That Time Telco Lobbyists Sent Me All Their Talking Points About Trying To Shift The Blame To Internet Companies

from the oops dept

It's not every day that big telco lobbyists email me their internal documents about how they're going to try to shift all the negative press about themselves and try to flip it onto internet companies. But it did happen yesterday. In what was clearly a mistake a top exec at the telco's largest lobbying organization, USTelecom, emailed a 12 page document of talking points yesterday, asking the recipients to "review the document for accuracy and other thoughts" in order to help USTelecom President Jonathan Spalter for when he goes on C-SPAN next week. I found it a bit odd that I would be on the distribution list for such an email -- especially when 13 of the 15 recipients of the email were US Telecom employees. And me. The one other non-US Telecom person works at a firm that provides "subject matter experts" and "in-depth legal analysis."

The talking points are not all that surprising, if you're at all familiar with the telco industry, so there aren't really any huge smoking guns here, but they do cover a huge range of issues, from net neutrality, competition, privacy, cybersecurity, and more. Amusingly, on the net neutrality front, there's a section on "Verizon Throttling Fire Responders." Tragically, that appears to be one of the few sections in the document that they hadn't yet filled in yet -- perhaps because the industry still doesn't have a good response to Verizon throttling fire fighters in California as they were battling wildfires.

One thing that's clear, however, is that the big telcos really want to play up the recent attacks on social media companies ("edge providers," as they like to say), and throughout the document there are statements about taking advantage of the current political attacks on those companies. For example, in the "Privacy" section, the talking points for Salter appear to be for him to try to pivot to making it about Facebook and Google as quickly as possible, saying they are the bigger risks:

Privacy

MESSAGE: Here is the modern reality of consumer protection: the greatest risks are posed by companies on the internet’s edge. Privacy is a shared responsibility -- and the burdens and obligations can not rest solely with ISPs and must be applied equally across the internet ecosystem.

• The increased scrutiny of Facebook and other edge provides offer a significant opportunity for Congress to implement clear and consistent rules that apply equally to all companies in the internet ecosystem.  And when they begin the process of establishing best practices for privacy, they will need to look no further than broadband providers.
• For years, our members have embraced strong consumer privacy policies, because they understand the success of any digital business depends on earning their customers’ trust.
• Consumers and companies alike deserve one set of protections and rules of the road. This is the best way to ensure consumer protection while also providing the necessary flexibility for a competitive and innovative marketplace.

Let's just say that's laughable. Google and Facebook may be no great shakes on privacy, but the telcos are far, far worse. First of all, they have much greater visibility into everything that you do, because it all goes through their pipes. You can avoid Google and Facebook if you want. Not so much your ISP. Second, these companies have terrible, terrible histories when it comes to privacy issues, much worse than Google and Facebook.

Telcos have historically sucked up all your clickstream data and sold it to databrokers, while pretending it was no big deal. The telcos have regularly used incredibly sneaky and intrusive spying practices (way beyond anything Google and Facebook have done) including deep packet inspection and undeletable supercookies. And who can forget when the telcos wanted to sell you back your privacy, and raise your subscriber fees $30/month if you didn't want them to snoop on all your internet activity? And who can forget that it was just weeks ago that Verizon launched a VPN without any privacy policy at all?

And let's not forget their super cozy relationship with the NSA. After the Snowden leaks five years ago, the internet companies all were quick to highlight what they were doing to prevent the NSA from snooping on you. They revealed long-hidden lawsuits fighting back against the NSA. They pushed for greater transparency and legal reform, they published transparency reports... all while the telcos went silent (and when they finally -- years later -- were pressured into releasing transparency reports, those reports left out key details on surveillance support). That's because it was shown that they were extra cozy with the NSA, even giving them full access to their equipment. Section 702 "upstream" collection involves the NSA directly tapping into telco backbone connections and sniffing through everything. We only found about all of this because an AT&T technician literally walked into EFF's offices one day and spilled the details (later confirmed with Snowden documents). And rather than admit to helping the government violate the 4th Amendment, the telcos ran to Congress to get guaranteed retroactive immunity for supplying warrantless wiretaps.

So, sure, the privacy failings of Google and Facebook are worth pointing out and discussing. But they're child's play compared to the telcos. For the telcos to pretend that they are the ones who "embraced strong consumer privacy policies" is laughable. This isn't a talking point. It's pure propaganda.

There's a brief section later in the document, suggesting that they play up Trump now fighting with Google, and suggest that's a good point to drop in the "same rules for edge" providers meaningless argument:

Trump/Google Drama

People have spent years clamoring for ISP net neutrality. We need same rules of the road for edge.

I'm sure that sounds good to whoever came up with it way back when, but as people have explained for the better part of a decade, it makes no sense at all. Access providers and edge providers provide very different types of services, and "the same rules" don't make any sense at all. The telcos and the folks at US Telecom know this. They only bring this up because they think the viewing audience is stupid and will nod along with "same rules for everyone." But, in reality, they know that what they are advocating for is basically handicapping internet companies.

On net neutrality there's the usual nonsense, falsely claiming that they "strongly support net neutrality" even as they immediately cheer on the FCC order that literally wiped out net neutrality:

MESSAGE: Our nation’s broadband providers strongly support net neutrality—without 1930’s-era regulations—and with consumer protections that are consistently applied across the entire internet ecosystem.

