Every Streaming Company Not Named Apple Receives A Lousy Grade On Privacy

from the unimportant-afterthoughts dept

While streaming providers and hardware companies see significantly higher consumer satisfaction rates that traditional cable TV, their privacy practices still leave something to be desired. That's according to a new breakdown of streaming service privacy policies by Common Sense Media, which doled out terrible grades to pretty much everybody not named Apple:

"Our privacy evaluations of the top 10 streaming apps indicate that all streaming apps (except Apple TV+) have privacy practices that put consumers' privacy at considerable risk including selling data, sending third‐party marketing communications, displaying targeted advertisements, tracking users across other sites and services, and creating advertising profiles for data brokers."

Of course their privacy practices suck because being terrible on privacy is perfectly legal in a country that can't manage to pass even a basic privacy law for the internet era. Not a law cracking down on the dodgy behavior by third party data brokers. Not a law that implements some basic transparency requirements so consumers know what's being collected and who it's being sold to. And not a basic law that implements something vaguely resembling real accountability for companies that can't be bothered, time and time again, to properly secure their networks, devices, and servers from intrusion.

The firm took a deep dive into the data collection and sharing practices of 10 different streaming services and hardware vendors, from Netflix and Disney+ to Roku. They closely examined what data was being collected, how much of that collection was transparent to the end user, and where that data was sent. They also took a close look at device security using the Consumer Reports' Digital Standard, a promising new metric that attempts to standardize security practices so they can be included in product reviews.

Some of the failures were downright ugly, like making no real exceptions for the data collection of children. Many of the issues revealed weren't the end of the world, but they make it repeatedly clear that companies aren't being transparent about what is collected, and often enjoy making opting out of data collection and monetization as cumbersome and annoying as possible:

"The Roku Streaming Stick+ set‐up process did not display notice of privacy settings or choices a user can make about sharing data. Only after the Roku device has completed setup can users navigate to the "Settings" menu, and choose to opt in to the single privacy setting "Limit Ad Tracking" which is not enabled by default. This setting is worded in such a way that it may be misleading that opting in to limiting a worse practice is actually opting out of use of your data for that worse practice, which is not a principle of privacy by design."

There's a consistent drumbeat of arguments that tend to focus on how it's simply impossible for our Luddite Congress to pass a useful privacy law. But again, it wouldn't be at that difficult to write a clear law, with input from major stakeholders, that simply mandates clear communication on what's being collected and how to opt out of it. But we can't even do that. Instead we've got complete apathy toward the privacy and security internet shit show on the federal level, which created a discordant wave of less than impressive and often convoluted state-level laws.

Filed Under: data collection, privacy, streaming
Companies: apple

Apple's Dedication To Privacy Is Missing When It Comes To Its Workforce, Employees Say

from the consistently-inconsistent dept

For a while it's been clear that Apple has been hoping to use "we care about privacy" as a marketing advantage in an internet economy that consistently... doesn't. For example Apple has stood up to the FBI when it comes to backdooring encryption. And in 2020 Apple unveiled several new privacy features and policies it hoped would differentiate it from its other "big tech" contemporaries repeatedly under fire in the press and in Congress. Granted there's been ongoing hints this dedication isn't exactly consistent, but it's the thought that counts, I guess.

But Apple employees say the company's outward-facing dedication to privacy isn't reflected in house. This week The Verge reported on how the company's decision to force Apple employees to link their personal Apple ID and work Apple accounts are creating significant privacy headaches for employees. Personal Apple ID accounts are obviously filled with all manner of sensitive personal and financial data that an employee might not want shared with an employer. And the requirement that employees fuse their personal and work lives in such a fashion is causing significant internal turmoil, the report claims:

"...some employees say the company isn’t doing enough to protect their personal privacy and, at times, actively seeks to invade it for security reasons. Employees have been asked to install software builds on their phones to test out new features prior to launch — only to find the builds expose their personal messages. Others have found that when testing new products like Apple’s Face ID, images are recorded every time they open their phones. “If they did this to a customer, people would lose their goddamn minds,” says Ashley Gjøvik, a senior engineering program manager."

Apple devices don’t support using multiple Apple IDs, and while you can technically use several phones (say, an Android), that winds up being cumbersome and difficult if you want to actually get work done. The forced integration is just a bizarre disconnect from the company's recent pro-privacy branding. Especially given the requirements have had a stunning privacy impact on the very people Apple expects to build privacy-friendly products and services:

So in short Apple is demanding that employees fuse extremely personal accounts with oceans of sensitive data with their work accounts. While at the same time conducting significant internal surveillance, and making it extremely clear employees should have absolutely no expectation of privacy (very much the status quo at most companies):

"Underpinning all of this is a stringent employment agreement that gives Apple the right to conduct extensive employee surveillance, including “physical, video, or electronic surveillance” as well as the ability to “search your workspace such as file cabinets, desks, and offices (even if locked), review phone records, or search any non-Apple property (such as backpacks, purses) on company premises."

The story makes it very clear Apple hasn't tried very hard to make any of this any easier. Untangling your personal and work data when you leave Apple also winds up being a nightmare, given that Apple bans employees from wiping their company-owned devices (including the personal data that gets tangled up with work) when they leave the company, opening them to legal action for violating their employment agreement if they do.

So in short Apple's marketing insists that when it comes to privacy the company is ethical and different, but when it comes to the people actually tasked with building the products that adhere to those standards -- these values suddenly and mysteriously disappear.

Filed Under: apple id, employment, privacy, work life balance, work phone
Companies: apple

Google Report Shows 'Reverse Warrants' Are Swiftly Becoming Law Enforcement's Go-To Investigative Tool

from the Pokemon-Go,-but-for-cops dept

Thanks to its never-ending collection of location data, Google has become a prime target for law enforcement investigators. Using so-called "reverse warrants," investigators ask Google to turn over information for all devices in a geofenced area, with the hope of working their way backward from these data points to actual criminal suspects.

