How We Can 'Free' Our Facebook Friends

from the data-portability-to-the-rescue dept

In the wake of the recent privacy controversy over Facebook and Cambridge Analytica, internet users and policymakers have had a lot of questions on the topic of “data portability”: Is my social network data really mine? Can I take it with me to another platform if I’m unhappy with Facebook? What does the new European privacy law, the General Data Protection Regulation (GDPR), demand in terms of my being able to export my data? What even counts as my data that I should be able to download or share, and as my friends’ data that I shouldn’t?

There’s a growing consensus that being able to easily move your data between social platforms, and perhaps even being able to communicate between different platforms, is necessary to promote competition online and enable new services to emerge. But that raises some difficult technical and policy questions about how to balance such portability and interoperability with your and your friends’ privacy interests—and how to guarantee that new privacy efforts don’t have the unintended consequence of locking in current platforms’ dominance by locking down their control over your data.

To investigate a potential path forward, New America’s Open Technology Institute partnered with Mozilla to host an event earlier this month, “A Deep Dive Into Data Portability: How Can We Enable Platform Competition and Protect Privacy at the Same Time.” It included a tutorial from OTI’s senior policy technologist Ross Schulman on the basic terminology and technologies at issue—for instance, distinguishing between “data portability” and “interoperability,” and explaining what the heck an “Application Programming Interface,” or “API,” is.

The event opened with a forceful keynote from David Cicilline, who’s a congressman for Rhode Island and the top Democrat on the House Judiciary Committee’s Antitrust Subcommittee. “We need pro-competitive policies that give power back to Americans in the form of more rights and greater control over their data,” Cicilline argued. “This starts by taking on walled gardens that block startups and other competitors from entering the market through high switching costs.”

Echoing a Wired op-ed he had previously co-authored, Cicilline highlighted how “[p]eople who may want to leave Facebook are less likely to do so if they aren’t able to seamlessly rebuild their network of contacts, photos, and other social graph data on a competing service or communicate across services.” Just as Congress gave cellphone users the right to “number portability”—lessening the switching cost of changing your cell carrier by giving you the ability to take your phone number with you—Cicilline argued that social network users should have the right to portability of their social media data. Unless we “free the social graph,” as one commentator put it, we may find ourselves locked into the current platform ecosystem with no chance of meaningful competitors emerging.

Importantly, Facebook has offered a feature called “Download Your Information” (DYI) since 2010. This lets users download all of the content they’ve ever posted on Facebook as a browsable HTML archive. (As described in our tech tutorial, other providers like Twitter and Google offer similar options.) However, Facebook’s download feature was originally designed as a personal archiving tool, rather than for easy porting of your data to another service. Indeed, when it was launched, Facebook clearly stated that "[t]his file and the information contained within it, is designed for an individual's use and not for developers or other services." That said, over the past couple of months, in response to both the Cambridge Analytica scandal and its data portability obligations under the GDPR, Facebook has revamped the DYI tool to be more portability-friendly. Most notably, Facebook now allows users to download their data in the structured JSON data format (see the tutorial for what that is!) instead of in unstructured HTML, making it much easier to move the data between different services.

But here comes the irony: The one thing you can’t download from Facebook is the one thing you’d most need if you wanted to move to a competing social network—your friends’ contact information, or any other unique information that would help you reconnect with them on another service. Instead, all you get is a list of their names, which isn’t very helpful for re-identifying specific individuals, considering how common many names are. Indeed, as was highlighted during the event, Facebook has long treated its possession of your friends’ contact information as a key competitive advantage, making it difficult for users to collect or export it.

For example, when users were first able to share an email address with friends on their profile page, it was displayed as a graphic rather than as text so that it couldn’t be cut and pasted. Some users may also recall when Facebook, in 2012, temporarily replaced users’ non-Facebook addresses with new “@facebook.com” addresses by default, making it harder to obtain off-Facebook contact information about your friends. And although there’s a hard-to-find setting where Facebook users can allow their friends to download their contact information, it is by default set not to allow such downloading—one of the rare Facebook settings that defaults away from, rather than toward, more sharing with friends.

Facebook has consistently justified its attempts to restrict sharing contact info as a privacy and security measure, but the alignment with its own business goals was always more than a little convenient. In addition, it’s also rather ironic, considering that a huge part of Facebook’s meteoric growth was driven by importing contact information from other services, especially Gmail (which led to a dispute between Google and Facebook back in 2010, when Google briefly cut off Facebook’s ability to access Google contacts over its API because Facebook wasn’t reciprocally allowing other services to access contact information on Facebook). Convenient and ironic or not, Facebook’s reticence to share contact information has only been bolstered by recent events: It was, of course, users’ ability to export data about their friends to outside apps that was at the root of the Cambridge Analytica scandal that has put Facebook in the privacy hot-seat. Meanwhile, thanks to GDPR’s privacy requirements, Facebook would now probably need to get affirmative consent from your friends before letting you export their email addresses, even if they arguably didn’t have to before.

There were no easy answers to this privacy-versus-portability conundrum coming out of our panel discussion. However, there were a few critical takeaways in terms of things that Facebook can and should do now to promote portability—and which are in its own interest to do, as it may face unwanted regulatory action if it doesn’t.

Help Set Clear Technical Standards. Easy portability of data between services will require open standards that everyone can use. Facebook’s offering downloadable data in the JSON file format is a good start, but it and other social networks should consider using the Activity Streams 2.0 open standard, a particular JSON-based format for exporting social media items. Facebook helped develop the standard at the World Wide Web Consortium, but right now only decentralized social network tools like Mastodon use it. On top of that, Facebook and all the other major cloud and social platforms should contribute to the open source Data Transfer Project, which aims to establish a common framework for easily moving data directly between services with just a few clicks and without having to download the data yourself. Google and Microsoft are already participating; others should, too.

Solve the Graph Portability Problem. Social platforms should allow you to export your friends’ contact information—or, if they can’t due to privacy restrictions, otherwise provide unique identifiers or other information sufficient to easily re-identify your friends on another platform. Your social graph is yours, and we need a standardized way to move that graph around. Some ideas that came out of the panel: Facebook could ask all users to give consent for their friends to export their contact information as part of Download Your Information—or at least give friends the power to ask each other for that permission. Or, Facebook could allow users to download some other unique piece of a friend’s data, like the URL of their profile or their unique Facebook user ID number. If that raises security concerns, the data could perhaps be “hashed” to obscure it while maintaining its usefulness as a unique identifier, as Josh Constine at TechCrunch has suggested. Facebook and others could maybe even petition the European Data Protection Board for an interpretation of the GDPR that would clearly allow such sharing for competition purposes. There are a range of possible solutions; the only certainty is that Facebook needs to start identifying and testing approaches now.