This is blatantly untrue. The telcos fought multiple earlier attempts to enforce net neutrality that did not use "1930's era regulations." What happened was that Verizon's lawsuit over earlier rules (which did not rely on those regulations) resulted in the court effectively saying "to have net neutrality, you have to use those rules." So, we would have had net neutrality without those 1930s-era regulations if US Telecom and its members hadn't sued over the older rules.

Not surprisingly, they also want to push the silly argument that just because they didn't immediately make the internet turn to shit the day after the FCC repealed the rules, it proves that we didn't need the rules (I will again remind you right here -- for no particular reason -- that the section on how to respond to Verizon violating those old net neutrality rules in throttling the fire department's wireless connection... is left blank in the document).

Since the FCC’s Restoring Internet Freedom Order, the internet as we know it is still thriving, growing, open and continues to spin on its axis. The predictions that ISPs would engage in anti-competitive throttling, blocking, and prioritization, have not happened.

Again, the telcos aren't going to rush out bad practices all at once -- especially not while the repeal of the rules is still in court. But, again, it should be noted that during a previous fight over these rules, in court, Verizon's lawyer flat out admitted that without these rules, the company had every intention of throttling traffic.

And, of course, the telcos strategy when the questioning gets tough on net neutrality is to try to do this judo move and attack the big internet companies instead:

It’s ironic—but not unexpected—that the companies which have become the internet’s most powerful gatekeepers are fighting for an open internet that exempts them from the very rules for which they are advocating.

First off, this is not ironic. Second, it's not accurate. Google and Facebook are hardly the most powerful "gatekeepers." Nor are they the ones pushing for open internet rules. That's been left mainly to smaller internet companies who can't get into bed with the telcos like Google and Facebook are able to do. Third, the whole idea that the rules are somehow different for them makes no sense. These rules are about providing access to the internet. There is no "net neutrality" for edge providers that makes any sense.

Not surprisingly, the telcos are freaked the fuck out about state regulators stepping in to reimpose net neutrality rules. And, on this, I don't blame them. Well, no, that's not correct, I totally blame them. I blame them for pushing the FCC to drop the federal rules opening up this vacuum into which the states are now stepping. I agree that having the states take this on is a bad idea that will lead to a mess of different rules across the country, but, hey maybe the telco lobbyists should have thought of that before asking the FCC to kill off these wildly popular rules that had a very light touch. But, still, they've got their new talking points and they're sticking to 'em:

• Broadband is and will continue to be regulated at the federal level
• Precedent at the FCC, and in the courts, have recognized the dangers of individual state mandates and have embraced state preemption to avoid piecemeal approaches to internet regulation.
• [Pending passage] The regulations signed into law by Governor Jerry Brown put short-term political gain ahead of long-term economic development and growth of California’s internet economy.

Well, no. Broadband has long been regulated at the state and local level thanks to public utility commissions, local franchise laws and more. And, hey, you had broadband regulated at the federal level under the 2015 open internet order, which included state pre-emption but you gave that up when Ajit Pai repealed it and gave up the state pre-emption bit when he took the FCC out of the broadband regulation game.

Ooops. Maybe you jokers should have thought of that before.

As for the California bill -- what?!? Long term economic development in California especially depends on a free and open internet -- the kind where Verizion, AT&T and your other members are unable to kill new startups with excessive tolls and fees, not to mention limited services.

There are then some talking points about just how painfully expensive it is for the telcos to serve rural residents -- which no one denies. But, it's pretty funny to watch these massive telcos, with billions in profits and a long history of squandering government subsidies use these talking points to talk about why they just need more cash from the government:

Delivering broadband to sparsely populated rural areas is a costly and challenging endeavor that requires significant upfront investment.

That is why federal support is essential for network providers to meet deployment challenges in high cost areas.

Oh, but not only do they want cash from the government, they most certainly DO NOT want that cash to go to programs that would create competition in the marketplace. Oh no.

Federal investment must be used to fill the gaps in truly unserved areas, not create false market competition by allowing electric utilities with established monopolies to extend their market power over this already fragile market. Together, we should be laser-focused on serving the unserved and maximizing the federal support to do it, while avoiding duplication and overbuilding, and ensuring efficiencies wherever possible.

Sounds like somebody is still quite a bit ticked off about massive success stories like Chattanooga, where the local electric utility built an amazing competitive network that not only provided better, cheaper service in that city to under-served residents, but also forced the incumbents to up their own game as well.

It's doubly hilarious that a key talking point in this document is literally "we don't want competition" when much of the other document keeps trying to push the lie that there's robust broadband competition.

They also talk up having states give them money, such as this:

In New York, officials just completed a $500 million broadband auction to deploy high-speed service to 99 percent of its residential structures.

One would hope that the C-SPAN interviewer would follow up this point with a question about why NY would trust any of these companies when US Telecom member Verizon promised to bring fiber to 100% of New York City in 2008 and then didn't. Seems like we should be fairly skeptical of the 99% claim now.

