Unintended Consequences: How The GDPR Can Undermine Privacy

from the be-careful-what-you-wish-for dept

We've highlighted a few times now, just how problematic the GDPR is. This is not because we don't care about privacy -- we do very much. We just think that the GDPR's approach is not a very good one with a lot more downsides than upsides -- and, it's unlikely to do very much to actually protect your privacy. For example, we just wrote about the GDPR being used (successfully!) to try to erase a public court docket.

But not only do we think that the GDPR doesn't actually protect your privacy, it might actually put it at much greater risk. Take the story of Jean Yang, who noted that someone hacked her Spotify account and then, thanks to GDPR requirements, was able to download her entire Spotify history.

That's because, under the GDPR, platforms are supposed to make all of the data they have on you easily downloadable. The theory is that this will help you understand what a company has on you (and, potentially, to request certain data be deleted). But, it also means that should anyone else get access to your account, they could access an awful lot of important and/or personal data. Your Spotify interactions might not seem like that big of a deal, but plenty of other services could expose much more sensitive data (and, who knows, there are situations where your Spotify data might be quite sensitive as well).

As Jean notes in a later tweet, this kind of thing could really come back to bite other services, such as Lyft or Uber. She jokes: "Would be pretty bad to get hacked and kidnapped in the same day."

There are possible technological solutions that could help (again, as Jean suggests), such as using multi-factor authentication to access your own data (one-time passwords, Yubikey, etc), but it's telling that few companies (or regulators!) have really thought about that, because that vector of attack probably hasn't occurred to many people. But, it probably will now.

This is, of course, yet another good example of the unintended consequences of regulating technology, even with good intentions. Very little thought has been put into the second and third order effects. Instead, you have a bunch of policymakers who think "platforms collecting too much data is bad, thus, we have to let people check on their own data." It never occurs to them that this now creates a brand new route to accessing potentially valuable, sensitive and private data.

And, as an end result, a regulation designed to increase our privacy... could sometimes have the exact opposite effect.

Filed Under: breaches, data, data protection, gdpr, hacked accounts, privacy
Companies: spotify

Congress Fails To Include A Single Consumer Advocate In Upcoming Privacy Hearing

from the ill-communication dept

As the U.S. ponders what meaningful privacy protections should look like in the Comcast & Cambridge Analytica era, it should probably go without saying that consumers should be part of that conversation. Unsurprisingly, that hasn't really been the case so far. That was exemplified, in part, by the GOP's decision to neuter FCC broadband privacy rules much the same way they dismantled net neutrality: by ignoring any consumer-oriented input that didn't gel with their pre-existing beliefs: namely that all regulation is always bad and a nuanced conversation on the merits of each instance of regulation simply isn't necessary.

When a "conversation" does occur, it tends to be superficial at best, and consumers pretty consistently aren't invited to the table. Case in point: on September 26, the Senate Commerce Committee will be holding a hearing entitled "Examining Safeguards for Consumer Data Privacy." One of the motivating reasons for this hearing, at least according to Senator John Thune, was because "consumers deserve clear answers" on privacy:

"Consumers deserve clear answers and standards on data privacy protection,” said Thune. “This hearing will provide leading technology companies and internet service providers an opportunity to explain their approaches to privacy, how they plan to address new requirements from the European Union and California, and what Congress can do to promote clear privacy expectations without hurting innovation."

It's odd then, that not a single consumer or consumer advocacy group was invited to appear at said hearing, according to the EFF:

"...the Committee is seeking only the testimony of big tech and Internet access corporations: Amazon, Apple, AT&T, Charter Communications, Google, and Twitter. Some of these companies have spent heavily to oppose consumer privacy legislation and have never supported consumer privacy laws. They know policymakers are considering new privacy protections, and are likely to view this hearing as a chance to encourage Congress to adopt the weakest privacy protections possible—and eviscerate stronger state protections at the same time."