Allow Competitive Apps to Use the Facebook Platform. Data portability—letting someone download their data and transfer it elsewhere—isn’t the only way that people can leverage their Facebook data on another service. There’s also interoperability—the ability to use the Facebook Platform API to run an app that can make use of your Facebook data on an ongoing basis. The problem is that Facebook’s policy for app developers has long required that in order to make full use of the API, apps “must not replicate core Facebook features or functionality, and must not promote [their] other apps that do so.” For example, “your app is not eligible… if it contains its own in-app chat functionality or its own user generated feed” akin to Facebook’s messaging product or Facebook’s newsfeed. If Facebook doesn’t want to continue to be viewed by the public and by regulators as a platform monopolist, it needs to remove this anti-competitive provision and allow users to easily make use of their Facebook data on interoperable competing services.

Some of these steps would be easy for Facebook to take. Others would be more challenging. But all are worthwhile, and ultimately necessary, for ensuring an internet ecosystem that continues to be open, innovative, and competitive.

Reposted from New America's Weekly Newsletter.

Filed Under: competition, data portability, privacy
Companies: facebook

Yes, Privacy Is Important, But California's New Privacy Bill Is An Unmitigated Disaster In The Making

from the not-how-to-do-it dept

We've talked a little about the rush job to pass a California privacy bill -- the California Consumer Privacy Act of 2018 (CCPA) -- and a little about how California's silly ballot initiatives effort forced this mad dash. But a few people have asked us about the law itself and whether or not it's any good. Indeed, some people have assumed that so many lobbyists freaking out about the bill is actually a good sign. But, that is not the case. The bill is a disaster, and it's unclear if the fixes that are expected over the next year and a half will be able to do much to improve it.

First, let's state the obvious: protecting our privacy is important. But that does not mean that any random "privacy regulation" will be good. In a future post, I'll discuss why "regulating privacy" is a difficult task to tackle without massive negative consequences. Hell, over in the EU, they spent years debating the GDPR, and it's still been a disaster that will have a huge negative impact for years to come. But in California they rushed through a massive bill in seven days. A big part of the problem is that people don't really know what "privacy" is. What exactly do we need to keep private? Some stuff may be obvious, but much of it actually depends quite heavily on context.

But the CCPA takes an insanely broad view of what "personal info" is covered. Section 1798.140(o)(1) defines "personal information" to mean... almost anything:

“Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
(B) Any categories of personal information described in subdivision (e) of Section 1798.80.
(C) Characteristics of protected classifications under California or federal law.
(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E) Biometric information.
(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
(G) Geolocation data.
(H) Audio, electronic, visual, thermal, olfactory, or similar information.
(I) Professional or employment-related information.
(J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).
(K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

So, first off, note that it's not just associated with any individual, but also a "household." And, again, in the list above, there are lots of items and situations where it totally makes sense that that information should be considered "private." But... there are other cases where that might not be so obvious. Let's take "information regarding a consumer's interaction with an internet web site." Okay. Yes, you can see that there are reasonable privacy concerns around a company tracking everything you do on a website. But... that's also generally useful information for any website to have just to improve the user experience -- and basically every website has tended do some form of user tracking. It's not privacy violating -- it's just understanding how people use your website. So if I'm tracking how many people flow from the front page to an article page... now suddenly that's information impacted by this law. Perhaps the law is intended to mean tracking people on other websites through beacons and such... but the law appears to make no distinction between tracking people on your own website (a feature that's built into basically every webserver) and tracking people elsewhere.

Similarly, "preferences" is private information? Sure, on some sites and for some reasons that makes sense. But, I mean, we do things like let users set in their preferences whether or not they want to see ads on our site at all (in case you don't know, you can turn off ads on this site in the preferences, no questions asked). But... in order to make sure we don't show you ads, we kinda have to keep track of those preferences. Now, I think many of you will recognize that in removing ads, we're actually helping you protect your privacy. But under this law, we're now incentivized not to keep such preferences because doing so is now its own legal liability.

And that leads into the "costs" vs. the "benefits" of such a law. Again, lets be clear: many internet companies have been ridiculously lax in how they treat user data. That's a real problem that we don't, in any way, mean to diminish. But, the costs of this law seem very, very, very likely to outweigh a fairly minimal set of benefits. On the benefits side: yes, a few companies who have abused your data will face some pretty hefty fines for continuing to do so. That's potentially good. But the costs are going to be massive. For this part, I'll borrow from Eric Goldman's analysis of the bill, which is well worth reading. It's long, but he outlines just some of the likely "costs":

How Much Will This Cost? (part 1) Regulated companies–i.e., virtually every business in California–will need to spend money on compliance, including building new processes to deal with the various consumer requests/demands. Adding up all of the expenditures across the California economy, how much will this cost our society? It’s not like these expenditures come from some magic pot of money; the costs will be indirectly passed to consumers. Are consumers getting a good deal for these required expenditures?

How Much Will This Cost? (part 2) Lengthy statutes seem like they are detailed enough to eliminate ambiguity, but it actually works in reverse. The longer the statutes, the more words for litigators to fight over. This law would give us 10,000 different bases for lawsuits. One of the current tussles between the initiative and the bill is whether there is a private right of action. Right now, the bill attempts to limit the private causes of action to certain data breaches. If the private right of action expands beyond that, SEND YOUR KIDS TO LAW SCHOOL.

How Much Will This Cost? (part 3) The bill would create a new “Consumer Privacy Fund,” funded by a 20% take on data breach enforcement awards, to offset enforcement costs and judiciary costs. Yay for the bill drafters recognizing the government administration costs of a major new law like this. Usually, bill drafters assume a new law’s enforcement costs can be buried in existing budgets, but here, the bill drafters are (likely correctly) gearing up for litigation fiestas. But exactly how much will these administration costs be, and will this new fund be sufficient or have we written a blank check from the government coffers to fund enforcement? Most likely, I expect the Consumer Privacy Fund will spur enforcement, i.e., enforcement actions will be brought to replenish the fund to ensure it has enough money to pay the enforcers’ salaries–a perpetual motion machine.

Let's dig into that first part, because it's important. It's important to remind people that this bill is not an "internet" privacy bill. It's an everyone privacy bill. Any business that does business in California more or less is impacted (there are some limitations, but for a variety of reasons -- including vague terms in drafting -- those limitations may be effectively non-existent). So now, in order to comply, any company, including (for example!) a small blog like ours, will have to go through a fairly onerous process to even attempt to be in compliance (though, as point two in Eric's list above shows, even then we'll likely have no idea if we really are).

An analysis by Lothar Determann breaks out some of what we'd need to do to comply, including setting up entirely new processes to handle data access requests, including a system to verify identity and authorization of individuals, and ways of tracking requests and blocking the chance that anyone who opts out of certain practices is offered a chance to opt-back in. So... to use the example above, if someone sets a preference on our site not to see ads, but then makes a data privacy request that we not track that data, we then would likely need to first verify the person and that they are the one making the request, and then we'd need to set up a system to (get this!) make sure we somehow track them well enough so that they... um... can't "opt-in" to request that we no longer show them ads again.

