardizing APIs to allow users to use other apps to access and process the information and data that companies hold on them. That could be tremendously useful in moving to a world where individuals can take back more control over their data. I also appreciate the specific point that the rules do not apply to media organizations, as we've already been dealing with the fallout from the GDPR where people are claiming the data protection rules there can prevent media organizations from even reporting on certain people.

But, in the end, I'd prefer that be done more by the companies themselves in recognizing that they're better off pushing control of the data out to the end users, rather than feeling the need to hoard it all themselves. I recognize that Wyden's view on this is basically "they had their chance, and they failed" and perhaps that's true. But I still worry about the unintended consequences from locking in some of these ideas.

At this point, the bill is still a "discussion draft" and it's not at all clear if it has any chance of moving forward. Hopefully, if it does, there can be significant changes made to the bill so that it is still designed to punish truly bad behavior (and incentive good behavior), but without making it difficult to impossible for good people to hold key positions, and without cutting off potentially useful innovations for end users. At this point, I'm not sure this bill does so, even if it's well-intentioned.

Filed Under: apis, cdpa, consumer data protection act, cybersecurity, data protection, ftc, privacy, ron wyden, transparency

Last Chance To Opt Out Of #MyHealthRecord, Australians!

from the deadline-is-november-15 dept

Australia's controversial and clumsy rollout of its "My Health Record" program this summer didn't cause the "spill" -- what Australians call an abrupt turnover of party leadership in Parliament — that gave the country a new Prime Minister in August. But it didn't improve public trust in the government either. The program — which aims to create a massive nationally administered database of more or less every Australian's health care records — will pose massive privacy and security risks for the citizens it covers, with less-than-obvious benefits for patients, the medical establishment, and the government.

Citizen participation in the new program isn't quite mandatory, but it's nearly so, thanks to the government's recent shift of the program from purely voluntary to "opt-out." Months before the planned rollout, which began June 16, at least one poll suggested that a sizable minority of Australians don't want the government to keep their health information in a centralized health-records database.

In response to ongoing concern about the privacy impact of the program (check out #MyHealthRecord on Facebook and Twitter), the new government is pushing for legislative changes aimed at addressing the growing public criticism of the program. But many privacy advocates and health-policy experts say the proposed fixes, while representing some improvements on particular privacy issues, don't address the fundamental problem. Specifically, the My Health Record program, which originally was designed as a voluntary program, is becoming an all-but-mandatory health-record database for Australian citizens, held (and potentially exploited) by the government.

Australia's shifting of its electronic-health-records program to "opt-out" — which means citizens are automatically included in the program unless they take advantage of a short-term "window" to halt automatic creation of their government-held health records — is a textbook example of how to further undermine trust in a government that already has trust issues when it comes to privacy. Every government that imposes record-keeping requirements that impact citizen privacy should view Australia's abrupt shift to "opt-out" health-care records as an example of What Not To Do.

And yet: supporters of My Health Record have persisted in their commitment to "opt out" during the shift from Malcolm Turnbull's administration to that of his successor, Scott Morrison. This means that if an Australian doesn't invest time and energy into invoking her right not to be included in the database — within the less-than-one-month window that citizens currently have to make this choice — she will be included by default.

In other words, any citizen's health-care records in the program will be held by the government permanently throughout that citizen's and will persist for 30 years after that citizen's death. Even if an Australian chose later to opt out of the program, the record might still (theoretically) accessible to health-care providers and government officials. Health Minister Greg Hunt introduced legislation last summer that would address some of these complaints about the program, but it's unclear whether the Australian Parliament, which has weathered several leadership shifts over the past decade, has the focus or will to implement the changes.

The fact is, the automatic creation of your My Health Record could still result in a permanent health-care record that's outside of any individual Australian's control because the government can always repeal any law or regulation requiring deletion or limiting access. In effect, "My Health Record" is a misnomer: a more accurate name for the program would be "The Government's Health Records About You."