Regardless of whether you think new privacy rules are necessary, it goes without saying that consumers should have some voice in the process. Instead, Congress pretty clearly prefers a round table where companies that have spent the better part of the last decade trying to avoid meaningful privacy protections get to dictate the course and cadence of the conversation. AT&T thinks it's a good idea to charge consumers more to protect their own privacy. Google and Facebook, meanwhile, have been working in concert with the telecom sector to scuttle state-level efforts on privacy, no matter what they look like.

Like net neutrality, the Trump era attack on federal consumer protections (like the GOP's dismantling of modest FCC broadband privacy rules last year) has opened the door to numerous states rushing to fill the oversight vacuum. The end result, as we've seen in California, tends to be rushed bills that over-reach (as opposed to the FCC's broadband privacy rules, which took years to craft). All the while, the tech press adores tap dancing around the fact that this current administration and Congressional majority couldn't care less about meaningful consumer protections.

Yes, some of these state efforts are terrible. And yes, it would be easy for federal rules to be equally bad. Especially when the crafting process is largely being driven by cross-industry gamesmanship (the telecom industry, for example, has covertly undermined its alliance with Silicon Valley and is pushing for rules that screw over their video ad competitors like Google, but leave giant ISPs free to do as they wish). That said, it shouldn't be assumed that meaningful privacy protections are impossible, especially given the Congressional status quo shake up that may be just over the horizon.

Another truth the tech press enjoys tap dancing around is the fact that none of the companies invited to this round table want serious privacy rules impacting them, even if they're well-crafted. Informed, educated, empowered consumers are more likely to opt-out of data collection and monetization, and you'd be hard pressed to find any major company that's eager to lose billions as these consumers dodge being tracked and sold to.

Without consumer groups at the table, these are the kind of facts that tend to get lost in the shuffle, and the entire conversation tends to shift to why privacy rules kill innovation and aren't necessary, and not what real privacy consumer protections might look like. Again, because as it stands now, none of the folks at this hearing are actually interested in real rules that protect consumers. They're interested in either no rules at all, or flimsy federal rules that pre-empt more meaningful state-level protections. And many of the politicians at this hearing aren't interested in privacy at all, they're simply eager to hammer Silicon Valley over perceived, frequently hallucinated, partisan censhorship claims that have nothing to do with privacy.

Sure, maybe meaningful privacy protections are impossible, either due to government's failure to adapt to quickly changing markets, or outright corruption. But by omitting consumer groups from the conversation, it's being made abundantly clear that this isn't a serious effort one way or another, with the end result being more of an echo chamber than any meaningful policy discussion.

Filed Under: congress, consumer advocates, data, data protection, privacy, senate commerce committee

Software Patch Claimed To Allow Aadhaar's Security To Be Bypassed, Calling Into Question Biometric Database's Integrity

from the but-it's-ok,-we-already-blacklisted-the-50,000-rogue-operators-that-we-found dept

Earlier this year, we wrote about what seemed to be a fairly serious breach of security at the world's largest biometric database, India's Aadhaar. The Indian edition of Huffington Post now reports on what looks like an even more grave problem:

The authenticity of the data stored in India's controversial Aadhaar identity database, which contains the biometrics and personal information of over 1 billion Indians, has been compromised by a software patch that disables critical security features of the software used to enrol new Aadhaar users, a three month-long investigation by HuffPost India reveals.

According to the article, the patch can be bought for just Rs 2,500 (around $35). The easy-to-install software removes three critical security features of Aadhaar:

The patch lets a user bypass critical security features such as biometric authentication of enrolment operators to generate unauthorised Aadhaar numbers.

The patch disables the enrolment software's in-built GPS security feature (used to identify the physical location of every enrolment centre), which means anyone anywhere in the world -- say, Beijing, Karachi or Kabul -- can use the software to enrol users.

The patch reduces the sensitivity of the enrolment software's iris-recognition system, making it easier to spoof the software with a photograph of a registered operator, rather than requiring the operator to be present in person.

As the Huffington Post article explains, creating a patch that is able to circumvent the main security features in this way was possible thanks to design choices made early on in the project. The unprecedented scale of the Aadhaar enrollment process -- so far around 1.2 billion people have been given an Aadhaar number and added to the database -- meant that a large number of private agencies and village-level computer kiosks were used for registration. Since connectivity was often poor, the main software was installed on local computers, rather than being run in the cloud. The patch can be used by anyone with local access to the computer system, and simply involves replacing a folder of Java libraries with versions lacking the security checks.