Think about that. In order to stop letting someone opt out of ads on our site "for privacy purposes" we'd have to set up a system to track them to make sure that they aren't even offered the possibility of opting out of ads again. It's mind boggling. Also, this:

Consider alternative business models and web/mobile presences, including California-only sites and offerings, as suggested in Cal. Civ. Code §1798.135(b) and charges for formerly free services to address the complex and seemingly self-contradictory restrictions set forth in Cal. Civ. Code §1798.125 on a company's ability to impose service charges on California residents who object to alternate forms of data monetization.

Okay, so I'm all for businesses exploring alternative business models. It's what we talk about here all the time. But... requiring that by law? And, even requiring that we offer a special "California-only" site that we charge for?

I'm having difficulty seeing how that helps anyone's privacy. Instead, it seems like it's going to cost a ton. And... for limited to negative benefit in many cases. Just trying to figure out what this would cost us would mean we'd probably have to let go of multiple writers and spend that money on lawyers instead.

And that leaves out the cost to innovation in general. Again, this is not to slight the fact that abusive data practices are a real problem. But, under this law, it looks like internet sites that want to do any customization for users at all -- especially data-driven customization -- are going to be in trouble. And sure, some customization is annoying or creepy. But an awful lot of it is actually pretty damn useful.

An even larger fear: this could completely cut off more interesting services and business models coming down the road that actually would serve to give end users more control over their own data.

Also, as with the GDPR, there are serious First Amendment questions related to CCPA. A number of people have pointed out that the Supreme Court's ruling in Sorrell v. IMS Health certainly suggests some pretty serious constitutional defects with the CCPA. In Sorrell, the Supreme Court struck down a Vermont law that banned reporting on certain prescription practices of doctors as violating the First Amendment. It's possible that CCPA faces very similar problems. In an analysis by professor Jeff Kosseff, he explains how CCPA may run afoul of the Sorrell ruling:

CCPA is more expansive than the Vermont law in Sorrell, covering personal information across industries. Among its many requirements, CCPA requires companies to notify consumers of the sale of their personal information to third parties, and to opt out of the sale. However, CCPA exempts “third parties” from coverage if they agree in a contract to process the personal information only for the purposes specified by the company and do not sell the information. Although CCPA restricts a wider range of third-party activities than the Vermont statute, it still leaves the door open for some third parties to be excluded from the disclosure restrictions, provided that their contracts with companies are broadly written and they do not sell the data. For instance, imagine a contract that allows a data recipient to conduct a wide range of “analytics.” Because the recipient is not selling the data, the company might be able to disclose personal information to that recipient without honoring an opt-out request.

Under Sorrell, such distinctions might lead a court to conclude that CCPA imposes a content-based restriction on speech. Moreover, the findings and declarations section of the bill cites the revelations about Cambridge Analytica’s use of Facebook user data, and states “[a]s a result, our desire for privacy controls and transparency in data practices is heightened.” This could cause a court to conclude that the legislature was targeting a particular type of business arrangement when it passed CCPA.

I highly recommend reading the rest of Kosseff's analysis as well. He notes that he's generally in favor of many internet regulations -- and has been advocating for cybersecurity regulations and didn't think amending CDA 230 would be that bad (I think he's wrong on that... but...). And his analysis is that CCPA is so bad it cannot become law:

[M]y initial reaction was that nothing this unclear, burdensome, and constitutionally problematic could ever become law.

He then goes on to detail 10 separate serious issues under the law -- and notes that those are just his top 10 concerns.

While it's nice to see lots of people suddenly interested in privacy issues these days, the mad dash to "deal" with privacy through poorly thought out legislation where the target and intent is unclear other than "OHMYGOD INTERNET COMPANIES ARE DOING BAD STUFF!!!" isn't going to do any good at all. There is little in here that suggests real protection of privacy -- but plenty of costs that could significantly change the internet many of you know and love, in large part by making it nearly impossible for small businesses to operate online. And, frankly, ceding the internet to the largest providers who can deal with this doesn't exactly seem like a way to encourage smaller operations who actually are concerned about your privacy.

Filed Under: california, ccpa, free speech, gdpr, privacy, regulations

What Soda Taxes And Lead Paint Have To Do With Internet Regulation

from the public-policy-on-sale-now! dept

They say that laws are like sausages, and you should never watch either be made if you don't want to be sick. But some manufacturing processes are more disgusting than others, and if we don't want to suffer ill-effects, we need to keep an eye on the worst of them.

As others have discussed, the new California Consumer Privacy Act (CCPA) is at best a law with troubling aspects, if not completely chilling for future Internet businesses and even non-commercial online expression. True, there may be the opportunity to amend it before it goes into effect to dull the worst of it, but how we find ourselves in this position where we are stuck with a ticking time bomb of a law that we now need to fix is a story worth telling, because if it could happen once it could happen again. And already has.

Which is why I'm going to tell the story about how California just banned soda taxes (in fact, not coincidentally, right around the same time that it passed the CCPA).

To understand what happened, one first needs to understand a bit about the California Constitution. In addition to setting up the typical branches of government (legislative, executive, judicial), it also allows for a form of direct democracy through ballot initiatives. Ballot initiatives generally only need a simple majority to pass, but once passed, they can be very difficult, if not impossible, to un-pass or modify them without another ballot measure. Even when ballot measures only amend statutory code, and not the Constitution itself, the legislature can be prevented from making any modifications to that new language, no matter how necessary those changes may be, unless the ballot initiative allows the legislature to act. And even if the initiative does permit it, it may require a much more difficult to attain super-majority of the legislature to make any changes, rather than the simple majority typically required to pass legislation.

The upshot is that an awful lot of California law and policy can depend on the initiative process -- and thus a whole lot can depend on who is able to use it to push forth the policy they prefer. In one sense, it's hard to get a new initiative on the ballot: it requires hundreds of thousands of signatures to qualify. But it turns out that for people who have a lot of money, it's not all that hard. Some estimate that it may take only $3-4 million to acquire enough signatures to get any initiative on the ballot.

Of course, whether such an initiative would pass is a separate question, but there are a few factors that make the odds pretty good. One is that it's very difficult for the electorate to make informed choices, and I don't say that as any sort of insult to the average California voter. In the most recent election this past June I timed how long it took to figure out who and what to vote for and clocked it at a whole hour. And that's with me, a lawyer practiced in reading and evaluating law and policy, living in an unincorporated area of California, meaning that I was spared having to wade through any city candidate or ballot measure choices. I just had to vote on candidates for all county, state, and federal offices, and on all county and state ballot measures. And this was in June, where there were fewer choices all around than there will be in November, yet it still took an hour to make any sort of responsible decisions before I was prepared to head to the polls. Of course, not everyone has that hour, and for many it will likely take longer, which means that the electorate tends to be dependent on campaign advertising to help them make those choices. But if someone has a few million dollars to spend to get an initiative on the ballot, they may easily have a few more, or a lot more, to spend on that advertising, and their opponents, no matter how principled in their opposition, just as easily may not.