A great deal of Australian media coverage of the rollout has been critical of the Turnbull government's -– and later the Morrison government's -- "full steam ahead" approach. The pushback against My Health Record has been immense. Worse, citizens who have rushed to opt out of the program have found the system less than easy to navigate — whether on the Web or through a government call center. The flood of Australians who attempted to opt out of the program on the first day they were allowed to do so, found that they were unwitting beta testers, stress-testing the opt-out system. After the first-day opt-out numbers, the government has either declined or been unable to disclose how many Australians are opting out. But a Sydney Morning Herald report in July said the number of opt-outs might "run into the millions."

In kind of a weird mirror-universe adventure, Australia has managed to reproduce the same kind of public concern that sank a similar health-care effort in the United Kingdom just a few years ago. Phil Booth of the UK's Medconfidential privacy-advocacy group told the Guardian that "[t]he parallels are incredible" and that "this system seems to be the 2018 replica of the 2014 care.data." After a government-appointed commission underscored privacy and security concerns, the UK's "care.data" program was abandoned in 2016. Unfortunately for Australians, in the Australian version of the UK's "care.data" scheme, Spock has a beard.

The UK's experience suggests that the policy problem signaled by the opposition to the My Health Record initiative is bigger than Australia. That shouldn't be a surprise. After all, a developed country may provide a "universal health care" program like the United Kingdom's National Health Service, or a more "mixed" system (a public health care program supplemented by private insurers like that of Australia) or even an insurance-centric public-health program like Obamacare. But whatever the system, the appeal of "big data" approaches to create efficiencies in health care is broad, in the abstract.

But despite the theoretical appeal of #MyHealthRecord there's a paucity of actual economic research that shows that centralized health-care databases will actually provide benefits that recoup the costs of investment. (Australia's program has been estimated to cost more than $2 billion AUD so far, and it's not yet fully implemented.) No one, in or out of government, has made a business case for My Health Record that uses actual numbers. Instead, the chief argument in favor MHR is that it will enable health-care providers to share patient data more easily — which supposedly will save money — but health-care workers, much as they hate the paperwork associated with it, mostly know that there's no substitute for taking a fresh patient history at the point of intake.

The push for a national database of personal health information has been a fairly recent development, even though the country's current health-care system has been in place in more or less its current form since 1984. The Australian Department of Health announced in 2010 that the government would be spending nearly half a billion Australian dollars to build a system of what then were called Personally Controlled Electronic Health Records. The primary idea was to make it more efficient to share critical patient information among health-care providers treating the same person.

Another purported benefit would be standardization. Like the United States (where proposals to for a national health-records system have sometimes been promoted) Australia is a federal system of states and territories, each of which has its own government. The concern was that a failure to set national standards for digital health records would lead to the states and territories developing their own, possibly mutually incompatible systems. The distance among the states and territories (mostly on the coasts surrounding Australia's dry, unpopulated Outback) makes integration harder because of the distances separating different pockets of its population (now 25 million).

The 2010 announcement of the Personally Controlled Electronic Health Records program stated expressly "[a] personally controlled electronic health record will not be mandatory to receive health care." The basic model was opt-in — starting in 2012, Australians had to actively choose to create their shared digital health records. If you didn't register for the program, however, you didn't create a PCEHR. If you did register, you had the assurance that, under the government-promulgated Australian Privacy Principles, your personal health information would be strongly protected.

In practice, the PCEHR program, eventually rebranded as My Health Record, has never had much appeal to most citizens. The government burned somewhere near or past $2 billion AUD and yet, years into the program, the total number of citizens who had volunteered to "opt in" to have their health records shared and available in the program was only about 6 million. According to a March report in Australia's medical-news journal, the Medical Republic, Australia's physicians also seem to be less than sold on the value in the program either.

Prior to the latest push for a shift to "opt-out," only a few citizens saw much benefit (much less any fun or personal return) of investing the time it takes to master producing a complete and useful health record, and even those who did only rarely ended up using its key features. (Some health-fashion-forward citizens who do want to share their health-care records easily have opted to invest in more private solutions rather than rely on a centralized database that may be less controllable and less complete.)