It also is unlikely to surprise anyone that US Telecom is really, really, really against the requirements for very limited local loop unbundling, which has helped enable a smidgen of competition in certain areas (I only have the broadband I have today thanks to local loop unbundling). These are the rules that made the big telcos have to allow third party service providers to use their networks at wholesale rates to offer competing services. It's a great way to create competition at the service level, rather than doing it more wastefully at the infrastructure level. The telcos have done a good job making it more and more impossible for competitive carriers to make use of it, but they really want the rules gone entirely. And they say they're no longer needed due to a completely fictional "tremendous competition in the communications market." Don't laugh. They think they're serious:

Today, more than 20 years later, there is tremendous competition in the communications market, but these rules are still on the books.

We have asked the FCC to review whether these rules are still necessary. If the FCC agrees they are, we hope the commission will forbear from these outdated rules like they have with many other no longer relevant regulations.

Ending these rules will allow broadband providers to invest in the future of their networks father than being tied to the past.

So, let's be clear. There is barely any real competition in the broadband market, let alone "tremendous" competition. Ending those rules won't magically allow providers to invest in future networks. They will limit competition, meaning there's less reason to invest.

There's some nonsense about how the FTC will be a great protector of consumers from the telcos now that the FCC has taken itself out of the game. Of course, as we've discussed over and over again, the FTC's mandate is much more limited and does not cover most of the aspects of net neutrality that are important. Furthermore, the FTC has neither the resources nor the expertise to really play in the telco market.

There's some more stuff in there, but those are the highlights. Congrats, US Telecom, you get your draft in-progress talking points out there. If you want critiques of your future talking points, feel free to cc: me again.

Filed Under: competition, cybersecurity, fcc, internet, lobbyists, net neutrality, privacy, regulation, talking points, telcos
Companies: at&t, ustelecom, verizon

Comcast Is Trying To Ban States From Protecting Broadband & TV Consumers

from the this-will-surely-end-well dept

We've repeatedly tried to make it clear that while everybody tends to focus on the death of net neutrality itself, the Pai FCC's "Restoring Internet Freedom" order killing net neutrality had a far broader impact than just killing net neutrality rules. As part of the repeal, Comcast, Verizon and AT&T also convinced FCC boss Ajit Pai to effectively neuter FCC authority over ISPs entirely, making it harder for the agency to hold giant ISPs accountable on a wide variety of issues ranging from privacy to transparency (the recent fire fighter kerfuffle being a prime example).

The order also attempts to ban individual states from holding giant ISPs accountable as well, though early ISP efforts to take advantage of this legal language haven't gone very well. In an effort to double down on weakening state oversight of natural telecom monopolies, Comcast lobbyists at the NCTA (the cable industry's biggest lobbying and policy organization) have also started petitioning the FTC, urging it to similarly "pre-empt" (read: ban or ignore) state-level efforts to protect consumers:

"The FTC should ensure that the Internet is subject to uniform, consistent federal regulations, including by issuing guidance explicitly setting forth that inconsistent state and local requirements are preempted," the NCTA wrote.

The FCC is already trying to preempt state net neutrality laws at the urging of industry groups, and courts might ultimately have to decide whether federal agencies can preempt such rules.

"The FTC should endorse and reinforce the FCC's ruling by issuing guidance to state attorneys general and consumer protection authorities reaffirming that they are bound by FCC and FTC precedent in this arena," NCTA argued."

The shorter version: the FCC's Restoring Internet Freedom order effectively cripples the FCC's ability to protect consumers, then shovels any remaining enforcement authority over to the FTC, which is ill-equipped to actually police the telecom market. Predicting that states would then try to jump in and fill the oversight accountability vacuum (which is precisely what started happening on both net neutrality and privacy), ISPs have also been urging both the FCC and the FTC to ban states from doing so.

This is all being done under the pretense that blind deregulation of the telecom sector magically results in greater industry investment and broader deployment. But as we've explained countless times, that's not how the U.S. telecom sector works. With neither competition nor reasonable government oversight to constrain it, natural monopolies like Comcast are simply free to double down on all their worst behaviors. To ignore this historical fact, one is required to pretend that the broadband industry is actually competitive, something Comcast again leans on in its filing with the FTC:

"ISPs claim they face so much competition that market forces will prevent bad behavior. Cable TV faces competition from online video services like Netflix, YouTube, and Amazon, NCTA noted. But notably, the NCTA filing includes a graphic listing "competitors" that doesn't include any broadband providers."

None of this logic is new. It was the same argument used by former FCC head Mike Powell (now the top lobbyist of the cable industry), who happily deregulated the broadband sector in the early aughts promising a cornucopia of investment and competition (consumers instead got a bigger Comcast monopoly, skyrocketing prices, usage caps, and virtually no competition at faster speeds). Oddly, giving giant telecom monopolies the precise regulatory landscape they want (no oversight, no concern about monopoly power) doesn't end well for consumers, innovation, or competition.

That this is still debated speaks to how lost in the woods on these issues we've become. And like Charlie Brown and his football, we never seem to learn, so nothing changes. And our reward for this collective gullibility is expensive broadband, comically-terrible customer service, and a bigger, meaner Comcast.