The reality is that anyone who can spend a few million dollars to get an initiative on the ballot can use that money to put an electoral gun to the head of policymakers and force them to legislate for their desired policy in exchange for withdrawing the initiative from the upcoming election. Because at least if the policy gets implemented via the legislature's hand, rather than through the initiative process, the legislature might be able to temper some of its language. Also, by being an ordinary bill, it would theoretically be more changeable in the future, subject only to ordinary legislative majorities and not dependent on someone funding a new initiative that could successfully override it.

As this article in the Sacramento Bee describes, the soda tax ban is a case study of this dynamic. A business group wrote a proposal that would have created some significant limitations in the state's ability to raise revenue. It then shopped around the proposed initiative until it found someone willing to underwrite the signature-gathering necessary to get it on the ballot. That someone turned out to be the beverage industry, which generally hates soda taxes.

The relative merits of soda taxes are beyond the scope of this post. Suffice it to say, certain California communities like them, often as a way of raising revenue for public health programs and deterring the over-consumption of unhealthy drinks. Several of these communities have already passed a few such taxes.

But after the beverage industry underwrote the effort to get enough signatures to qualify the tax-limiting initiative for the ballot, an initiative that did more than just ban soda taxes but instead affected the state's taxation ability more broadly, the legislature found itself having to play electoral roulette: perhaps the ballot measure might fail and everything would be fine, but if it passed, it risked messing up the fiscal health of the state and all the policies and programs the legislature wanted to fund. So it capitulated and did a deal with the initiative's sponsor to bar any other California communities from passing their own soda taxes for the next 12 years in exchange for having the ballot initiative withdrawn.

In fact, June was a busy month for legislative capitulation, because right around the same time that the legislature did that deal it also did a deal with the sponsors of the "Consumer Right to Privacy Act of 2018" initiative that had also qualified for the November ballot.* Because that initiative, if it passed, would definitely cripple the Internet, the legislature instead agreed to pass the CCPA, which will only probably cripple it, but at least has the potential for improvement.

And that's what this post is really about, this extortionate ability for basically anyone with $4 million to spend to blackmail the legislature to set aside its own legislative judgment and build into California law whatever terrible policy the person with the money wants. Sure, for any policy that is so awful or unpopular there's always the chance that it might lose at the polls come Election Day, and from time to time ballot initiatives do get shot down. But it's very easy for garbage to get through, and wealthy minority voices count on that possibility when they try to ram through all sorts of policies that aren't necessarily good ones for Californians or its businesses – including on matters of tech policy.

On our best days these tech policy challenges require careful, nuanced treatment. We should look to the legislature, and legislators, to give it that careful, nuanced treatment before imposing drastic changes in the law that will affect them. But they can't give these regulatory proposals that sort of necessary attention they deserve if for a mere $4 million or so people can force them to rush through law that has been drafted without any of the care or necessary transparency sound regulation requires.

And when they are forced to pass a law like that, as they were just now with the CCPA, it is unlikely to be something we should cheer.

* Also, per the Los Angeles Times article linked above, "A third proposal, asking taxpayers to subsidize lead paint cleanup projects, was withdrawn by paint companies in exchange for lawmakers scrapping a slate of bills designed to impose new rules on the industry."

Filed Under: ballot measures, california, democracy, intermediary liability, lead paint, moral panic, privacy, regulations, soda tax

Threats To Pull Database Access Increasing Misuse Reporting By Cali Law Enforcement Agencies

from the still-more-to-be-done,-unfortunately dept

Who polices the police? They can't be trusted to do it themselves. This much has been proven time and time again as misconduct and criminal behavior is greeted with minimal discipline or graceful exits that allow bad apples to move from barrel to barrel spreading rot.

What oversight actually exists tends to be beholden to law enforcement. In a few cases, truly independent oversight boards are in place, but their efforts are blunted by agencies that rarely hand out the punishment boards recommend or otherwise do everything they can to ensure this oversight is starved for information.

In California -- much like in other states -- abuse of law enforcement databases remains a problem. The EFF has been focusing on this state's efforts to curb abuse, raising it above the zero effort previously expended. This is, unfortunately, possibly one of the better years on record in California, and it still looks like this:

The records obtained by EFF show a total of 143 violations of database rules—the equivalent of an invasion of privacy every two and half days.

These numbers represent the first comprehensive accounting of misuse of the California Law Enforcement Telecommunications System (CLETS). While the acronym is not well known by the public, everyone with a driver’s license or criminal record has information accessible through CLETS. Police and other public safety employees access this sensitive information approximately 2.8 million times a day during the regular course of business.

The EFF's efforts led to a reform effort by the state's Attorney General. New rules were handed down by the California DOJ mandating reporting on misuse of law enforcement databases. The AG swore to "proactively enforce this requirement," and it appears to be having a positive effect.

In 2017, only 704 agencies disclosed these records—approximately 53% compliance. Following an overhaul of the oversight system, in 2018 the Attorney General gathered information from 1,285 agencies—98 percent compliance.

The teeth in the mandate are linked to database access. Failure to comply means revoked access department-wide. Local law enforcement officials aren't going to want to have to hold press conferences explaining their inability to close investigations or whatever because their database access has been severed for refusing to report misuse.

But that's not the end of the line for the state AG. Compliance is way up, but there appears to be some under-reporting occurring. The EFF reports the LAPD -- which has blown off reporting for years -- finally started turning in numbers, but the reporting is beyond belief. The LAPD claims it only had to investigate misuse three times in 2017. This means one of two things: the LAPD's employees are among the finest and most honest in the United States, or lots of misuse is going un-investigated or unreported.

The AG needs to follow up with agencies to ensure the reported numbers are accurate and that investigations are prompt and thorough. Otherwise, it will be tempting for agencies to just hand in their homework every year without making any real changes to discourage misuse of law enforcement databases.

Filed Under: california, clets, database, law enforcement, privacy

Over 60 Organizations Want Sanctions For EU Nations' Failure To Repeal 'Invalid' Data Retention Laws

from the attacking-the-data-retention-zombie dept

We recently wrote about a slight setback in the fight against mass surveillance in Europe. But in general, there have been some good decisions in this field by the EU's top court. In 2014, the Court of Justice of the European Union (CJEU) ruled that the region's Data Retention Directive was "invalid", in what is generally known as the "Digital Rights Ireland" case. In 2016, the CJEU took a similarly dim view of the UK's Data Retention and Investigatory Powers Bill (DRIPA), in the "Tele-2/Watson" judgment. Under EU law, those decisions had to be implemented by all the EU Member States. But a report by Privacy International published in September last year showed that compliance has been dismal (pdf):

in an alarmingly large number of Member States (roughly 40% of all countries surveyed in this report) the pre-Digital Rights Ireland regime transposing Directive 2006/24 is still in place.