By 2014 it was clear that the Australian government (control of which had shifted to the more conservative of the two major parties) wanted to move in closer-to-mandatory direction. It did so by announcing a wholesale conversion of the My Health Record database from opt-in to opt-out. This meant that, if you were an Australian citizen, a health record would be created automatically for you—unless you explicitly said you didn't want one. But the possibility of opting out hasn't quelled these ongoing complaints from the general public:

1. The still-too-short, too-limited opt-out window. Australians were originally given a three-month window, starting July 16, to opt out of My Health Record. (It was later extended to November 15. Of course, critics regard the one-month extension as something less than stellar.) If you don't opt out in the approved window, an electronic health record will be created for you. By default, program provides that the government will keep the record for 30 years after your death. And the government will have the right to access the record—whether you've died or not— "for maintenance, audit and other purposes required or authorised[sic] by law."
2. This goes on your permanent record. The law already authorizes a lot of government access (for law-enforcement agencies, court proceedings, and other non-health-related purposes). And of course the laws can be amended to authorize even more access. Were you ever treated for alcohol poisoning? Did you ever have an abortion? You may be able to limit access somewhat by tweaking the privacy controls of "My Health Record," but (unless you take strong, affirmative steps otherwise) it's never erased. And it may be demanded by a range of government authorities for all sorts of reasons under current or future laws or regulations.
3. The disputed warrant requirement. The Australian Digital Health Agency, the relatively new government agency in charge of the program, said a warrant would be required—but that claim was contradicted by Australia's Parliamentary Library, whose analysis found that access by non-health government agencies with few if any procedural or privacy safeguards. Disturbingly, the Parliamentary Library's report was abruptly removed and revised after pushback from the Turnbull government. (The removed report has been reproduced here.) A subsequent Senate inquiry—with a report issued October 12—shows growing consensus behind adding a warrant requirement before law enforcement gets health record access, but the Australian Labor Party and the Australian Greens have dissented on the question of whether a warrant requirement fixes the problems: Per the Greens, the warrant requirement is "an improvement on the status quo, but it is an insufficient and disappointing one."
And none of these criticisms even touch on the significance that a centralized health-care record database will give 900,000 health-care workers (not just doctors) comparatively unrestricted, untracked access to patient health records. By comparison, the average Australian under the pre-My Health Care system likely had to worry only about dozens of people having access to her health records — not hundreds of thousands.

Then-Prime Minister Malcolm Turnbull was dismissive of privacy concerns early on arguing that "there have been no privacy complaints or breaches with My Health Record in six years and there are over 6 million people with My Health Records." But many prominent health-care and privacy experts argue that the government's new promises to patch the system are inadequate. For example, requiring government agencies to get a warrant does nothing to protect patients from unauthorized access to their records by health-care workers with access to the My Health Record system. And the Labor members have argued that the new system needs a statutory provision that prevents health-care insurers from accessing My Health Record's data.

Typical of the external critics is former Australian Medical Association President Kerryn Phelps, who views the promises as "minor concessions" that are "woefully inadequate." Phelps, who cites a survey showing that 75 percent of doctors are themselves planning to opt out, called for "full parliamentary review" of the My Health Record program. Other critics have argued the government has painted itself into a corner due to the "sunk costs" of $2 billion AUD. Bernard Robertson-Dunn of the Australian Privacy Foundation argues that the whole problem, despite the fact that the government has spent those billions, is that Australia needs to reboot its digital-health initiative entirely.

But many of the critics of My Health Record in Parliament seem to be maneuvering to lessen the privacy harms likely to ensure from the shift to near-mandatory participation in My Health Record. In this, they may be driven by the fear that writing off the Australian health-care-records program may look too much like the abject failure that was the UK's "care.data" program. But Robertson-Dunn views the unwillingness of some members or Parliament to cut their losses as short-sighted, given the likely long-term harms the system poses to citizens' health privacy. Better to scrap My Health Record and write off the costs so far, he argues. Once that's done, he says, Australia can "[s]tart with a problem patients and doctors have and go from there."

Mike Godwin (mnemonic@gmail.com) is a distinguished senior fellow at R Street Institute.