Filed Under: broadband, consumer protection, fcc, pre-emption, privacy, states, tv
Companies: comcast

Danish ISPs Get Win That Could End Copyright Trolling In Denmark

from the this-is-the-end dept

We have talked in recent years how the scourge of copyright trolling has hit the nation of Denmark particularly hard. While trolling operations started off about the same as they do elsewhere in the world, their requests to unmask ISP customers soon ramped up to enormous levels. It was enough to turn two ISP rivals into allies, with Telenor and Telia fighting in court for their respective customers' privacy rights. After an initial loss, the companies appealed up the legal chain and managed to get a win with the court siding with the ISPs' privacy concerns over the copyright trolls' nefarious business model. After that, one of the copyright trolls appealed to Denmark's Supreme Court, hoping to reverse the decision once again.

It didn't work. The Supreme Court is refusing to hear the case, potentially putting an end to copyright trolling in Denmark.

Unfortunately for the trolls, their hopes were shattered this week when the committee responsible for references to the Supreme Court said it would not be putting the case forward.

As a result, the May 7th decision of the Østre Landsret will stand, with Telenor and Telia no longer required to cooperate with parties involved in trolling cases.

As the article notes, the ISPs will no longer have to cooperate with copyright trolls moving forward. And that really should be the end of copyright trolling entirely, as the whole business model hinges on ISPs being forced to give up their customer information so that those customers can be targeted with the threat letters that have milked so much money from the public. This of course doesn't mean that these ISPs will never be required to hand over customer information. Rather, such unmasking can only occur at the request of police investigating criminal conduct.

Telenor Denmark’s Legal Director, Mette Eistrøm Krüger, welcomed the decision.

“Both personally and on behalf of our customers, I am really glad that we are being strictly ruled by the National Court’s decision, and we once again find that logging data should only be handed over to the police to combat serious crime,” he told Version2.

And so now we're left to hope that the rest of the world's courts will catch up to the pro-consumer stance taken by the legal system in Denmark.

Filed Under: copyright, copyright trolling, denmark, isps, privacy
Companies: telenor, telia

Charter Spectrum Security Flaw Exposes Private Data Of Millions Of Subscribers

from the Another-day,-another-scandal dept

Last year you'll recall that the cable and broadband industry lobbied the government to kill off broadband privacy rules at the FCC. The rules were fairly basic, requiring that ISPs and cable operators clearly disclose what data is being collected and sold, but also provide working opt out tools for users who didn't want to participate. The rules also contained restrictions requiring that consumers opt in to more sensitive data collection (financial), as well as some requirements that ISPs and cable ops adhere to standard security procedures, and quickly inform consumers when their private data was exposed by a hacker.

In recent months, the cable industry has been showcasing how it's simply not very good at keeping its websites secure. Comcast, for example, has seen three privacy breaches in almost as many months, with security researcher Ryan Stevenson discovering numerous, previously-unreported vulnerabilities that potentially exposed the the partial home addresses and Social Security numbers of more than 26.5 million Comcast customers.

Not to be outdone, now Buzzfeed has found that a vulnerability on the Charter Communications (Spectrum) website made it possible for just about anyone to take over customers’ accounts without a password. According to the report, this flaw was again discovered by Stevenson (who goes by the monicker Phobia), and involved tricking a Spectrum website that let subscribers create a Time Warner Cable (the company Charter just acquired) ID.

If a targeted customer hadn't yet registered for such an ID, a website flaw let a hacker trick the website into creating one by replacing their own IP address with the customer’s using the “X-forwarded-for” technique, a relatively trivial affair:

"The registration website tried to verify subscribers’ identities by asking for their zip codes and phone numbers. But according to the security researcher Phobia, the zip code didn’t need to be correct to proceed to the next page. Only the phone number associated with the account needed to be accurate. Additionally, Ceraolo found that hackers could use a brute-force software program in the phone number field (in other words, repeatedly try different 10-digit combinations), because the Spectrum website did not limit the number of attempts. That means it would be relatively easy for a hacker to take over someone’s account even without an accurate phone number."

Once the bogus ID was created, the hacker subsequently had access to oodles of private user account data, including billing address, email, and account number. That data could, in turn, be used as the cornerstone of social engineering and phishing efforts to glean even more customer information. Not all of Charter's total 23 million customers are impacted; only a smaller subset of the company's 14 million "legacy," pre-merger Time Warner Cable subscribers were impacted. The company also claims that it has no evidence to suggest that these flaws were actually exploited.

But we're still likely talking about millions of potential subscribers, and Charter won't specify just how many users may have had their private data exposed. And if Stevenson's recent track record is any indication, there's plenty more flaws likely waiting in the wings to be discovered.

Filed Under: breaches, broadband, flaws, privacy
Companies: charter, charter spectrum

Facebook's 'Privacy Protecting' VPN Booted From Apple Store For Snooping Too Much

from the ill-communication dept

Back in February we noted how Facebook had launched a new security tool the company promised would "help keep you and your data safe when you browse and share information on the web." The product was effectively just reconstituted version of the Onavo VPN the company acquired back in 2013. We also noted how some reports were quick to point out that instead of making Facebook users' data more private and secure, Facebook used the VPN to track users around the internet -- specifically what users were doing when they visited other platforms and services.