The Unique Identification Authority of India (UIDAI), the government body responsible for the Aadhaar project, has responded to the Huffington Post article, but in a rather odd way: as a Donald Trump-like stream of tweets. The Huffington Post points out: "[the UIDAI] has simply stated that its systems are completely secure without any supporting evidence." One of the Aadhaar tweets is as follows:

It is because of this stringent and robust system that as on date more that 50,000 operators have been blacklisted, UIDAI added.

The need to throw 50,000 operators off the system hardly inspires confidence in its overall security. What makes things worse is that the Indian government seems determined to make Aadhaar indispensable for Indian citizens who want to deal with it in any way, and to encourage business to do the same. Given the continuing questions about Aadhaar's overall security and integrity, that seems unwise, to say the least.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, biometrics, breach, india, privacy, security

Federal Court Says NSA PRISM Surveillance Good And Legal Because The Gov't Said It Was Good And Legal

from the 'those-DOJ-guys-are-real-straight-shooters' dept

Three years after its inception, a prosecution involving possibly unlawful FISA-authorized surveillance, hints of parallel construction, and a very rare DOJ notification of Section 702 evidence has reached a (temporary) dead end. The defendants challenged the evidence on multiple grounds -- many of which weren't possible before the Snowden leaks exposed the breadth and depth of the NSA's domestic surveillance.

The federal judge presiding over the case -- which involved material support for terrorism charges -- has declared there's nothing wrong with anything the NSA or FISA Court did, so long as the surveillance was authorized and possibly had something to do with national security. (via FourthAmendment.com)

First, the defendants -- all accused of providing material support to Al Qaeda (remember them?) -- asserted the constitutionality of the NSA's upstream collections should be revisited in light of the Snowden leaks. The court [PDF] says these more-recent exposures are no reason to upset the precedential apple cart.

Controlling precedent decides this issue. In 2005, the Sixth Circuit rejected a Fourth Amendment challenge to FISA's procedures. The court explained in Damrah that the defendant's Fourth Amendment challenge lacked merit, as "FISA has uniformly been held to be consistent with the Fourth Amendment." Damrah has not been overturned or altered in light of the public disclosures regarding PRISM and upstream collections. And consequently, Damrah forecloses Defendants' constitutional challenge.

So, to add this all up: leaked documents from 2013 onward, exposing routinely-abused programs that massively expanded following the 2008 FISA Amendments Act, mean nothing when stacked up against a 2005 case predating the NSA's admissions of surveillance abuse and the exposure of the FBI's backdoor searches of domestic communications.

Furthermore, the court declares -- based on documents provided by the government directly to the court, but not to the defendants (in ex parte hearings) -- the FISA-authorized surveillance was on the up-and-up because the government provided documents declaring the FISA-authorized surveillance was on the up-and-up.

The court is sympathetic to those on the other side of the deck it helped stack, but only barely.

I recognize the challenge faced by a defendant in making a substantial preliminary showing that a FISA application contains a false statement when the defendant does not have access to the application. But the threshold burden exists nonetheless. [...] And here, Defendants have failed to satisfy that burden.

Oddly, the court then decides, after pulling from a 2005 decision and ignoring every FISA-related development since then, that previous domestic surveillance violations by the FBI have no bearing on this case.

The Government's errors from more than a decade ago [referring to a 2004 IG report about post-9/11 surveillance] do not amount to a substantial preliminary showing that an application for FISA collection relevant to this case contains a false statement which was knowingly or recklessly made and necessary to the finding of probable case.

Yes, this is true. These are not comparable things. But with the defendants unable to review the FISA applications, they're left with the judge's take as guided by government submissions -- submissions the defendants are also unable to review or even argue.

As for the Fourth Amendment challenge to Section 702 surveillance generally, the court says there's really no Fourth Amendment issues as this does not apply to "aliens in foreign territory." The court goes even further, though, suggesting the collection of communications outside of the country does not even require a warrant, even if it "inadvertently" sweeps up Americans' communications during the process.