They're called "warrants" but they can't possibly be supported by probable cause. Treating everyone in the area of a suspected crime as a criminal suspect until things can be sorted out inverts this concept. And the government isn't always honest with courts about how many innocent people these "reverse warrants" can ensnare. Fortunately, we've seen some courts engage in more active reviews of these requests, which has led to a few notable rejections.

Google has released some details [PDF] on reverse warrants, which show they're an increasingly-popular option for law enforcement agencies. Zack Whittaker breaks down the data for TechCrunch.

The figures, published Thursday, reveal that Google has received thousands of geofence warrants each quarter since 2018, and at times accounted for about one-quarter of all U.S. warrants that Google receives. The data shows that the vast majority of geofence warrants are obtained by local and state authorities, with federal law enforcement accounting for just 4% of all geofence warrants served on the technology giant.

According to the data, Google received 982 geofence warrants in 2018, 8,396 in 2019 and 11,554 in 2020. But the figures only provide a small glimpse into the volume of warrants received and did not break down how often it pushes back on overly broad requests.

Well, every request could be considered "overly broad," seeing as the only probable cause used is the presumption that it's probable Google has the data investigators are looking to obtain. Crimes that occur in heavily trafficked areas or during daylight hours produce the biggest haystacks, increasing the odds of someone being wrongly arrested for literally being in the wrong place at the wrong time.

They're also overly broad in the sense that they make the assumption that the criminal suspect would be carrying a device utilizing Google location services. And they tend to gloss over the fact that this location data isn't nearly as accurate as cell site location data, which means there's just as much of a chance for a false negative as there is for a false positive.

But, if this report is any indication, geofence warrants aren't going away. It's up to legislators to change that. And until legislators are willing to ban or restrict use of these warrants, it's up to the courts to thoroughly vet these requests that burden hundreds of people with a presumption of guilt until the thousands of data points gathered by a third party can exonerate them.

Filed Under: 4th amendment, location data, privacy, reverse warrants, surveillance
Companies: google

States Wouldn't Be Pushing Inconsistent Tech Laws If Congress Wasn't So Corrupt

from the cycle-of-stupid dept

You might recall after the telecom lobby convinced Congress to obliterate both privacy and net neutrality rules (despite both having bipartisan public support), there was a lot of industry whining about the various state replacement efforts that popped up. For example when California popped up with its own net neutrality rules, AT&T whined incessantly about how a "discordant network of state laws" would harm puppies and innovation. Ignored, of course, is that states were simply rushing to fill the consumer protection void created by federal apathy, itself a direct result of lobbying (aka corruption).

The same thing happened with broadband privacy guard rails. In 2015, the FCC proposed some fairly basic broadband privacy rules largely focused on making sure what was being collected and sold would be transparent to consumers. But the telecom lobby was easily able to lobby the GOP-controlled Congress to use the Congressional Review Act to kill those rules before they could even take effect. And again, giants like AT&T whined about the discordant landscape of imperfect state legislative efforts that popped up in its wake, hoping you'd ignore that they helped create the problem by attacking even the most basic federal protections.

The same thing of course is now playing out in the broader tech sector as well. For years, the tech, healthcare, marketing, insurance, and telecom sectors have worked to uniformly battle any meaningful federal privacy protections on the federal level. Not just the bad proposals. All of them. And, unsurprisingly, after years of this, states have started filling the void with their own solutions, many of which are less than perfect. This, as we saw with telecom, is causing all manner of consternation and constipation at major tech companies:

"There's little question state and local policy moves get the attention of both tech companies and Congress. David Edmonson, vice president for state policy and government relations at the trade group TechNet, said that the "impact of a 50-state patchwork" is among the group's highest concerns.

The group, which is known for its state-level advocacy work, said it worries about the compliance costs and impact of patchwork regulation on small businesses — although its membership is primarily midsize and large companies. It also fears the potential impact on consumers who may be confused about their rights or who remain completely uncovered because of where they live, according to Edmonson."

"A 50-state patchwork of state-based privacy laws creates more problems than it solves both for consumers and the digital economy," he said. "A single federal standard that applies to all 50 states is better for both consumers and businesses."

AT&T and Comcast are both members of Technet, it should be noted, and are both particularly guilty of this practice of lobbying against all federal consumer protections, then whining incessantly about the resulting escalation in state proposals. So basically, large companies work tirelessly to fight pretty much any meaningful federal consumer protections, then complain via their proxy groups about the end result, namely an inconsistent patchwork of discordant state consumer protection rules. At no point is there any awareness that their own actions may have contributed to the outcome they're now complaining about.

Yes, there's some valid business concerns about having to comply with a massive patchwork of often inconsistent legislative solutions. And there's certainly ample concerns with how many of these laws are written, as California's often problematic privacy law can attest. And yes, there's also plenty of valid concerns that legislating many of these problems is well beyond the core competency of many modern q-anon-era elected officials.

But what I've noticed missing from any of these conversations is how this is all largely a byproduct of Congressional corruption. Or, quite often, any mention that the very problem companies are complaining about (states passing discordant legislation) was the direct byproduct of their lobbying influence on federal lawmakers.

Congress is so broken and corrupt, even very popular proposals (see: net neutrality) can't survive for long. And that's particularly true of policy issues that see broad, cross-industry opposition like privacy. There's an army of industries, all with near unlimited budgets, laser-focused on not just opposing bad federal privacy rules, but any federal privacy rules at all. It's virtually impossible for activists, academics, and truly solution-focused, objective experts to combat efforts backed with those kinds of resources. Again, we can call that specific problem a lot of things, but it's predominately a byproduct of corruption.