That is, the national laws that implemented the Data Retention Directive had not been repealed, despite the CJEU's ruling that they were invalid, nor had new legislation been passed. The research also showed something interesting about the other countries that had repealed or amended their data retention laws:

What has emerged from our analysis is that as a rule of thumb repeal or amendments to data retention legislation have mainly occurred as a result of challenges in national courts, predominately by human rights NGOs, while Governments and legislators have been largely inactive.

In other words, governments have to be kicked into doing something, otherwise they just ignore the CJEU's ruling. Based on that fact, dozens of NGOs, community networks, academics and activists have decided to increase the pressure on Member States that are slacking:

60 organisations, community networks and academics in 19 EU Member States are sharing their concerns to the European Commission, to demand action, and to stand for the protection of fundamental rights enshrined in Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union, as interpreted by the Grand Chamber of the CJEU. We call for the application of sanctions for non-compliant Member States by referring to the CJEU, which should logically strike down all current data retention national frameworks.

As the dedicated web site stopdataretention.eu indicates, there are now over 60 organizations backing the move and signatories to the formal letter of complaint sent to the European Commission (pdf). Given the CJEU's clear ruling against the earlier data retention frameworks, it seems likely that it will also strike down the national implementations of them. Whether the European Commission will send these cases to the CJEU, and how long it will take if it decides to do so, is less clear. If nothing else, the latest move underlines just how important it is for digital rights organizations to keep up the pressure -- and how hard it is to kill off bad EU laws once they are passed.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cjeu, data retention, eu, privacy

NSA Extends Its Streak Of Surveillance Violations To Fourteen Years With Its Latest Announcement

from the let's-hear-it-for-the-good-guys! dept

There isn't a surveillance program or authority the NSA hasn't abused and yet it's still humming along, hoovering up data and communications while mostly useless Congress folks pretend to be in the oversight business. Section 702, the "about" program, Section 215… all of these have received judicial smackdowns and the occasional Congressional nastygram, but the only thing that's changed is the NSA's willingness to admit its failures.

Consistent with NSA’s core values of respect for the law, accountability, integrity, and transparency we are making public notice that on May 23, 2018, NSA began deleting all call detail records (CDRs) acquired since 2015 under Title V of the Foreign Intelligence Surveillance Act (FISA).

2015 would be the date the control of phone records shifted back to phone companies and the FISA court began demanding articulable suspicion for specific targets before the NSA could even ask phone companies for records. Prior to that, the NSA had collected phone records from telcos in bulk, using its internal tools to limit itself to targeted searches of compiled haystacks. The USA Freedom Act effectively ended this part of the Section 215 program, forcing the NSA to target first and ask for only records related to its targets.

Apparently, it can't even do this right.

NSA is deleting the CDRs because several months ago NSA analysts noted technical irregularities in some data received from telecommunications service providers. These irregularities also resulted in the production to NSA of some CDRs that NSA was not authorized to receive. Because it was infeasible to identify and isolate properly produced data, NSA concluded that it should not use any of the CDRs. Consequently, NSA, in consultation with the Department of Justice and the Office of the Director of National Intelligence, decided that the appropriate course of action was to delete all CDRs.

Whatever was broken on the tech end is now apparently fixed. All oversight has been notified and the collection of records (via telcos) will continue. I guess our three-year national nightmare is over and the NSA is finally on the road to recov---

Last year, I did a report that catalogued all the times NSA had violated FISA since the Stellar Wind phone dragnet got moved under FISA in 2004. There were the five different practices deemed violations of 1809(a)(2), which prohibits the use of any data that was illegally collected.

[...]

In addition to those, NSA had continued to conduct back door searches of data collected using upstream 702 collection even after John Bates prohibited the practice in 2011.

[...]

While Rosemary Collyer (who is the worst presiding FISA Judge ever) didn’t deem that a violation of 1809(a)(2) — meaning NSA didn’t have to segregate and destroy andy data collected improperly — it still violated the minimization procedures that control 702 collection.

So between 2004 and 2016, NSA was always breaking the rules of FISA in one way or another.

And we can now extend that timeline to 2018.

Thanks, Marcy Wheeler, for clearing that up. This is just a continuance of the NSA's inability to run its programs in a technically-capable manner, much less with an eye on the Constitution. Muted applause for taking this oversight before the few members who give a shit start asking questions, but why aren't we (and by "we," I mean the people who could actually do something about it) expecting more from an well-funded agency with vast technical knowledge? Sure, an apology is better than a plausible denial, but it's been 14 years of failure after failure. Where's the improvement? Or is national security just one of those things that's too important to be done properly? We just need to have it done, no matter how many violations occur in the process? I fear that's how most of the NSA's oversight actually feels: the ends justify the badly-broken means.

Filed Under: 4th amendment, call records, failures, nsa, privacy, section 215, surveillance, usa freedom act

Lobbyists Descend On California To Shape A Rushed New Privacy Law

from the if-at-first-you-don't-succeed dept

Last year, the GOP and Trump administration used the Congressional Review Act to dismantle FCC consumer broadband privacy protections before they could take effect last March. While AT&T and Comcast whined incessantly about the rules, the FCC's guidelines were relatively modest; they required that ISPs and mobile carriers be transparent about what data is being collected and sold, and get express consumer opt-in consent before ISPs can share more private financial or location data. Such rules could have gone a long way in protecting consumers in the wake of the recent Securus and Locationsmart location data scandals.

Following the ISP-funded attack on FCC authority and consumer protections, states have begun exploring their own privacy protections (mirroring what we're also seeing on the net neutrality front). For example, California last year considered passing a state-level copy of the FCC's gutted privacy rules. But those efforts hit a political brick wall thanks to the collective lobbying muscle of Comcast, Verizon, AT&T, Google and Facebook, which killed that effort by lying repeatedly about what the proposal actually did, including claims the proposal would "aid extremism."

Verizon and Facebook both pretended to back away from those attacks once their efforts gained press exposure, but those promises don't appear to be worth much.

In the wake of the successful attack on FCC privacy rules, California privacy advocates have been pushing a new ballot initiative, this time dubbed the California Consumer Privacy Act of 2018. The initiative would require that companies be fully transparent about what data is being collected and sold (and to whom), as well as mandating mandatory opt-out tools. The proposal goes further than the FCC's discarded rules, in that it would ban ISPs from trying to charge consumers more for privacy, something that has already been previously implemented by AT&T and considered by Comcast.