Since the court has also unilaterally decided it can -- unaided by anyone but the government -- decipher the government's FISA-related submissions, there are no due process violations even if the defendants are prevented from viewing, analyzing, or rebutting the claims made by the government during these ex parte sessions. In the end, there's nothing left for the defendants to do but appeal, which will certainly happen what with the court dismissing out of hand the evidence provided by multiple leaked documents and documents officially released by the Director of National Intelligence. To buy the government's claims of above-board surveillance in secret court sessions and declare those NATSEC Kosher seems like a very close-minded move that grants the government more deference than documents the government released publicly itself shows it has earned.

Filed Under: 4th amendment, fisa, fisa court, fisc, mass surveillance, nsa, prism, privacy, surveillance

AT&T, Verizon, T-Mobile & Sprint Want Even Broader Access To Your Personal Data

from the hard-pass dept

We've noted repeatedly that however bad Facebook has been on privacy (pretty clearly terrible), the broadband industry has traditionally been much, much worse. From AT&T's efforts to charge consumers more just to protect their privacy, to Verizon getting busted for covertly tracking users around the internet without telling them (or letting users opt out), this is not an industry that respects you or your privacy. That's before we even get to their cozy, often mindlessly-loyal relationship with intelligence and law enforcement.

As such, it's kind of amusing to note that these are the same companies now trying to position themselves as the gatekeepers of all of your private data online. As security expert Brian Krebs notes, AT&T, Verizon, T-Mobile and Sprint (the latter two of which will likely soon be one company) are cooking up something dubbed "Project Verify," which would let end users eschew traditional website passwords -- instead authenticating visitors by leveraging data elements unique to each customer’s phone and mobile subscriber account, including location, "customer reputation", and device hardware specs.

This video by the carriers offers a little more detail:

The problem, as Krebs is quick to note, is that giving more private data to companies with an utterly abysmal track record on privacy might not be a particularly bright idea:

"A key question about adoption of this fledgling initiative will be how much trust consumers place with the wireless companies, which have struggled mightily over the past several years to validate that their own customers are who they say they are."

As we've been noting, these are the same companies that have been struggling to prevent hackers from routinely stealing customer identities via SIM hijacking, which involves a hacker bribing an employee to port your phone number to a new device, then jacking your identity and making off with your private data (or making millions by selling your cryptocurrency or valuable accounts). These are also the same carriers that have routinely failed to do much about the SS7 exploit that's been in the wild for seemingly ever, allowing hackers to spy on an undetermined number of cellular customers for years.

These are also the same wireless carriers that were just caught up in a massive scandal involving their collection of sale of user location data, a multi-billion dollar venture that involves selling your daily motion habits to a cavalcade of different companies, many of which have shown a similarly-flimsy disregard for actually keeping that data safe. And these are the same companies that work tirelessly to scuttle any and every effort to actually shore up nationwide privacy standards, usually by lying to lawmakers and the public about what these plans would actually do.

For his part, Krebs thinks this is a hard pass:

"I am not likely to ever take the carriers up on this offer. In fact, I’ve been working hard of late to disconnect my digital life from these mobile providers. And I’m not about to volunteer more information than necessary beyond the bare minimum needed to have wireless service."

Other widely-respected security reporters were similarly unimpressed:

Again, the devil will be in the details. But at first glimpse, you'd be pretty foolish to trust companies with additional private data that have repeatedly proven to be routinely cavalier about the oceans of data they already collect. Time and time again wireless carriers have prioritized profits over the personal interest and welfare of consumers, and anybody expecting that to magically change ahead of Project Verify's launch haven't been paying attention.

Filed Under: accounts, digital identity, passwords, privacy, project verify, telcos
Companies: at&t, sprint, t-mobile, verizon

DHS Continues Facial Recognition Deployment With An Eye On Expanding Program To All Domestic Travelers

from the ALL-YOUR-FACE-ARE-BELONG-TO-US dept

The DHS is moving forward with the deployment of facial recognition tech at ports of entry, including US airports hosting international flights. The tech is still in its infancy, more prone to ringing up bogus hits than removing criminals and terrorists from circulation. But the DHS -- like many other government agencies -- isn't afraid to let a mere toddler do an adult's job. Faces will be scanned, whether travelers like it or not.