Those with the power and resources to truly dictate U.S.tech policy very much like the current unaccountable adtech paradigm that involves over-collecting data, selling access to it to any nitwit with a nickel, failing repeatedly to secure it, then occasionally getting a piddly wrist slap from underfunded and understaffed U.S. regulators as a modest cost of doing business.

If you look at the steady drumbeat of hacking, location data, and other scandals, that approach isn't working out that well for the rest of us. And yet we still somehow can't seem to get even a basic federal privacy law on the books (one that mandates some very basic transparency requirements, or erects some very clear but meaningful penalties for companies that refuse to secure their networks and servers). The primary reason for that is clearly corruption, but again, that's often rarely mentioned in discourse.

At some point you'd think many of these large companies would realize that it would be better to concede on some issues and support basic, decent, federal solutions even if there's a revenue hit. But because they know Congress is ethically malleable, they know they don't have to do that.

So instead, as we saw in telecom, you'll have a company like AT&T lobby to kill meaningful federal and state consumer protections (privacy, net neutrality), then try to push their own shitty federal proposals written by their lawyers. Proposals so filled with intentional loopholes as to be useless beyond one core function: supplanting better, stronger, consensus-driven federal and state legislative solutions. But whether it's Facebook or AT&T, if they truly claim to want consistent federal guidelines, maybe, I don't know, stop throwing millions of dollars at lawmakers who then fight tooth and nail against absolutely every effort to do that?

Filed Under: broadband, congress, corruption, privacy, regulations, soft corruption, states

ISPs Give 'Netflow Data' To Third Parties, Who Sell It Without User Awareness Or Consent

from the more-of-the-same dept

Back around 2007 or so there was a bit of a ruckus when broadband ISPs were found to be selling your "clickstream" data (which sites you visit and how long you're there) to any nitwit with a nickel, then basically denying they were even doing that. Concerns about that now seem quaint.

In the years since, technologies like deep packet inspection have allowed ISPs to collect and sell details on every aspect of your online life, then, through obfuscation, proxies, and empty promises of "anonymization," insist they're not doing exactly that. Or, as the wireless industry's location data scandals have shown, collect and sell your daily movement habits, initially with only a fleeting concern about user privacy and security.

Now, sources in the infosec community tell Motherboard ISPs are also (again, via proxies) selling access to "netflow data." As the name suggests, netflow data details the day to day broader stroke network traffic (pdf), whether that's overall network loads, which servers are talking to one another, network topology, etc. The data is generally beneficial to researchers to understand network and user behavior, and to security experts to help mitigate network attacks. But it's also valuable, and increasingly, it's being offloaded to businesses who are then turning around and selling it:

"I'm concerned that netflow data being offered for commercial purposes is a path to a dark fucking place," one source familiar with the data told Motherboard. Motherboard granted multiple sources anonymity to speak more candidly about industry issues."

Recall that modest FCC broadband privacy rules designed to give users a little more transparency into this stuff were killed by the GOP in 2017 (using the Congressional Review Act at telecom industry behest) before they could even take effect. And recall that, thanks to a cross-industry coalition of lobbyists, the United States still doesn't have even a basic privacy law for the internet era. As a result, any shred of data that can be collected and sold is, securing that data is often an afterthought, and consumers more often than not have absolutely no transparency into anything.

The data provides comprehensive insight into not just what's happening on the originating ISPs network, but everybody's network, including what data is being pushed through VPNs. ISPs offload this data to security vendors in exchange for security threat analysis work. Those vendors then turn around and act as data brokers, selling access to this data to a wide variety of third parties... without consumer awareness or consent. ISPs then can tell reporters "we don't sell access to user data" because, technically, they aren't directly "selling" it:

"The continued sale of sensitive data could present its own privacy and security concerns, and the news highlights that ISPs are providing this data at scale to third parties likely without the informed consent of their own users.

"The users almost certainly don't [know]" their data is being provided to Team Cymru, who then sells access to it, the source familiar with the data said.

Again, there's always a lot of hand-wringing about the potential impossibility of privacy legislation given the potential for harm. But it remains entirely possible to craft comprehensive, basic federal rules that, at the very least, mandate absolute transparency with the end user. Instead of doing what we've created with a wild west like ecosystem of app makers, phone makers, software giants, telecoms and others selling every shred of data they can find, often failing to adequately secure it, and with consumer protection (or even awareness) a distant, belated afterthought.

Filed Under: broadband, clickstream data, fcc, isps, netflow data, privacy

Apple's New Scanning Tools Raising More Concerns, Even Inside Apple

from the take-a-step-back dept

Last week, we wrote about our concerns about Apple's newly announced scanning efforts that the company claimed were to protect children. Lots of security experts raised concerns about how this was being rolled out -- and none of the complaints were meant to take away from the very real and legitimate concerns about child sexual abuse. Security guru Alex Stamos wrote one of the most thoughtful threads about the whole thing, noting (as with so many of these issues) that there are no easy answers here. I highly recommend you read the entire thread, but here's a little snippet:

Similar to many of these debates involving nuanced tech policy issues with no easy answers, a big part of the problem here is, as Stamos notes in his thread, there are tons of conversations happening about the nuances and tradeoffs, and even though Apple's approach is not as disastrous and dangerous as it could have been (i.e., clearly a lot of thought was put by the team at Apple into minimizing many -- though not all -- of the risks here), this approach was still done without talking to the many, many people who have been trying to find a reasonable balance here. And that messes a lot of stuff up.

Stamos, along with computer science professor/security guy Matt Green, have now published a good piece in the NY Times highlighting their concerns. The article notes there is less concern about the iMessage child safety features (Apple's initial description of that seemed much more concerning, but the details show why it's not that bad). But the photo scanning on the phone raises a lot of concerns:

But the other technology, which allows Apple to scan the photos on your phone, is more alarming. While Apple has vowed to use this technology to search only for child sexual abuse material, and only if your photos are uploaded to iCloud Photos, nothing in principle prevents this sort of technology from being used for other purposes and without your consent. It is reasonable to wonder if law enforcement in the United States could compel Apple (or any other company that develops such capacities) to use this technology to detect other kinds of images or documents stored on people’s computers or phones.