Filed Under: australia, health records, my health record, privacy

TSA Announces Plans To Subject Domestic Travelers To Biometric Screening

from the to-secure-its-'position-as-a-global-leader-in-aviation-security'-hahahah dept

As promised/threatened, the DHS is moving forward with expanded use of biometric scanning at airports, including facial recognition and fingerprint matches. What was touted as a way to combat international terrorism and illegal immigration will now include those on the home front, as the tech spreads to include US citizens on domestic flights. But the TSA doesn't see this as an unwanted incursion into the lives of innocent citizens. Instead, it pitches it as a useful tool to speed up security screening at TSA checkpoints.

TSA says that by moving toward facial recognition technology in a time where travel volume is rising, it’s hoping to reduce the need for physical documents like passports and paper tickets. Currently, TSA manually compares the passengers in front of them to their ID photos, but it believes an automated process that can match facial images to photos from passports and visa applications will be more accurate and efficient.

The TSA expects paying customers to foot the bill for the expansion -- the same citizens it's been selling civil liberties back to for years. From the TSA's "roadmap" for expanded biometric screening:

Currently, TSA and airline partners verify traveler identity primarily by processing biographic data and inspecting physical identity and travel documents. The use of biometric technology will simplify the passenger experience and increase efficiency and security effectiveness.

The roadmap focuses on four main goals: 1) partnering with U.S. Customs and Border Protection (CBP) on biometrics for international travelers; 2) using biometrics provided by TSA Pre✓® members to enhance the travel experience; 3) expanding biometrics to additional domestic travelers; and 4) developing the infrastructure for biometric technology. TSA is already carrying out these objectives through smart investments and collaborative partnerships.

Yes, the paying members of the TSA's Pre✓ program will be the first to "enhance" their "travel experience" by feeding their faces into a database the TSA controls, using tech prone to erroneous conclusions. Other travelers won't be able to opt out of biometric screening, however. They'll just be subject to the non-enhanced travel experience where TSA and CBP officers ask a long series of invasive questions and infer suspicious behavior on the part of travelers who bypass the biometric kiosks.

It's true that traveling in the US has always been a "papers, please" experience. But prior to the 9/11 attacks, this simply meant presenting a ticket before boarding. Now, it's everything about everybody, no matter how useless this information is 99.9% of the time. Rather than move towards smarter screening methods, the TSA has decided to subject everyone to the same level of screening with the same arbitrary rules stemming from airborne attacks the TSA failed to prevent.

The TSA pitches this as a paperless airport, but it's really just another way for the government to compile a massive database of identifying info and of citizens' movements. The DHS likes to talk about its 96% accuracy target, but has released no information about actual accuracy in test runs, so concerns about false positives/negatives aren't going away anytime soon.

The government has responded in the worst way to terrorist attacks in the US. It has made freedom of movement a hassle -- one that diminishes Constitutional protections and turns every traveler into a potential suspect.

Filed Under: biometrics, privacy, screening, security theater, tsa

Vizio Customers Get A Pittance In Settlement Over Snooping Televisions

from the watching-you,-watching-me dept

As we frequently note, most of the "smart" products you buy are anything but intelligent when it comes to your privacy and security. Whether it's your refrigerator leaking your gmail credentials or your new webcam being hacked in mere minutes for use in massive new DDoS attacks, the so-called "smart" home is actually often dumb as nails and potentially hazardous. So-called smart-televisions have been particularly problematic, whether that has involved companies failing to encrypt sensitive data, or removing features if you refuse to have your daily viewing habits measured and monetized.

Last year Vizio joined this not-so-distinguished club when it was discovered that the company's TVs had been spying on users for the last several years, starting back in 2014. Vizio's $2.2 million settlement with the FTC indicates that the company at no time thought it might be a good idea to inform customers this was happening. The snooping was part of a supposed "Smart Interactivity" feature deployed in 2014 that claimed to provide users with programming recommendations, but never actually did so. Its sole purpose was to hoover up your data and help Vizio sell it, without your express consent.