From a report in the Wall Street Journal just about a year ago:

"Interviews with more than a dozen people familiar with Facebook’s use of Onavo data show in detail how the social-media giant employs it to measure what people do on their phones beyond Facebook’s own suite of apps. That information shapes Facebook’s product and acquisition strategy—furthering its already formidable competitive edge, the people said."

At the time, Facebook spokespeople attempted to claim that this was no big deal because "websites and apps have used market-research services for years," and that the data collected by its nosy VPN helped the company improve its products.

But that response ignored the obvious problem: that Facebook has been pitching a product it claimed "protected" people's privacy but did the exact opposite. During a massive, global privacy scandal. With regulators and media outlets around the world contemplating vast new privacy guidelines that could massively impact Facebook's entire data-hoovering business model.

That anybody at Facebook thought this was a good idea is pretty remarkable.

This week, Facebook was forced to pull the company's "data security app" from the Apple Store after the company found that the service violated its data-collection policies:

"Earlier this month, Apple officials informed Facebook that the app violated new rules outlined in June designed to limit data collection by app developers, the person familiar with the situation said. Apple informed Facebook that Onavo also violated a part of its developer agreement that prevents apps from using data in ways that go beyond what is directly relevant to the app or to provide advertising, the person added."

Admittedly, Apple's app store approval process is certainly its own type of terrible. But the report notes that Apple demanded that Facebook "voluntarily" remove the app, and Facebook complied. As such, iOS users can no longer download the app, and users that have already installed it will no longer receive updates for it. It is, however, still available over at the Google Play store, if giving Facebook even greater insight into your online activity is a prospect that excites you.

The whole kerfuffle only punctuated our repeated point that VPN's aren't some kind of mystical privacy panacea. In the wake of the GOP killing broadband privacy rules and the myriad other privacy and hacking scandals, countless people have been flocking to VPNs under the mistaken belief that a VPN is some kind of silver bullet. But a VPN is only as good as the people running it on the other end. And if the people on the other end are running scams or lying about what data is collected and stored (which is incredibly common in the VPN realm) you're not a whole lot better off.

In short, who you get your VPN from is incredibly important, and if the person pitching you said VPN has a rich history of privacy abuses (be it Facebook or a giant, incumbent ISP like Verizon), you should probably know better than to trust the integrity of their promises, whatever form they take.

Filed Under: apps, onavo, privacy, security, vpn
Companies: apple, facebook

Chinese Surveillance State Is Basically The US Surveillance Apparatus Minus The Constitutional Rights

from the result-of-asking-'why-not?'-rather-than-'why?' dept

Reuters has a long, detailed examination of the Chinese surveillance state. China's intrusion into the lives of its citizens has never been minimal, but advances in technology have allowed the government to keep tabs on pretty much every aspect of citizens' lives.

Facial recognition has been deployed at scale and it's not limited to finding criminals. It's used to identify regular citizens as they go about their daily lives. This is paired with license plate readers and a wealth of information gathered from online activity to provide the government dozens of data points for every citizen that wanders into the path of its cameras. Other biometric information is gathered and analyzed to help the security and law enforcement agencies better pin down exactly who it is they're looking at.

China’s high tech surveillance gadgets, sometimes referred to as “black tech”, often make the headlines. They include police glasses with built-in facial recognition, cameras that analyze how people walk, drones and artificially-intelligent robots.

But it goes further than that. The Chinese version of stop-and-frisk involves "patting down" cellphones for illegal content or evidence of illegal activities.

Filip Liu, a 31-year-old software developer from Beijing, was traveling in the far western Chinese region of Xinjiang when he was pulled to one side by police as he got off a bus.

The officers took Liu’s iPhone, hooked it up to a handheld device that looked like a laptop and told him they were “checking his phone for illegal information”.

Liu’s experience in Urumqi, the Xinjiang capital, is not uncommon in a region that has been wracked by separatist violence and a crackdown by security forces.

[...]

Hand-held devices allow police to quickly check the content of phones on the street. Liu, the Beijing software developer, said the police were able to review his data on the spot. They apparently didn’t find anything objectionable as he was not detained.

China is home to several companies offering phone cracking services and forensic software. It's not only Cellebrite and Grayshift, although these two are best known for selling tech to US law enforcement. Not that phone cracking is really a necessity in China. Most citizens hand over passwords when asked, considering the alternative isn't going to be a detainment while a warrant is sought. The option is far more likely to be something like a trip to a modern dungeon for a little conversational beating.

What's notable about this isn't the tech. This tech is everywhere. US law enforcement has access to much of this, minus the full-blown facial recognition and other biometric tracking. (That's on its way, though.) Plate readers, forensic devices, numerous law enforcement databases, social media tracking software… these are all in use already.

Much of what China has deployed is being done in the name of security. That's the same justification for the massive surveillance apparatus erected after the 2001 attacks. The framework for a totalitarian state is already in place. The only thing separating us from China is our Constitutional rights. Whenever you hear a US government official lamenting perps walking on technicalities or encryption making it tough to lock criminals up, keep in mind the alternative is China: a full-blown police state stocked to the teeth with surveillance tech.

Filed Under: china, civil liberties, civil rights, privacy, surveillance

Google's Location Info Failure Might Interest The FTC

from the do-better dept

Earlier this week, the Associated Press did a story revealing that even for Google users (on both Android and iPhone) who turned off location tracking Google was still tracking their location in some cases.