While Apple is introducing the child sexual abuse detection feature only in the United States for now, it is not hard to imagine that foreign governments will be eager to use this sort of tool to monitor other aspects of their citizens’ lives — and might pressure Apple to comply. Apple does not have a good record of resisting such pressure in China, for example, having moved Chinese citizens’ data to Chinese government servers. Even some democracies criminalize broad categories of hate speech and blasphemy. Would Apple be able to resist the demands of legitimately elected governments to use this technology to help enforce those laws?

Another worry is that the new technology has not been sufficiently tested. The tool relies on a new algorithm designed to recognize known child sexual abuse images, even if they have been slightly altered. Apple says this algorithm is extremely unlikely to accidentally flag legitimate content, and it has added some safeguards, including having Apple employees review images before forwarding them to the National Center for Missing and Exploited Children. But Apple has allowed few if any independent computer scientists to test its algorithm.

The computer science and policymaking communities have spent years considering the kinds of problems raised by this sort of technology, trying to find a proper balance between public safety and individual privacy. The Apple plan upends all of that deliberation. Apple has more than one billion devices in the world, so its decisions affect the security plans of every government and every other technology company. Apple has now sent a clear message that it is safe to build and use systems that directly scan people’s personal phones for prohibited content.

In a separate thread, Stamos has a suggested path forward for Apple, which involves pumping the brakes quite a bit on some of these features.

Meanwhile, Reuters revealed on Thursday that inside Apple there are widespread concerns as well.

Apple employees have flooded an Apple internal Slack channel with more than 800 messages on the plan announced a week ago, workers who asked not to be identified told Reuters. Many expressed worries that the feature could be exploited by repressive governments looking to find other material for censorship or arrests, according to workers who saw the days-long thread.

Past security changes at Apple have also prompted concern among employees, but the volume and duration of the new debate is surprising, the workers said. Some posters worried that Apple is damaging its leading reputation for protecting privacy.

The article notes that many of the concerns are coming from outside of the security team at Apple -- suggesting that the concerns are more about perception than they are technical. But, really, this highlights the same problem that Stamos noted earlier: Apple's standard operating procedure of doing everything alone, and then also doing "surprise" announcements regarding products. That's great for a new gadget in your pocket. It's not so great for dealing with a massively challenging and very legitimate problem with no easy answers, where getting things even a little wrong can have significant negative consequences.

Unlike many companies that rush out offerings that do more harm than good, I do think that Apple did think this through internally with lots of smart and thoughtful people. But these are problems and challenges that go beyond just one company -- and Apple's famously insular approach is exactly the wrong thing for this sort of challenge.

Filed Under: backdoors, csam, encryption, icloud, iphones, privacy, scanning, security, surveillance
Companies: apple

Facebook Acting Badly: Shuts Down Researchers Accounts Over Claims Of Privacy Violations That Don't Stand Up To Scrutiny

from the oh-stop-it dept

Last year we wrote about Facebook threatening NYU researchers who had set up a browser extension that would allow users to voluntarily collect information about ads and ad targeting on Facebook -- information that Facebook does not publicly reveal -- and provide it to the researchers' "Ad Observatory" project. As we noted at the time, Facebook's threats were definitely going too far, though you could see how it came about, as it could be argued that there were technical similarities to what the NYU researchers were doing, and what an academic from Cambridge did many years ago that turned into... the Cambridge Analytica scandal, which resulted (in part) in a massive fine from the FTC for privacy violations.

But, as we explained then, the NYU Ad Observer story is clearly distinguishable from the Cambridge Analytica story. The Ad Observatory involves people installing an extension on their own computer in their own browser, and choosing to share that information. That's not something Facebook should have any right to block.

Unfortunately, this week, Facebook took things up a notch and shut down the accounts of everyone associated with the project, effectively cutting off all their access to Facebook's Ad Library and other tools they were using in their research. Facebook's own explanation for this is... to claim that it was compromising people's privacy, though that appears to be bullshit (as we'll get to in a moment). Here's part of what Facebook said:

We told the researchers a year ago, in summer of 2020, that their Ad Observatory extension would violate our Terms even before they launched the tool. In October, we sent them a formal letter notifying them of the violation of our Terms of Service and granted them 45 days to comply with our request to stop scraping data from our website. The deadline ended on November 30, long after Election Day. We continued to engage with the researchers on addressing our privacy concerns and offered them ways to obtain data that did not violate our Terms. 

Earlier this year, we invited researchers, including the ones from NYU, to safely access US 2020 Elections ad targeting data through FORT’s Researcher Platform. This offered the Ad Observatory researchers a more comprehensive data set than the one they created by scraping data on Facebook. The researchers had the opportunity to use the data set, which is designed to be privacy-protective, instead of relying on scraping, but they declined.

We made it clear in a series of posts earlier this year that we take unauthorized data scraping seriously, and when we find instances of scraping we investigate and take action to protect our platform. While the Ad Observatory project may be well-intentioned, the ongoing and continued violations of protections against scraping cannot be ignored and should be remediated. 

Collecting data via scraping is an industry-wide problem that jeopardizes people’s privacy, and we’ve been clear about our public position on this as recently as April. The researchers knowingly violated our Terms against scraping — which we went to great lengths to explain to them over the past year. Today’s action doesn’t change our commitment to providing more transparency around ads on Facebook or our ongoing collaborations with academia. We’ll continue to provide ways for responsible researchers to conduct studies that are in the public interest while protecting the security of our platform and the privacy of people who use it. 