The new initiative is scheduled to appear on this November's ballot, and Google, Facebook, and large ISPs are once again working in concert to ensure that doesn't happen ahead of a looming Thursday afternoon deadline. They're collectively now pushing for quickly-hacked together "compromise legislation," AB 375, they're hoping will be significantly weaker than the looming November ballot initiative.

"In addition to Facebook, Google, AT&T, Microsoft, Amazon, Verizon, and the California New Car Dealers Association have each contributed six figure donations to the Chamber account set up to defeat CCPA. Uber, the Data & Marketing Association, Cox Communications, and the Interactive Advertising Bureau have each contributed $50,000 to the account, according to disclosures."

Recall, Facebook recently made a big show earlier this year about how it wouldn't be working to undermine such privacy proposals in the wake of the Cambridge scandal:

"The inclusion of a Facebook representative is notable, given the company’s well-publicized announcement earlier this year that it would end its opposition to the initiative. In February, the company provided $200,000 to an account set up by the California Chamber of Commerce designed to defeat the CCPA initiative. But in April, following revelations about the extent to which British consulting firm Cambridge Analytica provided the Donald Trump campaign with illicit access to Facebook user data, Facebook announced that it would withdraw its opposition to CCPA and not provide additional funding to the Chamber account."

As the GDPR clearly illustrates, there's some real peril in pushing through solutions before ironing out all of the potential pitfalls. Both the scotch-taped together AB 375 and the California Consumer Privacy Act (a pet side project of San Francisco real estate developer Alastair Mactaggart) have some notable problems that would have been aided by a longer, more transparent and inclusive discussion. Though the problems with AB 375 (which, again, if passed would eliminate the latter from contention) are notably worse, in large part because the bill was quickly cobbled together in just under a week behind closed doors:

"By tomorrow, the California legislature likely will pass a sweeping, lengthy, overly-complicated, and poorly-constructed privacy law that will have ripple effects throughout the world. While not quite as comprehensive as the GDPR, it copies some aspects of the GDPR and will squarely impact every Internet service in California (some of whom may be not currently be complying GDPR due to their US-only operations). The GDPR took 4 years to develop; in contrast, the California legislature will spend a grand total of 7 days working on this major bill."

Not only was AB 375 a rush job, the bill has been steadily eroded since introduction by this super group of telecom and Silicon Valley lobbying giants. AB 375 just passed out of the out of the Senate Judiciary Committee, meaning it's most likely going to be the California privacy proposal of choice. And the fact that it's a rush job is not apparently of much concern to the bill's backer:

"Assemblyman Ed Chau, an Arcadia Democrat and the chief bill author, said he doesn't like the rushed process forced by the ballot measure deadline, but he stressed that his bill gives Californians important privacy protections."

With that mindset, it's easy to wind up with a privacy law that sounds good ("look ma, I "fixed" privacy!") but doesn't actually do anything. And when you've got lobbyists from AT&T, Comcast, Verizon, Facebook, Google, Amazon and Microsoft disproportionally dictating the overall trajectory of the law, the chances that you're going to end up with weak-kneed "privacy rules" in name only is pretty monumental. Adding speed for speed's sake -- combined with an overall lack of transparency -- only adds to the potential that the rules you end up with are toothless or packed with unintended consequences.

That said, doing nothing isn't an option. This isn't a problem that magically fixes itself.

Modern consumer privacy oversight in the internet-era currently consists of little more than pinky swears and winks, a point driven home repeatedly by the Cambridge, LocationSmart and Securus scandals. We need to have a lengthy, transparent, adult conversation about what a potential solution might look like. The problem is that the larger companies dictating the conversation have an absolutely abysmal track record on these issues, so while they may have valuable insight on the complicated scope of a particular proposal's impact, they've managed, repeatedly, to shoot their credibility squarely in the foot on this subject.

And while ISPs and Silicon Valley giants like to go on at length about how they're "open to having a conversation" about more meaningful privacy guidelines, the reality is that most of these larger companies simply aren't. Any rules worth their salt will cost them money, since an informed, empowered consumer is more likely to opt-out of data monetization schemes, whatever they look like. As a result, you'll be hard-pressed to find many large ISPs or Silicon Valley giants willing to back truly tough consumer protections, especially rules than mandate express, opt-in consumer consent for things like location or financial data.

Eventually, after we've suffered through a few more hacks, breaches and major scandals, some of these companies may shift their thinking toward the idea that compliance with quality, even-handed rules is more profitable than chaos. But as the ham fisted repeal of the FCC privacy rules makes clear, we're nowhere near that point yet. Meanwhile, on the federal level, the Trump administration is rumored to be considering a broad new privacy plan. And if the administration's equally heavy-handed net neutrality repeal is any indication, objectivity, hard data and transparency aren't likely to have much of a seat at the table there, either.

Filed Under: california, gdpr, laws, lobbyists, privacy, rush, transparency
Companies: at&t, comcast, facebook, google

Supreme Court Says Warrants Are Needed For Cell Site Location Info

from the 4th-Amendment-Bonus-Content! dept

The Supreme Court -- in a narrow decision (both in scope and votes) -- has restored a little more of the Fourth Amendment. The long-awaited decision [PDF] in the Carpenter case has been released and the Supreme Court finds, in a 5-4 decision, that cell site location info (CSLI) is technically a third-party record but worthy of the Fourth Amendment's protection.

The defendant challenged the government's warrantless acquisition of 127 days of CSLI, arguing that the constant location records generated (without proactive assistance from phone users) by cell providers raised enough of a privacy issue the Fourth Amendment was implicated. Somewhat surprisingly -- given the long history of expansive readings of the Third Party Doctrine -- the Supreme Court agrees.

[W]hile the third-party doctrine applies to telephone numbers and bank records, it is not clear whether its logic extends to the qualitatively different category of cell-site records. After all, when Smith was decided in 1979, few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person’s movements.

We decline to extend Smith and Miller to cover these novel circumstances. Given the unique nature of cell phone location records, the fact that the information is held by a third party does not by itself overcome the user’s claim to Fourth Amendment protection. Whether the Government employs its own surveillance technology as in Jones or leverages the technology of a wireless carrier, we hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI. The location information obtained from Carpenter’s wireless carriers was the product of a search.

The court notes simply venturing out into the public does not erase all privacy expectations. The pervasive tracking engaged in by phone companies for business reasons should not undo a person's reasonable expectation of privacy. While the government tried to compare it to tracking vehicles with GPS devices, the court notes that cars cannot go everywhere people go. Long-term tracking -- made possible by provider recordkeeping -- provides the government with detailed depictions of cellphone users' lives. And all of this was -- up until this decision -- only a subpoena away.