Google says that will prevent the company from remembering where you’ve been. Google’s support page on the subject states: “You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

That isn’t true. Even with Location History paused, some Google apps automatically store time-stamped location data without asking. (It’s possible, although laborious, to delete it .)

For example, Google stores a snapshot of where you are when you merely open its Maps app. Automatic daily weather updates on Android phones pinpoint roughly where you are. And some searches that have nothing to do with location, like “chocolate chip cookies,” or “kids science kits,” pinpoint your precise latitude and longitude — accurate to the square foot — and save it to your Google account.

If you squint, you can kind of see why this might have happened. Apps like Maps and weather more or less need your location info to work well (though, the search part is a bit more baffling). But, even so, this seems like a huge blunder by Google, a company that should absolutely know better. The latest, of course, is that Google has quietly moved to update the language that users see to "clarify" that some location data may still be recorded:

But its help page for the Location History setting now states: “This setting does not affect other location services on your device.” It also acknowledges that “some location data may be saved as part of your activity on other services, like Search and Maps.”

Previously, the page stated: “With Location History off, the places you go are no longer stored.”

It's entirely possible, if not likely, that the location history feature is completely disconnected from the location specific data within these other apps. But, still, the average consumer is not going to realize that. Indeed, the tech savvy consumer is mostly unlikely to understand that. And Google's new "clarification" isn't really going to do a very good job actually clarifying this for people either. Google certainly has done a better job than a lot of other companies both in providing transparency about what data it collects on you and giving you controls to see that data, and delete some of it. But this was still a boneheaded move, and it's simply ridiculous that someone at the company didn't spot this issue and do something about it sooner.

As I've been pointing out for a while, a big part of why so many people are concerned about privacy on digital services is because those services have done a piss poor job of both informing users what's happening, and giving them more control over the usage of their data. This kind of situation is even worse, in that under the guise of giving users control (a good thing), Google appears to have muddied the waters over what information it was actually collecting.

I also wonder if this will make the FTC's ears perk up. There is still an FTC consent decree that binds the company with regards to certain privacy practices, and that includes that the company "shall not misrepresent in any manner, expressly or by implication... the extent to which consumers may exercise control over the collection, use, or disclosure of covered information." And "covered information" includes "physical location."

Would these practices count as misrepresenting the extent to which consumers could stop Google from collecting location info? It certainly seems like a case could be made that it does. There are many areas where it feels like people attack the big internet companies just because they're big and easy targets. Sometimes those attacks are made without understanding the underlying issues. But sometimes, I'm amazed at how these companies fail to take a thorough look at their own practices. And this is one of those cases.

Filed Under: ftc, google maps, location, location info, privacy, transparency
Companies: google

We're Bad At Regulating Privacy, Because We Don't Understand Privacy

from the we're-bad-at-this dept

It's been an interesting year for those of us who support strong privacy for the public -- in part because we've seen lots of movement on attempts to regulate privacy. However, you may have noticed that we've also regularly criticized almost every attempt to regulate privacy. We've been highly critical of the GDPR, Europe's big privacy regulation that is impacting basically every website globally. And we were even more critical of California's disaster of a privacy bill, that was a rush job with tremendous problems. And now that the news has come out that the White House is working on a domestic version of the GDPR (perhaps in an attempt to preempt California and other states from making a mess of things) we should, perhaps, clarify why nearly all attempts at regulating privacy, are likely to be complete disasters.

And I know that many people who advocate in favor of privacy issues are supportive of at least some aspects of these bills. And I completely understand where they're coming from. So let's set some parameters: privacy is incredibly important -- and it's something that is often undervalued by those services that collect other people's private information, and a failure to protect privacy can have massive, life-changing consequences. But, I believe that almost everyone is confused about what privacy really is. We've discussed this a few times before, but I think it's important to recognize that the more we fail to properly understand privacy, the more likely it is that every attempt to regulate it will fail badly, often creating significantly bad consequences that will do a lot more harm than good. That doesn't mean we shouldn't protect privacy, however, and towards the end of this post, I'll suggest a better path forward on that front.

The basic issue is this: privacy is not a "thing," it's a trade-off. Yet, nearly all attempts to regulate privacy treat it as a thing -- a thing that needs "protecting." As such, you automatically focus on regulating "how do we protect this thing" which generally means prohibitions on sharing information or data, or even being willing to delete that data. But, if we view privacy that way, we also lose out on all sorts of situations where someone could benefit greatly from sharing that data, without the downside risks. When I say privacy is a trade-off I mean it in the following way: almost everything we do can involve giving up some amount of private information -- but we often choose to do so because the trade-off is worthwhile.

For example, leaving my house to go grocery shopping involves a trade-off in privacy. Someone could see me and recognize me, and could figure out certain pieces of information about me: what I shop for, what I eat, perhaps generally where I live, and the fact that I'm not home at that moment. They might also be able to spot what kind of car I drive, or divine other information about me from the things that they see me buying. That's all "private" information that is in some way exposed. Now, for most of us, we consider this trade-off worth it. First of all, the potential downside risk is extremely low. We doubt most people would recognize or care who we are, and we doubt that anyone who does so would glean information from this that could be used abusively. Also, the benefits are pretty high (we get the stuff we need). There are scenarios under which that might change (for example, this is why many top celebrities don't do their own grocery shopping -- the privacy "cost" to them is much higher, and thus the trade-off equation is different).