The DHS has issued an undated Privacy Impact Assessment [PDF] meant to unruffle the feathers of Americans it informed last year that not traveling internationally was the only way to opt out of this collection. The next phase of the facial rec tech deployment dials things back a bit, offering a bit more in the way of data collection/retention constraints.

In an effort to mitigate the impacts of this expanded collection, CBP seeks to minimize the data it maintains by purging facial images as quickly as possible after use. Each traveler’s biographic and biometric data is deleted from the TSA-issued device, either at the time of the next passenger’s transaction or after two minutes, whichever occurs first. All PII collected for the TVS transaction is stored in a secure database within the CBP network. CBP does not retain images of U.S. Citizens in ATS-UPAX but does retain images of non-U.S. Citizens for up to 14 days for confirmation of the match, as well as evaluation and audit purposes. CBP deletes all photos, regardless of immigration or citizenship status, from the TVS cloud matching service within 12 hours of the match.

[...]

TSA will only use these photos for identity verification at the checkpoint and cannot access the photos after the inspection is completed.

This is one of the better data retention policies the government has rolled out, especially considering it pertains to a border security program. But the DHS is far more vague -- and in some cases appears to be fudging the truth -- when it comes to details about data sharing. DHS claims this data won't be shared with airlines because the airlines have no interest in the data. As Edward Hasbrouck of Papers, Please points out, this statement runs contrary to the DHS's actions.

The joint government/industry interest and intent to develop and deploy a shared system of automated facial image tracking and control of travelers is made clear in white papers on government/industry biometric strategy and in the agendas for events at which CBP, TSA, and industry executives get together to discuss their plans.

Next month’s Future Travel Experience Global 2018 conference, for example, includes presentations by the planning and implementation directors for CBP’s “Biometric Exit” program, followed later the same day by a “working session” with CBP, airline, and airport executives on “Implementing advanced passenger processing with automation and biometrics”.

As for allowing American travelers to opt of the program, the DHS's stance has softened from its earlier "just don't travel" posture. Travelers can bypass face-scanning kiosks, but that just routes them towards CBP secondary inspection. All the CBP/DHS has to do to encourage more opting-in is make the non-scan option as laborious and invasive as possible. As has already been observed by Papers, Please, opting out sends American citizens to the same line as foreign international travelers, ensuring the wait for clearance is much longer than utilizing the facial rec option. Bottlenecks are good way of routing traffic where you want it to go, rather than where it would naturally flow.

The end goal isn't more surveillance of international travelers. The DHS ultimately wants to harvest faces from every domestic traveler in the US. It's not stated in the Impact Assessment, but there are already signs the agency has no interest in limiting this to those arriving from foreign countries.

Use of automated facial recognition is intended by the DHS to become a routine element of the surveillance and control of all air travelers, foreign and domestic. As the head of the CBP, Commissioner Kevin McAleenan, said in a press release in June 2018, “We are at a critical turning point in the implementation of a biometric entry-exit system, and we’ve found a path forward that transforms travel for all travelers.” [emphasis in the original]

The best way to fight this is to opt out. It may subject travelers to longer waits at checkpoints, but it also forces CBP agents to process more people the old fashioned way, without the aid of the DHS's new tech. Annoying the government by refusing to be traffic-shaped by deliberate bottlenecks can be its own small victory, even if the War on Terror machinery continues to rack up loss after loss to terrorists.

Filed Under: 4th amendment, dhs, domestic travelers, facial recognition, privacy, tsa

Ajit Pai Coddles Big Telecom, Demonizes Silicon Valley

from the inconsistency-ahoy dept

To be very clear there's no shortage of legitimate criticism aimed at giants like Facebook and Google for their inconsistent policies, repeated privacy snafus, and incessantly-incompetent public relations skills.