This is... nonsense. I challenge the idea that "data scraping" is a problem, first of all. I mean, that's what the entire search engine business is built on. It's all data scraping. The problem is when private information is somehow exposed. But that's different. And here we're talking about individuals installing an extension in their own browsers, to collect information that is sent to their own computers. That's not Facebook's data to control. Once it's in my browser, it's mine to make use of. Facebook's argument here makes no sense.

And, indeed, a few others have stepped in to point out the same thing. For one, Mozilla, makers of the Firefox browser, called bullshit on the claims pretty directly:

Facebook claims the accounts were shut down due to privacy problems with the Ad Observer.  In our view, those claims simply do not hold water. We know this, because before encouraging users to contribute data to the Ad Observer, which we’ve done repeatedly, we reviewed the code ourselves. And in this blog post, we want to explain why we believe people can contribute to this important research without sacrificing their privacy.  

Anytime you give your data to another party, whether Facebook or Mozilla or researchers at New York University, it is important that you know whether that party is trustworthy, what data will be collected, and what will be done with that data. Those are critical things to consider before you potentially grant access to your data. And those are also key factors for Mozilla when we consider recommending an extension. 

Before Mozilla decided to recommend Ad Observer, we reviewed it twice, conducting both a code review and examining the consent flow to ensure users will understand exactly what they are installing. In both cases the team responsible for this add-on responded quickly to our feedback, made changes to their code, and demonstrated a commitment to the privacy of their users. We also conducted an in-depth design review of Ad Observer, the results of which can be found here. 

We decided to recommend Ad Observer because our reviews assured us that it respects user privacy and supports transparency. It collects ads, targeting parameters and metadata associated with the ads. It does not collect personal posts or information about your friends. And it does not compile a user profile on its servers. The extension also allows you to see what data has been collected by visiting the “My Archive” tab. It gives you the choice to opt in to sharing additional demographic information to aid research into how specific groups are being targeted, but even that is off by default.

You don’t have to take our word for it. Ad Observer is open source, so anybody can see the code and  confirm it is designed properly and doing what it purports to do.

And then, the FTC's Bureau of Consumer Protection weighed in with a letter to Mark Zuckerberg also calling bullshit on the idea that the Ad Observatory extension might somehow violate Facebook's various consent decrees with the FTC regarding privacy protection.

I write concerning Facebook’s recent insinuation that its actions against an academic research project conducted by NYU’s Ad Observatory were required by the company’s consent decree with the Federal Trade Commission. As the company has since acknowledged, this is inaccurate. The FTC is committed to protecting the privacy of people, and efforts to shield targeted advertising practices from scrutiny run counter to that mission.

While I appreciate that Facebook has now corrected the record, I am disappointed by how your company has conducted itself in this matter. Only last week, Facebook’s General Counsel, Jennifer Newstead, committed the company to “timely, transparent communication to BCP staff about significant developments.” Yet the FTC received no notice that Facebook would be publicly invoking our consent decree to justify terminating academic research earlier this week.

Had you honored your commitment to contact us in advance, we would have pointed out that the consent decree does not bar Facebook from creating exceptions for good-faith research in the public interest. Indeed, the FTC supports efforts to shed light on opaque business practices, especially around surveillance-based advertising. While it is not our role to resolve individual disputes between Facebook and third parties, we hope that the company is not invoking privacy – much less the FTC consent order – as a pretext to advance other aims.

I do think that some of the pressures that people put on Facebook about "protecting" privacy do more harm than good and lead to situations that backfire and actually give Facebook more control and less transparency. But this case seems to be Facebook cynically using this as an excuse to shut down academic research they were uncomfortable with and punish the researchers.

There are two simple answers here: give the academic researchers access to the data they need to do this research (Facebook's claims of making the data accessible leave out that not everything the researchers are asking for is actually in those data sets) and don't block people from installing things on their own computer. That's not Facebook's job.

Filed Under: ad observatory, data, excuses, ftc, privacy, scraping, transparency
Companies: cambridge analytica, facebook, mozilla, nyu

Apple Undermines Its Famous Security 'For The Children'

from the this-is-dangerously-dumb dept

Apple is somewhat famous for its approach to security on its iPhones. Most famously, Apple went to court to fight the FBI's demand that they effectively insert a backdoor into its on-phone encryption (by being able to force an update to the phone). Apple has tons of goodwill in the security community (and the public) because of that, though not in the law enforcement community. Unfortunately, it appears that Apple is throwing away much of that good will and has decided to undermine the security of its phone... "for the children" (of course).

This week, Apple announced what it refers to as "expanded protections for children." The company has been receiving lots of pressure from certain corners (including law enforcement groups who hate encryption), claiming that its encryption was helping hide child sexual abuse material (CSAM) on phones (and in iCloud accounts). So Apple's plan is to introduce what's generally called "client-side scanning" to search for CSAM on phones as well as a system that scans iCloud content for potentially problematic content. Apple claims that it's doing this in a manner that is protective of privacy. And, to be fair, this clearly isn't something that Apple rolled out willy-nilly without considering the trade-offs. It's clear from Apple's detailed explanations of the new "safety" features, that it is trying to balance the competing interests at play here. And, obviously, stopping the abuse of children is an important goal.

The problem is that, even with all of the balancing Apple has done here, it's definitely moved down a very dangerous, and very slippery slope towards using this approach for other things.

Apple's brief description of its new offerings are as follows:

Apple is introducing new child safety features in three areas, developed in collaboration with child safety experts. First, new communication tools will enable parents to play a more informed role in helping their children navigate communication online. The Messages app will use on-device machine learning to warn about sensitive content, while keeping private communications unreadable by Apple.

Next, iOS and iPadOS will use new applications of cryptography to help limit the spread of CSAM online, while designing for user privacy. CSAM detection will help Apple provide valuable information to law enforcement on collections of CSAM in iCloud Photos.