When we move into the digital world, once again, the issue that many people have is that this trade-off equation is a lot more of a gray area, and it makes people uncomfortable. In the grocery example above, for most people it's an easy call: the benefits outweigh the costs by a very large measure. When we talk about online services, what makes some people nervous is that this isn't as clear. And it's unclear for a number of important reasons: the risk of abuse is not clear, so we don't have as good an understanding of the potential costs as doing something like grocery shopping. Similarly, many of the costs appear "hidden" in that online services aren't completely upfront about what data they're collecting on us and what they're doing with it. The benefits still seem to be there -- otherwise why would people be using these services so much? -- but the trade-off equation includes a lot of guesses and uncertainty.

On top of that, we've definitely seen a few cases of information abuse or misuse -- though most of that has been around data breaches, identity fraud or credit card fraud. But, the potential downsides seem much more serious.

And thus, when we're dealing with services online, we're left in a situation that has many people reasonably nervous. And it's not because our privacy is lost or being abused but that we don't have a good sense of the risk of such abuse and thus we can't accurately gauge the the cost side of the equation (we similarly may have more difficulty measuring the benefits side, but that's perhaps less of a big deal here).

When we regulate privacy as a "thing," rather than a "trade-off," however, we end up cutting off many possibilities where people would actually be perfectly happy to trade some information for some larger benefit. This leads to things like rules and restrictions on what kind of information companies can even ask to use in offering services. Even worse, it often leads to rules that give companies who are holding our data even greater control over that data, by including "responsibilities" that actually serve to increasing the power of the companies over the users.

But there are better ways of dealing with all of this, starting with recognizing the idea that privacy is a trade-off. If that's the case, there should be two key concepts for any competent approach to privacy: transparency and user control. As discussed above, many of the problems today (and nearly all of the concerns) are over the lack of transparency. This impacts both the cost and the benefit sides of the equation. If we don't understand what data is being collected or what it's being used for (or how it's being stored), along with what actual benefits we're getting, it's much, much more difficult to make an informed decision about whether or not the trade-off is worth it. And the issue of control is connected to that, in that the more control end users have over their own data, the more they're able to make informed choices in weighing the costs and benefits.

Now, much of the problem here comes from various companies themselves, who for a variety of reasons have decided it's better to have less transparency and less user control involved. Perhaps it's because they feel that if people know the actual costs and benefits, they'll decide it's not worth it. Perhaps it's because it's difficult to provide both the transparency and control that is necessary to make informed decisions. Perhaps they're afraid that transparency and control might also create unnecessary friction leading to poor choices. It's likely to be some combination of these along with multiple other factors as well.

However, when many of the regulatory aspects focus on the "requirements" for companies using data, it often serves to harm the abilities of users to actually control their data. Yes, it may create opportunities for users to delete all of their data as held by a service, but "delete/not delete" is a very crude level of control. A more ideal world might be one where users have a form of a "data bank" which they control, and where they know what data is in there. And, if they want to use a service, that service could explain what data it needs, why it needs that data, and for how long it would like to access it. Then, the user can make a more informed choice, better weighing the trade-offs, and decide whether it will allow access to the data for that purpose, or if it wishes to somehow offer an alternative agreement.

Unfortunately, very few of these "privacy regulations" move us towards such a world, where there is greater transparency and end-user control. Instead, they mostly focus on putting onerous and often extraneous and unnecessary requirements on services to better "protect" data. And, again, all that does is increase their power, limit competition and limit the ability of new services to appear that do provide more transparency and control.

So every time we see new stories about privacy regulations, think about whether or not they'd lead to a world in which end users have more control and more transparency, or if they really seem designed to just put up enough roadblocks that only the largest companies can handle them... and which will likely lock our data even more tightly within those giant entities.

Filed Under: control, cost-benefit, gdpr, privacy, regulating privacy, tradeoffs, transparency

Third Comcast Website Flaw Exposes User Data In As Many Months

from the it's-Comcastic dept

Comcast has been dinged for a third significant website privacy vulnerability in almost as many months. Back in May, a bug in Comcast's website used to activate the company's Xfinity-branded routers opened the door to letting attackers trick the website into displaying the home address where the router is located, as well as the Wi-Fi name and password. Then last June, security researchers discovered that an API used by Comcast could be tricked into returning a swath of private customer data, including account numbers, a user's account address, and numerous details about a user's account, including what services are subscribed to.

Comcast's now back in the news again, with BuzzFeed reporting that yet another security flaw in Comcast's website has potentially exposed customer information. Security researcher Ryan Stevenson (who also discovered the previous two vulnerabilities) found that two new, previously-unreported vulnerabilities exposed the the partial home addresses and Social Security numbers of more than 26.5 million Comcast customers.

One of the flaws let an attacker exploit an "in home authentication" portal set up by Comcast that let customers pay their bills without logging in. The portal asked users to verify their identity by showing them partial snippets of four potential home addresses. While this was designed to be convenient, it opened the door to a potential hacker spoofing a Comcast user's IP address to obtain sensitive data. Once alerted, Comcast fixed the vulnerability and required that users enter their cable and broadband credentials to pay their bills.