Vizio was also hit with a class action lawsuit over its actions, and the finishing touches on a settlement are just getting hashed out now. Lawyers representing consumers in the case state Vizio secretly tracked and sold the usage habits of around sixteen million Vizio owners for around three years. They're demanding a settlement of $17 million and a promise from Vizio that this won't ever happen again:

"Under the terms of the proposed settlement, Vizio will establish a $17 million settlement fund that will deliver money directly to consumers who bought Vizio Smart TVs that were subsequently connected to the Internet between February 1, 2014 and February 6, 2017. Vizio has also stopped tracking what is displayed on its Smart TVs unless a consumer consents to this tracking after receiving a prominent notification. And Vizio will delete the remaining contested viewing data in its possession."

What this actually means for consumers is a bit less impressive. Ars Technica took a closer look at the court filings in the case and found that consumers are likely to get all of somewhere between $13 and $31 for the inconvenience of being spied on without their permission. Lawyers will, unsurprisingly, get significantly more:

"When it’s all said and done, new court filings submitted on Thursday say each of those 16 million people will get a payout of somewhere between $13 and $31. By contrast, their lawyers will collectively earn a maximum payout of $5.6 million in fees."

On the plus side, insiders tell Ars Technica that the $17 million being doled out is more than Vizio made from selling this data, which usually isn't the case in other similar failures of trust (especially by cellular carriers, who'll often be fined millions for privacy violations that potentially netted them billions). And while Vizio's promises are good and all, many argue we need stronger public deterrents for companies that fail to respect user privacy, starting first and foremost with efforts to include privacy and security oversights in product reviews.

Filed Under: class action, privacy, smart tv, surveillance
Companies: vizio

NY Legislators Introduce Bill That Would Seriously Curb Law Enforcement's Surveillance Collections

from the take-what-you-want-but-only-keep-what-you-need dept

A bipartisan group of New York assembly members has introduced a bill that doesn't appear to have much of a chance at becoming an actual law. But what a bill it is. If it does receive the governor's signature, it would drastically revamp how the NYPD (and other agencies) handle the massive amount of video and data they collect daily.

A bill introduced in the New York Assembly would prohibit the state from creating any database containing aggregate surveillance data including ALPR, audio, video and facial recognition records. Passage would not only protect privacy in New York; it would also put major roadblocks in front of federal surveillance programs.

Assm.Tom Abinanti (D-Greenburgh/Mt. Pleasant), along with a bipartisan coalition of six assembly members, introduced Assembly Bill 11332 (A11332) on Sept. 19. The proposed law would bar state agencies and departments, and contractors engaged in business with the state, from using any database as a repository of, a storage system for, or a means of sharing facial recognition functionality. I would also prohibit the creation of any permanent repository or storage system for aggregate license plate reader data records, aggregate audio surveillance recordings, aggregate video surveillance images, or aggregate driver license photographs.

In effect, A11332 would prohibit the creation of any comprehensive database storing surveillance data.

It's an anti-haystack bill. And law enforcement loves its haystacks. The NYPD -- believing itself to be a globetrotting intelligence agency -- loves them more than most. Law enforcement agencies have obtained massive boosts in collection power over the years, thanks to omnipresent surveillance cameras, automatic license plate readers, and cheap digital storage. Biometric data has recently been added to the mix, promising to turn dumb cameras into suspect-spotting field agents.

The tech has advanced ahead of best practices or privacy impact assessments. The new hardware is presumed legal until proven otherwise and is often obtained and deployed with minimal oversight and zero public input.

This bill doesn't outlaw the continued hoovering of data points/camera footage but it does ensure the massive amount collected will have to be quickly sorted into hay and needles by restricting stored collections to stuff pertinent to ongoing investigations.

The immediate local impact would be immense. But expect the feds to start inserting themselves into local legislating. This bill would make it impossible for federal agencies to accomplish their dream of connected, nationwide databases of license plate photos and biometric data.

Because the federal government relies heavily on partnerships and information sharing with state and local law enforcement agencies, passage of A11332 would hinder the creation of federal surveillance databases. Information that is never retained by the state cannot be shared with the feds.