Finally, updates to Siri and Search provide parents and children expanded information and help if they encounter unsafe situations. Siri and Search will also intervene when users try to search for CSAM-related topics.

Some of the initial concerns about these descriptions -- including fears that, say, LGBTQ+ children might be outed to their parents -- have been somewhat (though not entirely) alleviated with the more detailed explanation. But that doesn't mean there aren't still very serious concerns about how this plays out in practice and what this means for Apple's security.

First, there's the issue of client-side scanning. As an EFF post from 2019 explains, client-side scanning breaks end-to-end encryption. In the EFF's latest post about Apple's announcement, it includes a quick description of how this introduces a backdoor:

We’ve said it before, and we’ll say it again now: it’s impossible to build a client-side scanning system that can only be used for sexually explicit images sent or received by children. As a consequence, even a well-intentioned effort to build such a system will break key promises of the messenger’s encryption itself and open the door to broader abuses.

All it would take to widen the narrow backdoor that Apple is building is an expansion of the machine learning parameters to look for additional types of content, or a tweak of the configuration flags to scan, not just children’s, but anyone’s accounts. That’s not a slippery slope; that’s a fully built system just waiting for external pressure to make the slightest change. Take the example of India, where recently passed rules include dangerous requirements for platforms to identify the origins of messages and pre-screen content. New laws in Ethiopia requiring content takedowns of “misinformation” in 24 hours may apply to messaging services. And many other countries—often those with authoritarian governments—have passed similar laws. Apple’s changes would enable such screening, takedown, and reporting in its end-to-end messaging. The abuse cases are easy to imagine: governments that outlaw homosexuality might require the classifier to be trained to restrict apparent LGBTQ+ content, or an authoritarian regime might demand the classifier be able to spot popular satirical images or protest flyers.

We’ve already seen this mission creep in action. One of the technologies originally built to scan and hash child sexual abuse imagery has been repurposed to create a database of “terrorist” content that companies can contribute to and access for the purpose of banning such content. The database, managed by the Global Internet Forum to Counter Terrorism (GIFCT), is troublingly without external oversight, despite calls from civil society. While it’s therefore impossible to know whether the database has overreached, we do know that platforms regularly flag critical content as “terrorism,” including documentation of violence and repression, counterspeech, art, and satire.

It's actually difficult to find any security experts who support Apple's approach here. Alec Muffett sums it up in a single tweet:

This is the very slippery slope. If we somehow believe that governments won't demand Apple cave on a wide variety of other types of content, you haven't been paying attention. Of course, Apple can claim that it will stand strong against such demands, but now we're back to being entirely dependent on trusting Apple.

As noted above, there were some initial concerns about the parent notifications, but as EFF's description notes, the rollout here does include some level of consent by users before their parents are notified, but it's still quite problematic:

In these new processes, if an account held by a child under 13 wishes to send an image that the on-device machine learning classifier determines is a sexually explicit image, a notification will pop up, telling the under-13 child that their parent will be notified of this content. If the under-13 child still chooses to send the content, they have to accept that the “parent” will be notified, and the image will be irrevocably saved to the parental controls section of their phone for the parent to view later. For users between the ages of 13 and 17, a similar warning notification will pop up, though without the parental notification.

Similarly, if the under-13 child receives an image that iMessage deems to be “sexually explicit”, before being allowed to view the photo, a notification will pop up that tells the under-13 child that their parent will be notified that they are receiving a sexually explicit image. Again, if the under-13 user accepts the image, the parent is notified and the image is saved to the phone. Users between 13 and 17 years old will similarly receive a warning notification, but a notification about this action will not be sent to their parent’s device.

This means that if—for instance—a minor using an iPhone without these features turned on sends a photo to another minor who does have the features enabled, they do not receive a notification that iMessage considers their image to be “explicit” or that the recipient’s parent will be notified. The recipient’s parents will be informed of the content without the sender consenting to their involvement. Additionally, once sent or received, the “sexually explicit image” cannot be deleted from the under-13 user’s device.

Whether sending or receiving such content, the under-13 user has the option to decline without the parent being notified. Nevertheless, these notifications give the sense that Apple is watching over the user’s shoulder—and in the case of under-13s, that’s essentially what Apple has given parents the ability to do.

It is also important to note that Apple has chosen to use the notoriously difficult-to-audit technology of machine learning classifiers to determine what constitutes a sexually explicit image. We know from years of documentation and research that machine-learning technologies, used without human oversight, have a habit of wrongfully classifying content, including supposedly “sexually explicit” content. When blogging platform Tumblr instituted a filter for sexual content in 2018, it famously caught all sorts of other imagery in the net, including pictures of Pomeranian puppies, selfies of fully-clothed individuals, and more. Facebook’s attempts to police nudity have resulted in the removal of pictures of famous statues such as Copenhagen’s Little Mermaid. These filters have a history of chilling expression, and there’s plenty of reason to believe that Apple’s will do the same.

There remains a real risk of false positives in this kind of system. There's a very worth reading blog post explaining how automated matching technologies fail, often in catastrophic ways. You really need to read that entire post as brief excerpts wouldn't do it justice -- but as it notes, the risk of false positives here are very high, and the cost of such false positives can be catastrophic. Obviously, CSAM is also catastrophic, so you can see how there is a real challenge in balancing those interests, but there are legitimate concerns that with this approach it's unclear if the balance is properly calibrated.

Obviously, Apple is trying to walk a fine line here. No one wants to be supporting CSAM distribution. But, once again, all the pressure on Apple feels like people blaming the tool for (serious) abuses by its users, and in demanding a "solution," opening up a very dangerous situation. If there were some way to guarantee that these technologies wouldn't be abused, or mess up, you could kind of see how this makes sense. But history has shown time and time again that neither of these things is really possible. Opening up this hole in Apple's famous security means more demands are coming.