The other flaw was potentially more damning, since it exposed the last four digits of Comcast users' social security numbers:

"In the second vulnerability that Stevenson discovered, a sign-up page through the website for Comcast’s Authorized Dealers (sales agents stationed at non-Comcast retail locations) revealed the last four digits of customers’ Social Security numbers. Armed with just a customer’s billing address, a hacker could brute-force (in other words, repeatedly try random four-digit combinations until the correct combination is guessed) the last four digits of a customer’s Social Security number. Because the login page did not limit the number of attempts, hackers could use a program that runs until the correct Social Security number is inputted into the form."

Comcast, for its part, states that the vulnerabilities have been patched:

"We quickly investigated these issues and within hours we blocked both vulnerabilities, eliminating the ability to conduct the actions described by these researchers. We take our customers’ security very seriously, and we have no reason to believe these vulnerabilities were ever used against Comcast customers outside of the research described in this report."

Which is all well and good, but given the volume of sensitive data collected by telecom giants that also sell home phone service, wireless, security service, broadband, TV, and an ocean of other services, the number of website flaws in recent months remains troubling. Especially for a company that spent millions lobbying to kill FCC broadband privacy protections last year; protections that, among other things, required that ISPs be more transparent about what data is collected and sold, and quickly and transparently inform customers when their private data may have been improperly accessed.

Filed Under: flaws, passwords, privacy, security, xfinity
Companies: comcast

Verizon Launched A VPN Without Bothering To Write A Real Privacy Policy

from the whoops-a-daisy dept

As we've noted for a while, a VPN isn't some kind of magic bullet. While it might help you hide some of your online activity from snoopy governments, nosy ISPs, or a packet sniffing dudebro at the coffee shop, it's not some mystical panacea. Unfortunately, in the wake of seemingly endless privacy scandals and a federal apathy to any meaningful privacy rules of the road, many people have been flocking to VPNs without understanding that many VPNs are scams, poorly configured (making you less secure, not more), and that promises made about data retention are often hollow.

Ironically, many of the companies most responsible for our privacy problems have now jumped into the VPN business to capitalize on consumer worries they themselves helped create. Like Facebook, which, in the shadow of the Cambridge Analytica scandal, thought it might be a good idea to launch a VPN that pretends to protect consumers from online harm, but actually exists solely to track your behavior online when you're not visiting Facebook.

Verizon, fresh off of its successful efforts to kill net neutrality and FCC broadband privacy protections, also recently launched a new VPN service dubbed Safe WiFi. Safe WiFi, you'll be happy to learn, "protects your privacy and blocks ad-tracking." But when I began digging into Verizon's VPN for Motherboard, I found that the company had rushed the service to market so quickly, it failed to even write an actual privacy policy for the service. Instead, the company informed me it had simply copied a placeholder privacy policy lifted from McAfee, the company that actually built its VPN. According to this privacy policy, Verizon's VPN collects, well, pretty much everything:

"Details about your computers, devices, applications, and networks, including internet protocol (IP) address, cookie identifiers, mobile carrier, Bluetooth device IDs, mobile device ID, mobile advertising identifiers, MAC address, IMEI, Advertiser IDs, and other device identifiers that are automatically assigned to your computer or device when you access the Internet, browser type and language, language preferences, battery level, on/off status, geo-location information, hardware type, operating system, Internet service provider, pages that you visit before and after using the Services, the date and time of your visit, the amount of time you spend on each page, information about the links you click and pages you view within the Services, and other actions taken through use of the Services such as preferences."

When I pressed Verizon on how it could sell a "privacy and security" product that actively makes its users less private and secure, the company acknowledged that employees had simply copied the McAfee privacy policy and didn't bother to write one of its own for the product, something the company wasn't aware of until I brought it to their attention. That means that when you use Verizon's VPN, you have zero real assurance that they won't collect your data. Verizon, for its part, was quick to inform me that once it finishes actually writing a privacy policy, it will assure users that no private data is collected:

"We're working with McAfee to post their privacy policy specific to Safe WiFi and will send you a link as soon as it posts,” Verizon said, acknowledging that it wasn't aware of the problem until Motherboard “alerted us to this discrepancy." Whenever the actual privacy policy is posted, it will “reflect that fact that neither Verizon nor McAfee collects any personal data regarding users or use of the Safe WiFi VPN,” the company promises."

In the interim, you just apparently have to trust Verizon that it's not using the VPN to snoop on you. A sizable ask since, you'll recall, Verizon was busted in 2016 modifying wireless packets to track users around the internet without providing opt out tools or even informing anybody. The same company that just got done gutting FCC broadband privacy protections and is part of an industry that's the poster child for nontransparent and anti-consumer privacy practices.

There's a certain irony in Verizon trying to cash in on privacy worries it itself caused by rushing a VPN product to market so quickly -- it couldn't be bothered to include a real privacy policy for it. There might be a lesson in there somewhere. Meanwhile, if you do need a VPN, you're probably better off picking one of numerous options that don't have a several-decade history actively trying to undermine consumer privacy and real privacy guidelines.

Filed Under: privacy, trust, vpn
Companies: verizon