[H]istorical cell-site records present even greater privacy concerns than the GPS monitoring of a vehicle we considered in Jones. Unlike the bugged container in Knotts or the car in Jones, a cell phone—almost a “feature of human anatomy,” Riley, 573 U. S., at ___ (slip op., at 9)—tracks nearly exactly the movements of its owner. While individuals regularly leave their vehicles, they compulsively carry cell phones with them all the time. A cell phone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, political headquarters, and other potentially revealing locales.

[...]

Accordingly, when the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.

The ubiquity of cellphones has changed the Third Party Doctrine dynamic. The court isn't willing to give the government warrant-free access to the personal lives of millions of Americans.

Critically, because location information is continually logged for all of the 400 million devices in the United States—not just those belonging to persons who might happen to come under investigation— this newfound tracking capacity runs against everyone. Unlike with the GPS device in Jones, police need not even know in advance whether they want to follow a particular individual, or when.

That's the substance of the decision, but the whole thing is worth reading in full. Even the dissents are worth a read, if only to see how many justices would prefer the government treat long-term tracking as no different than bank records people voluntarily create with every transaction. The court will extend the Third Party Doctrine to cover historical CSLI. However, it does not extend that coverage to cover tower dumps, real-time CSLI (ping orders/Stingray use) or any other records otherwise covered by the Third Party doctrine. But this is still a significant Fourth Amendment win -- and law enforcement agencies using CSLI subpoenas to cover Stingray use will now need to craft warrant requests specifying what they're doing, which will make just a little bit tougher to engage in parallel construction.

More than half the page total is given over to the dissent. Justices Kennedy and Alito have written separate dissents that say pretty much the same thing:

1. The records were obtained from a third party so no warrant should ever be needed.

2. This will law enforcement's work more difficult.

Even if the latter is true, Constitutional protections protect the citizens from their government. If they're an obstacle, they're meant to be. The court isn't there to ensure easy government access. It's there to act as a check against any government overreach it observes.

Justice Thomas' dissent is perhaps the most infuriating read. Much like his dissent in other law enforcement-related cases, Thomas sides with the government while claiming he's siding with the Constitution. His main argument here is that the Fourth Amendment says nothing about privacy or reasonable expectations, therefore the court's decision is wrong. It guards people and papers, not stuff obtained from third parties, no matter how invasive these records can potentially be.

Justice Gorsuch's dissent, however, is an entertaining read. It's really not even a dissent. He agrees with the majority's decision but doesn't think it goes far enough. If Gorsuch had his way, he would also return to a more originalist view of the Fourth Amendment -- the property rights theory he pitched during oral arguments. But unlike Thomas, his would eliminate the court-erected Third Party Doctrine and grant privacy to records created by customers/users and held by third parties. These decisions (Smith, Miller, Katz) would instead be replaced with a property-based treatment of records, giving customers/users more ownership rights to third-party records they create, making them part of the "houses and papers" Fourth Amendment interpretation even if the the "papers" are held by others.

I cannot fault the Sixth Circuit for holding that Smith and Miller extinguish any Katz-based Fourth Amendment interest in third party cell-site data. That is the plain effect of their categorical holdings. Nor can I fault the Court today for its implicit but unmistakable conclusion that the rationale of Smith and Miller is wrong; indeed, I agree with that. The Sixth Circuit was powerless to say so, but this Court can and should. At the same time, I do not agree with the Court’s decision today to keep Smith and Miller on life support and supplement them with a new and multilayered inquiry that seems to be only Katz-squared. Returning there, I worry, promises more trouble than help. Instead, I would look to a more traditional Fourth Amendment approach. Even if Katz may still supply one way to prove a Fourth Amendment interest, it has never been the only way. Neglecting more traditional approaches may mean failing to vindicate the full protections of the Fourth Amendment.

This is a big ruling and it will definitely affect how law enforcement approaches investigations. It will not be well-received by those used to tracking people via subpoena (rather than tail cars and surveillance teams). But it likely won't do much for Carpenter, who will almost certainly find good faith awarded to law enforcement's acquisition of his CSLI records. It will help going forward, but Carpenter will not be a beneficiary.

Filed Under: 3rd party doctrine, 4th amendment, carpenter, csli, location info, privacy, scotus, supreme court

Wireless Carriers Hope You Won't Notice Their Location Data Scandal Makes The Facebook, Cambridge Fracas Look Like Amateur Hour

from the ill-communication dept

When the Facebook, Cambridge Analytica scandal broke, we noted that however bad you thought that scandal was (and it certainly was bad), it couldn't hold a candle to the routine privacy abuses that have occurred in the telecom sector for the better part of the last few decades. From charging consumers hundreds of additional dollars annually to opt out of snoopvertising, to the use of private user financial data to justify providing even worse customer service, the broadband industry has long been the poster child for privacy abuses without much in the way of practical public penalty.

It's just as bad on the wireless side, where carriers like Verizon have routinely have been caught modifying user data packets to track users around the internet (without telling them or providing opt out tools), and selling user browsing, app-usage and location data to everyone that comes calling. That's before you even touch on the fact that these companies are practically bone grafted to the NSA and other intelligence services.

As such, we noted how if you were part of the #DeleteFacebook set but were still rolling around using a stock phone on an incumbent carrier network, you failed to understand that Facebook's casual treatment of private consumer data was the cross-industry norm, not some errant exception.

The Location Smart and Securus scandals (which exposed the data of 200 million cell users) quickly proved our point. Thanks to lax handling of private location data by cellular carriers and third-party brokers, those scandals quickly highlighted how anonymized data isn't really anonymous, and this data can and is routinely abused by everybody in this chain of dysfunction (including law enforcement). Oddly, even in the wake of those reports, people still seemed to view the Cambridge, Facebook fracas as somehow far more scandalous, most likely because of that particular story's political undertones.

Clearly hoping to get ahead of the scandal before the press, public and regulators realized the depths of this particular rabbit hole, Verizon proclaimed that the company would be ending all sales of location data to third party data brokers. The company announced the decision (pdf) in a letter responding to inquiries by Senator Ron Wyden, who had begun to apply some pressure on mobile carriers. From the letter:

"We conducted a comprehensive review of our location aggregator program. As a result of this review, we are initiating a process to terminate our existing agreements for the location aggregator program. We will not enter into new location aggregation arrangements unless and until we are comfortable that we can adequately protect our customers’ location data through technological advancements and/or other practices."

Verizon announced it would be suspending all data sales to location data brokers like LocationSmart and Zumigo, which the company acknowledged sold that data in turn to a roster of more than 75 different companies. And, in short, it's promising to suspend such data sales at least until it can ensure that data is actually secure (what an incredibly novel idea). Who'll actually confirm this data is secure before the program is restarted isn't clear; you'll apparently just have to trust a company with a several-decades history of severe privacy violations and blatant false statements.