That said, a large chunk of the push to "do something" about Google, Facebook and Twitter's supposed assault on free speech is also little more than wet nonsense driven by people who don't understand how the internet or First Amendment work. And a lot of the recent breathless hyperventilation in DC and vilification of "big tech" is being driven by the telecom sector, which has spent years demanding that their broken and uncompetitive monopoly market be mindlessly deregulated, while the healthier, more competitive online content and ad space face onerous new regulations.

We've discussed at length how the telecom industry has grown bored with the slow, steady profit made from upgrading and running broadband networks, and has shifted its focus toward the sexier realm of online advertising. Granted, when large ISPs try to directly compete in that space they tend to fall flat on their faces, since running government-pampered monopolies has dulled their innovative and competitive edge. As a result, the Comcast/AT&T/Verizon version of "competition" usually involves two things they're actually good at: cheating by distorting the playing field (aka net neutrality violations) and lobbying.

The motivation here (money) isn't really mysterious. Cable lobbyists routinely call for regulation of companies they're trying to compete with in the online ad space, and loyal policymakers and lawmakers are frequently happy to oblige to keep campaign contributions flowing. Telecom executives like to pretend this is just fair play, given Netflix and Google's (long since dead) support of net neutrality. The difference: ISPs really were trying to use their broadband monopolies to harm competitors, and Google and Netflix's arguments were largely being made in good faith.

There's no good faith ISP arguments occurring here. ISPs don't actually care about privacy, transparency, or your right to spread hate on Twitter. And ISP BFFs like Ajit Pai have long demonized Silicon Valley giants by using straight up nonsense in order to make their argument (like the time he tried to claim a run of the mill Netflix CDN was a network neutrality violation). All while turning a blind eye to ample problems in the telecom sector.

This inconsistency was again on proud display this week in a post by Pai over at Medium ahead of this week's Silicon Valley hearings. In it, Pai laments all manner of problems with Silicon Valley giants, from their disdain for privacy, to a lack of total transparency. You'll notice that most of the concerns Pai expresses were comically-absent as he dismantled popular net neutrality (and ISP transparency) protections last fall:

"Are these tech giants running impartial digital platforms over which they don’t exercise editorial judgment when it comes to content? Or do they in fact decide what speech is allowed and what is not and discriminate based on ideology and/or political affiliation? And again, going back to the first point: where is the transparency?"

Pai's sudden interest in transparency is downright adorable. But you'd have to be blind not to notice how the things Pai demonizes Silicon Valley for pale in comparison to many of the things we've seen in the telecom sector. You'd also have to be blind not to notice how Pai's arguments perfectly mirror the telecom industry lobbying talking points accidentally leaked to us last week by US Telecom. Surely that's only coincidental, right?

From ISPs efforts to charge customers more for privacy to using bullshit fees to jack up your bill, Pai never bats an eyelash when AT&T or Comcast engages in all manner of bad behavior. Yet watch how Pai hyperventilates when talking about Google, Facebook, and Twitter doing things notably less terrible or, as we saw with the recent bogus Twitter shadowbanning controversy, completely made up.

Pai spent the last five years insisting that ISPs shouldn't face "burdensome regulations," despite the fact ISPs like Comcast operate natural monopolies. Yet here he is, advocating for new regulatory restrictions to be foisted upon ISP competitors who actually do face competition:

"The public deserves to know more about how these companies operate. And we need to seriously think about whether the time has come for these companies to abide by new transparency obligations. After all, just as is the case with respect to broadband providers, consumers need accurate information in order to make educated choices about whether and how to use these tech giants’ platforms."

Part of the problem is that this conversation on what to do about Facebook, Google and Twitter has been infected by our idiotic need to apply partisanship to fucking everything, regardless of whether it makes intellectual sense. Net neutrality, for example, has long been played up as a "partisan" issue by ISPs to sow dissent and derail consensus, despite the fact that an overwhelming bipartisan majority of Americans support it.

Here too, ISPs are using baseless, inconsistent, and inflammatory rhetoric to enflame ideological divides and censorship fears with an eye on hampering competitors and encouraging partisan gridlock. In reality, telecom operators don't exclusively inhabit "the right," and Google, Facebook, and Twitter aren't the exclusive dominion of "the left." They're comprised of employees across vast swaths of the ideological spectrum, who, if you actually sit down and talk to them, tend to agree more than they disagree.