Filed Under: client side scanning, csam, encryption, for the children, parent notification, privacy, security
Companies: apple

Techdirt Is Now Entirely Without Any Google Ads Or Tracking Code

from the cleaning-out-the-cobwebs dept

First things first: if you are interested in advertising on Techdirt in a non-intrusive, non-obnoxious way, please contact us. We'd love to work with you on cool, innovative advertising and sponsorship that engages, instead of annoys, our community. As some of you may recall, last summer, we had to pull all ads off of Techdirt, after we kept running into problems with Google, and its overly aggressive, overly sensitive (if somewhat arbitrary) advertising morality police (such as telling us all our stories about Google were "dangerous or derogatory").

After announcing that, we had a few different companies approach us with possible alternatives, and earlier this year, we tried to put ads back on the site briefly, with a promise from a provider that they could both serve better quality ads as well as "deal with" Google if it started complaining again. Here's the unfortunate secret underpinning nearly all of the internet advertising space: there are hundreds, if not thousands, of companies which will purport to put ads on your website. And all of them will promise "quality" ads and better rates. But the unfortunate reality is that they're all just backstopped by Google, and the ads are all the same crappy ads in the end. Only the largest websites (or highly, highly specialized ones) can really pull their own weight on advertising. And, tragically, wonky tech/legal/policy blogs don't cut it (unless we wanted to just start running reviews of every silly tech product out there, and that's not our thing).

So, we worked with a new partner, with promises of higher quality... and it all turned out to just be the same awful Google ads again, and with it, the same automated emails every damn day from Google threatening to cut us off for our "dangerous and derogatory" content. This time around, we just ignored those threats, because at this point, we're so damn sick of it that if Google cuts us off, so be it.

But, there was a larger issue. In our wrapup of the 2020 stats for Techdirt, I mentioned in passing that this would be the last year we used Google Analytics for tracking how people use the site. We've used a few different analytics systems in the life of Techdirt, and I think we used MeasureMap before Google bought it and wrapped it into Google Analytics. And, to be clear, Google Analytics worked decently well, had a nice interface (much nicer than most competitors) and, of course, was free for our use case. But that freedom came with a different kind of price -- which is that Google was tracking users on our site. And that was becoming both more and more problematic, and more of a nuisance.

After becoming increasingly uncomfortable with that, we switched over to a different analytics package, and are now using both Plausible and Matomo (self-hosted), to make sure that we're much more protective of the privacy of Techdirt's readers. We actually pulled Google Analytics off the site in late January. But then we noticed something odd. In February, Google Analytics was still showing up even though we had pulled the tags. It turned out that, via the new ad partner we had, as soon as ads via Google show up on our site Google Analytics code showed up along with it. And that really sucks.

After going through a variety of options, we eventually realized that none of this was worth it. We ended our contract with our ad provider, and then had to scrub through all our code to make sure Google Analytics was truly gone (it's amazing how it pops up in unexpected places). We didn't post about this immediately, in part because we were busy with other stuff, but also because I wanted to make sure Google Analytics was really gone. And it is.

Of course, that also means we're once again without any advertising on Techdirt, which is a hit to our revenue and our ability to keep going -- at a time when that's under threat from other things as well. We are hoping to try some more creative (less intrusive, less annoying) sponsorship and advertising methods in the near future, but at the very least we're increasingly going to rely on you, our community, to help Techdirt stick around. If you are able to, and interested, the easiest way to directly support Techdirt is via the Friend of Techdirt option (basically a way to tip us however much you'd like), but we have a wide variety of ways to support us, and any one you choose is greatly appreciated.

Techdirt is one of the very, very, very few truly independent media brands around. Almost none of the independent media brands that existed when we started remain. Some have been sucked up into larger companies or shut down entirely. Others have decided to go behind expensive paywalls. We've had to adapt and change over the years in many ways just to stick around, but in the end the reason we do this is because of the community we've built up here. For us to stick around, I need to ask the community to help support us as well. We have some cool experiments and projects in the works, so stay tuned for that, but in the meantime, if you can help us out, it would be hugely appreciated.

Filed Under: ads, advertising, analytics, privacy, tracking
Companies: google, techdirt

Seventh Circuit Says (Reluctantly) That 18 Months Of Pole-Mounted Camera Surveillance Isn't Unconstitutional

from the Fourth-Amendment-rights-slightly-down-on-active-trading dept

The Seventh Circuit Court of Appeals has issued a very well-written and thoughtful decision [PDF] on the Constitutionality of long-term surveillance via pole-mounted cameras.

The tricky thing is the "expectation of privacy." For years, it has often been decided that anything the public can view has no expectation of privacy. A person's front door -- easily observable by passersby and neighbors -- has no expectation of privacy. The location data collected by cellphone towers? No expectation of privacy, since these records have been "seen" by service providers. License plate numbers/vehicle location data, even when gathered millions of times a day around the nation? No expectation of privacy.

In recent years, the tide inadvertently created by the Supreme Court's 1967 Katz decision has started to recede a bit. As always-on surveillance (including the steady stream of useful information generated by smartphones) increases, courts have tried to rein in this unprecedented expansion of surveillance capability by defining "reasonable" as things police officers could actually do without the aid of all this new tech. If it's impossible for a cop to watch the same front door 24/7 for weeks on end (and provide specific recall of comings and goings days or weeks after they occurred), then there's perhaps some expectation of privacy even in public places.

The Supreme Court's Carpenter decision placed some limits on the gathering of records stored by third parties, ruling that these too contain some inherent expectation of privacy.

Into the mix comes the Seventh Circuit's decision, which seems a bit at odds with current case law on the subject of long-term surveillance. But it opens with a pretty accurate projection of the near future: something that will continue to wreak havoc on long-held notions about personal privacy, as well as long-lasting precedent that found nothing wrong with the government gazing steadily at people's yards and doorsteps.