If the bill passes unamended, law enforcement may be able to retain more than it should by making broad claims about everything in its collections being somehow relevant to investigations. If these legislators are serious about making this law do what it says it does, they will need to tack on some reporting requirements that will force agencies to go on the record about their data retention practices.

While it's true law enforcement agencies can't possibly know what data/footage will prove useful in future investigations, that shouldn't be used as an argument for retaining everything collected. Legitimate privacy concerns should not be subordinated to New York law enforcement's fear of missing out.

Filed Under: data, databases, new york, nypd, privacy, surveillance, video

As Everyone Knows, In The Age Of The Internet, Privacy Is Dead -- Which Is Awkward If You Are A Russian Spy

from the not-just-here-for-the-medieval-church-architecture dept

Judging by the headlines, there are Russian spies everywhere these days. Of course, Russia routinely denies everything, but its attempts at deflection are growing a little feeble. For example, the UK government identified two men it claimed were responsible for the novichok attack on the Skripals in Salisbury. It said they were agents from GRU, Russia's largest military intelligence agency, and one of several groups authorized to spy for the Russian government. The two men appeared later on Russian television, where they denied they were spies, and insisted they were just lovers of English medieval architecture who were in Salisbury to admire the cathedral's 123-meter spire.

More recently, Dutch military intelligence claimed that four officers from GRU had flown into the Netherlands in order to carry out an online attack on the headquarters of the international chemical weapons watchdog that was investigating the Salisbury poisoning. In this case, the Russian government didn't even bother insisting that the men were actually in town to look at Amsterdam's canals. That was probably wise, since a variety of information available online seems to confirm their links to GRU, as the Guardian explained:

One of the suspected agents, tipped as a "human intelligence source" by Dutch investigators, had registered five vehicles at a north-western Moscow address better known as the Aquarium, the GRU finishing school for military attaches and elite spies. According to online listings, which are not official but are publicly available to anyone on Google, he drove a Honda Civic, then moved on to an Alfa Romeo. In case the address did not tip investigators off, he also listed the base number of the Military-Diplomatic Academy.

…

One of the men, Aleksei Morenets, an alleged hacker, appeared to have set up a dating profile.

Another played for an amateur Moscow football team "known as the security services team" a current player told the Moscow Times. "Almost everyone works for an intelligence agency." The team rosters are publicly available.

The "open source intelligence" group Bellingcat came up with even more astonishing details when they started digging online. Bellingcat found one of the four Russians named by the Dutch authorities in Russia's vehicle ownership database. The car was registered to Komsomolsky Prospekt 20, which happens to be the address of military unit 26165, described by Dutch and US law enforcement agencies as GRU's digital warfare department. By searching the database for other vehicles registered at the same address, Bellingcat came up with a list of 305 individuals linked with the GRU division. The database entries included their full names and passport numbers, as well as mobile phone numbers in most cases. Bellingcat points out that if these are indeed GRU operatives, this discovery would be one of the largest breaches of personal data of an intelligence agency in recent years.

An interesting thread on Twitter by Alexander Gabuev, Senior Fellow and Chair of Russia in Asia-Pacific Program at Carnegie Moscow Center, explains why Bellingcat was able to find such sensitive information online. He says:

the Russian Traffic Authority is notoriously corrupt even by Russian standards, it's inexhaustible source of dark Russian humor. No surprise its database is very easy to buy in the black market since 1990s

In the 1990s, black market information was mostly of interest to specialists, hard to find, and had limited circulation. Today, even sensitive data almost inevitably ends up posted online somewhere, because everything digital has a tendency to end up online once it's available. It's then only a matter of time before groups like Bellingcat find it as they follow up their leads. Combine that with a wealth of information contained in social media posts or on Web sites, and spies have a problem keeping in the shadows. Techdirt has written many stories about how the privacy of ordinary people has been compromised by leaks of personal information that is later made available online. There's no doubt that can be embarrassing and inconvenient for those affected. But if it's any consolation, it's even worse when you are a Russian spy.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: gru, internet, open source intelligence, privacy, russia, russian spies