Like the Facebook scandal, there wasn't much in place to really ensure that often real-time data remained protected, something made clear when the LocationSmart scandal revealed that one Missouri Sheriff routinely (ab)used the system to spy on Judges and fellow law enforcement officers without much legitimate justification (or pesky warrants). In subsequent statements to the press, Verizon has tried to argue that the company quickly took steps to thwart the abuse:

"When these issues were brought to our attention, we took immediate steps to stop it. Customer privacy and security remain a top priority for our customers and our company. We stand-by that commitment to our customers."

But again, this was Verizon only acting after the horses escaped from the barn, suggesting that no, privacy and security was not a top priority. If Verizon's self-auditing was so stellar, it seems curious it never self-identified the potential for the kind of abuse the LocationSmart and Securus scandals revealed. Or the self-audits did reveal problems, but the money made from selling this data made actually fixing them a low priority. Knowing Verizon pretty well, it seems clear it wouldn't be taking this kind of financial hit if its lawyers didn't realize the company was potentially facing some pretty steep penalties here.

One of the key problems in location and other data sharing is that wireless cell carriers have found a way to effectively operate outside any meaningful privacy guidelines by perpetually passing the onus for user consent down a long line of location data aggregators. Blake Reid, an associate clinical professor at the University of Colorado School of Law, perfectly captures the problem in comments made to Brian Krebs:

"The carriers basically have arrangements with these location aggregators that contractually say, ‘You agree not to use this access we provide you without getting customer consent’,” Reid said. “Then that aggregator has a relationship with another aggregator, and so on. So what we then have is this long chain of trust where no one has ever consented to the provision of the location information, and yet it ends up getting disclosed anyhow."

Verizon's obviously trying to pre-empt privacy regulation before we collectively realize current oversight makes the wild west seem downright domesticated. The company has long fought tooth and nail against any kind of consumer privacy protections, stating back in 2008 that federal privacy rules aren't necessary because "public shame" would keep the company honest. More recently, Verizon successfully lobbied the FCC to kill modest broadband privacy rules that would have prevented precisely this kind of scandal from happening by requiring greater transparency -- and that users opt-in to more sensitive data sharing.

None of that is to say that regulatory action is the only solution here, or that this particular Congress could even accomplish such a task. But it's also pretty clear that sooner or later, the pinky swears and winks currently passing for oversight of the telecom sector's treatment of your private data aren't going to quite cut it.

Shortly after Verizon's announcement AT&T stated that it too had suspended location data sales to third-party brokers (for all the same reasons). Sprint followed suit. T-Mobile, which cultivates a reputation as a more consumer-friendly wireless carrier, belatedly brought up the rear, initially likely wary of highlighting any missteps as it seeks regulatory approval for its looming competition eroding megamerger. But again, most of these promises were somewhat murky in scope (T-Mobile's promise to improve, for example, was entirely devoid of substance and somehow never reached Wyden's office).

With this data having bounced around so many partners with so little transparency or oversight, you can be pretty sure we haven't heard the end of this story. And while wireless carriers would very much like the public and press to believe that they've fixed the privacy problems that plague the telecom sector, several decades of evidence to the contrary -- and the press and public's general tone deafness to the scope of this particular problem -- suggest any meaningful reckoning is still likely some time away.

Filed Under: data, data brokers, privacy, wireless carriers
Companies: at&t, cambridge analytica, sprint, t-mobile, verizon

Think The GDPR Only Regulates Big Internet Companies? The EU Says It Regulates You Too.

from the another-threat-to-democratized-speech dept

People tend to think of the GDPR as regulation companies must comply with. But thanks to a decision by the Court of Appeals for the EU earlier this month, there's particular reason to believe that ordinary Internet users will need to worry about complying with it as well.

In this decision the court found that the administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of its visitors' data. And, as such, the administrator must comply with applicable data processing regulations – which necessarily include the GDPR.

The fan page at issue in this case appears to be run by some sort of enterprise, "Wirtschaftsakademie." But fan pages aren't always run by companies: as the court acknowledges, they are often run by individuals or small groups of individuals. Yet there doesn't appear to be anything in the ruling that would exempt them from its holding. Indeed, the court recognizes that its decision would inherently apply to them:

Fan pages are user accounts that can be set up on Facebook by individuals or businesses. To do so, the author of the fan page, after registering with Facebook, can use the platform designed by Facebook to introduce himself to the users of that social network and to persons visiting the fan page, and to post any kind of communication in the media and opinion market user data a processor of the data for visitors to its page, and thus jointly responsible with Facebook for its handling.

The problem is, compliance with data protection regulations like the GDPR is no simple matter. In fact, as this article suggests, the decision also potentially makes it even more complicated and expensive by expanding the jurisdiction of individual member states' data protection authorities (which was something that EU-wide regulation like the GDPR was actually supposed to minimize).

[Eduardo] Ustaran expressed concern in his 2017 post about the potential for local DPAs’ authority to issue decisions that affect companies located in other areas, in this case, Facebook, whose EU representative is in Ireland. He says that this goes against the letter of GDPR’s one-stop shop goal.

But even without this change to the GDPR's enforcement operation, the burdens of compliance were already a matter of concern. As discussed previously, compliance with the GDPR is difficult and expensive for even well-resourced companies. It's not something that individual Internet users are going to be able to easily manage, and that's a problem, because who would want to set up a Facebook fan page if doing so opened yourself up to such a crippling compliance burden?

Which leads to the essential problem here. Some cheer the GDPR because it puts user privacy front and center as a policy priority. In and of itself, there's nothing wrong with doing so – in fact, it's an idea whose time has come. But it doesn't matter how well-intentioned a law is if instead of merely regulating otherwise lawful activity it ends up suppressing it. And it's especially problematic when that activity is expressive. Even if chilling expression weren't the intent, if that's the effect, then there is something wrong with the regulation.

Furthermore, while it's bad enough if regulation chills the expressive activity of those well-resourced companies better able to navigate complex and costly compliance requirements, it's even worse if it chills the lawful and even desirable expressive activity of ordinary individuals. One of the things an Internet platform like Facebook does, and does well, is encourage the casual expression of ordinary people. If you have things to say, these platforms make it easy to say them to other people without you needing to invest in corporate structure or technical infrastructure before doing so. These are tools that help democratize expression, which ordinarily is something places claiming to value the principles of free expression should want to support. In fact, the more the antipathy against big companies, the more they should want to ensure that independent voices can thrive.

But instead we're seeing how all this regulation targeted at those big companies instead attacks regular people trying to speak online. We've seen the same problem with SESTA/FOSTA too, where individual online speakers suddenly find themselves risking legal liability for how they interact with other speakers online. And now it's happening again in the GDPR context, where the very regulation ostensibly intended to protect people online now threatens to silence them.

Filed Under: data controller, eu, fan pages, gdpr, privacy, social media
Companies: facebook