But viewing technology debates through a partisan lens is encouraged by those eager to keep the public bickering--instead of developing real solutions to real problems. When the partisan labels come out, the brain often turns off. And there's entire industries happily cashing in on that fact to thwart consensus and meaningful change. There's also an ocean of lawmakers and politicians like Pai more than happy to unabashedly-parrot those efforts on demand, knowing full well that loyalty now means either a lucrative lobbying job or posh think tank gig down the road.

There's absolutely a legitimate conversation to be had here in terms of what to do about privacy and speech in the Facebook and Twitter era. And that may or may not involve crafting new regulations. But it might be nice if people wised up to the fact that a huge swath of the conversation is being dictated not by parties acting in good faith with a genuine eye on valid solutions, but by telecom monopolies eager to pee in the discourse pool simply to fatten their wallets.

Filed Under: ajit pai, fcc, neutrality, privacy, regulations, transparency
Companies: facebook, google, twitter

Verizon's Oath Will Still Scan Your E-mail For Advertising Purposes Because Hey, It's Verizon

from the Verizon-gonna-Verizon dept

While all major webmail companies have veered away from the idea of automatically scanning private e-mails in a bid to monetize the content for behavioral advertising due to public backlash, that's simply not how Verizon rolls. According to a deep dive over at the Wall Street Journal (watch out for the paywall, here's a Verizon-owned Techcrunch alternative), Verizon and its Oath subsidiary now offer the country's only major webmail service that still thinks this practice is a good idea:

"Yahoo’s owner, the Oath unit of Verizon Communications, has been pitching a service to advertisers that analyzes more than 200 million Yahoo Mail inboxes and the rich user data they contain, searching for clues about what products those users might buy, said people who have attended Oath’s presentations as well as current and former employees of the company."

After backlash, Google ended its own practice of auto-monetizing e-mail content for behavioral ads last year, acknowledging that the practice doesn't exactly instill trust in your customers (e-mails are still automatically scanned as part of the company's "Smart Compose" feature, but content is no longer monetized). Apple has never scanned subscriber e-mails for this purpose, and Microsoft told Techcrunch this week that the company does “not use email content for ad targeting in any way, anywhere in Microsoft." The shift has been part of an effort to compete on privacy, which is an idea that should be encouraged.

Coming from the telecom sector, Verizon's not quite as familiar with this whole competition thing. In comments to the Journal, Oath's vice president of data, measurements and insights provided a very Verizon-esque response, suggesting the scanning was a public benefit to users eager to see more relevant ads:

"Mr. Sharp said that being served ads is part of the trade-off users make in exchange for free online services, and that Yahoo’s research shows they prefer ads that are relevant to them.

"Email is an expensive system,” Mr. Sharp said. "I think it’s reasonable and ethical to expect the value exchange, if you’ve got this mail service and there is advertising going on."

Yes, so ethical.

On the plus side, Verizon's e-mail scanning doesn't include health and medical information, though in the wild west of consumer privacy oversight that is the United States, you'd have a hard time confirming that this or other information (like financial data) isn't being exploited. After all, Verizon doesn't exactly have a great track record about being candid about this sort of thing. That said, it looks like even before Verizon came on board Yahoo's e-mail scanning and monetization system went notably further than Google's ever did:

"Initially, Yahoo mined users’ emails in part to discover products they bought through receipts from e-commerce companies such as Amazon.com Inc., people familiar with the practice said. Yahoo salespeople told potential advertisers that about one-third of Yahoo Mail users were active Amazon customers, one of the people said. In 2015, Amazon stopped including full itemized receipts in the emails it sends customers, partly because the company didn’t want Yahoo and others gathering that data for their own use, someone familiar with the matter said."

The problem is that while Verizon has hungrily eyed Silicon Valley giants' ad revenues for years, its effort to pivot into the ad sector isn't going so well. The company's Go90 video platform, purported to be the cornerstone of Verizon's Millennial-focused video ad ambitions, recently imploded after a fairly severe lack of public interest. And while Oath may ultimately prove to be a powerhouse in advertising, refusing to bend to competitive trends and consumer concerns by scanning the e-mails of millions of subscribers for an extra buck isn't a great way to build a trustworthy brand.

Of course, anybody surprised that Verizon would take the low road shouldn't be. After all, this is the same company that was caught a few years ago covertly modifying user wireless packets so it could track users around the internet without telling them. It took two years for security researchers to even notice it, and months more before Verizon could be bothered to offer a working opt out tool. And while the company was ultimately fined by the FCC for the practice, a bigger variant of that technology has long-since been implemented across Verizon's entire Oath (the combination of Yahoo and AOL) ad network.

Of course we haven't even gotten to Verizon's ultra-cozy relationship with the nation's intelligence apparatus yet, or the fact that giant ISPs routinely engage in pretty sleazy behavior to undermine pretty much any effort to shore up the nation's privacy standards, regardless of the quality of the effort. All while hoovering up and monetizing private user browsing and location data on a scale that pretty routinely makes the Facebook, Cambridge scandal look like child's play.

Granted if Verizon wants to undermine its own efforts to pivot into the online ad space that's its prerogative, but it might make sense for the traditionally myopic telecom giant to try and evolve on the consumer trust front as well. As an aside, if you're a Yahoo e-mail customer, you should be able to opt out here.

Filed Under: email, privacy, scanning, yahoo, yahoo mail
Companies: oath, verizon, yahoo

Australian Gov't Likes Intrusive Border Device Searches Just As Much As The US Does

from the privacy-continues-to-be-the-biggest-victim-of-terrorist-attacks dept

Australians will be thrilled to discover they won't have to visit the United States to have their electronic devices brutalized and mercilessly probed in the name of security. Why spend all that money flying halfway around the world when you can experience the same intrusive discomfort at home?

A British-Australian citizen travelling through Sydney airport has had his devices seized, and believes his laptop password cracked and his digital files inspected by Border Force officers, in what privacy groups say is a worrying development.

Nathan Hague, a 46-year-old software developer, was detained apparently at random for 90 minutes while the officers took his phone and password-protected laptop into a back room.

Hague had no reason to be treated with extra suspicion, but extra suspicion was there all the same, simply because the random selection process told border officers to be as intrusive as possible. He asked officers a reasonable question -- if you search my other belongings in public because I'm a randomly selected "threat," why can't you search my devices out in the open. There was, of course, no response.

Other questions about the Border Force's handling of the contents of Hague's devices also went unanswered. Officers refused to say whether data would be copied and/or retained, as well as refusing to explain what they were looking for.

Why did the Border Force perform this intrusive search? Because it can.

“Officers may question travellers and examine goods if they suspect the person may be of interest for immigration, customs, biosecurity, health, law-enforcement or national security reasons,” said a spokesperson for the ABF.

So, for any reason or no reason, so long as the word "security" is chanted during the proceedings. Who could limit the Border Force's intrusive, suspicionless searches? Only the people who've already decided they're not going to.

Under the Customs Act, officers have the right to examine travellers’ personal items, including accessing electronic devices and making copies of their files. The Customs Act imposes no legal threshold or requirement that officers need to meet in order to use this power

The Border Force offered quasi-reasons in defense of its handling of Hague and his devices. The law itself doesn't even compel a quasi-rationalization.

And the law might get worse. Proposed changes would give citizens with password-protected devices two choices: hand over the password or spend 5-10 years in prison. At this point, Hague was free to refuse the request, but that likely would have meant not seeing those devices again for weeks or months. The Border Force has extended an invitation to the software developer to file a complaint with its redress black hole, just in case Hague wants to spend more time being jerked around by the Australian government.

This is status quo in the so-called free world: suspicionless, highly-intrusive searches requiring minimal, if any, justification… all done in the name of national security. While citizens may realize a security/freedom tradeoff is necessary in some extreme cases, their governments have already determined the exchange rate and made it clear the freedom side will continue to lose value indefinitely.

Filed Under: australia, border search, confiscated, devices, laptops, nathan hague, phones, privacy, random search, surveillance