One day, in a not-so-distant future, millions of Americans may well wake up in a smart-home-dotted nation. As they walk out their front doors, cameras installed on nearby doorbells, vehicles, and municipal traffic lights will sense and record their movements, documenting their departure times, catching glimpses of their phone screens, and taking note of the people that accompany them.

These future Americans will traverse their communities under the perpetual gaze of cameras. Camera-studded streets, highways, and transit networks will generate precise information about each vehicle and its passengers, for example, recording peoples’ everyday routes and deviations therefrom. Upon arrival at their workplaces, schools, and appointments, cameras on buildings will observe their attire and belongings while body cameras donned on the vests of police and security officers will record snippets of face-to-face or phone conversations. That same network of cameras will continue to capture Americans from many angles as they run errands and rendezvous to various social gatherings. By the end of the day, millions of unblinking eyes will have discerned Americans’ occupations and daily routines, the people and groups with whom they associate, the businesses they frequent, their recreational activities, and much more.

The court says the Katz ruling has created circular reasoning that largely benefits the government, rather than the people whose rights the government is entrusted to protect.

Despite its best intentions, this expectations-based Katz test has paved the way for a perilous circularity for new technology. Specifically, our current formulation of a Fourth Amendment search often turns on whether a used technology becomes widespread. Stated differently, as society’s uptake of a new technology waxes—cars, GPS devices, cameras, and the Internet come to mind—expectations of privacy in those technologies wane. In today’s interconnected, globalized, and increasingly digital world, for example, Americans largely accept that cell phones will track their locations, their Internet usage will leave digital footprints, and ever-watching fixed cameras will monitor their movements. These evolving expectations thus continually undermine themselves.

As long as the government moves discreetly with the times, its use of advanced technologies will likely not breach society’s reconstituted (non)expectations of privacy. The upshot: the Katz test as currently interpreted may eventually afford the government ever-wider latitude over the most sophisticated, intrusive, and all-knowing technologies with lessening constitutional constraints.

At the center of this case is eighteen months of continuous surveillance by three cameras installed near Travis Tuggle's property. Two kept constant watch on Tuggle's home and an adjoining parking area. The third was aimed mainly at a nearby shed owned by Tuggle's co-defendant, Joshua Vaultonburg. The cameras could be controlled remotely and recordings could be accessed at any time at a nearby FBI office, where the recordings were stored. This led to recordings of nearly 100 suspected deliveries of meth, which soon led to a raid of the premises and the arrest of Tuggle.

Tuggle challenged the Constitutionality of this surveillance. He raised two arguments. First, he argued each individual camera was a violation of his privacy rights. The court disagrees, pointing out Tuggle took no steps to prevent these areas from being observed by members of the public or law enforcement, such as erecting fences around the surveilled areas. Given these facts, the court says this argument fails.

In this case, Tuggle knowingly exposed the areas captured by the three cameras. Namely, the outside of his house and his driveway were plainly visible to the public. He therefore did not have an expectation of privacy that society would be willing to accept as reasonable in what happened in front of his home. See Evans, 27 F.3d at 1228. The Fourth Amendment accordingly did not require officers to “shield their eyes” (or their cameras) when passing by Tuggle’s “home on public thoroughfares.” See Ciraolo, 476 U.S. at 213.

And for that, society bears part of the blame.

We likewise conclude that, under a straightforward application of Kyllo, the isolated use of pole cameras here did not run afoul of Fourth Amendment protections. Today, cameras are in “general public use.” Kyllo, 533 U.S. at 40. Now more than ever, cameras are ubiquitous, found in the hands and pockets of virtually all Americans, on the doorbells and entrances of homes, and on the walls and ceilings of businesses.

[...]

In sum, the government used a commonplace technology, located where officers were lawfully entitled to be, and captured events observable to any ordinary passerby. The government did not invade an expectation of privacy that society would be prepared to accept as reasonable. Accordingly, the isolated use of pole cameras here did not constitute a Fourth Amendment search.

Tuggle also raised a "mosaic" argument, claiming the combined eighteen months of footage from three cameras intruded on reasonable expectations of privacy. Unfortunately, the Seventh Circuit can't find any Supreme Court precedent to overrule Katz, much less something that would turn a continuous series of Constitutional non-violations (the individual cameras and their approximation of a police officer's eye) into a prolonged Constitutional violation. While there are decisions at lower levels in both state and federal courts, there's no precedent at the appellate level stating that long-term surveillance via camera is a Fourth Amendment violation, with the exception of the Fifth Circuit (surprise surprise!), which held that anything over 30 consecutive days requires a warrant.

Faced with these depressing facts, the Seventh Circuit says it has no choice but to give the government a pass on long-term surveillance. Unlike more comprehensive surveillance (like cell site location data), this monitoring may have allowed the government to draw some conclusions about who came and went from the house, but didn't delve deeply enough into Tuggle's own movement to create a Constitutional violation.

Unlike those technologies, the cameras here exposed no details about where Tuggle traveled, what businesses he frequented, with whom he interacted in public, or whose homes he visited, among many other intimate details of his life. If anything, far from capturing the “whole of his physical movements,” id. at 2219, or his “public movements,” Jones, 565 U.S. at 415 (Sotomayor, J., concurring), the cameras only highlighted Tuggle’s lack of movement, surveying only the time he spent at home and thus not illuminating what occurred when he moved from his home.

The final decision from the Appeals Court is reluctant.

Although we now hold that the pole camera surveillance of the exterior of Tuggle’s home did not constitute a Fourth Amendment search, we are not without unease about the implications of that surveillance for future cases. The eighteen-month duration of the government’s pole camera surveillance—roughly four and twenty times the duration of the data collection in Carpenter and Jones, respectively—is concerning, even if permissible.

It backstops this reluctant conclusion by saying the courts and the nation's lawmakers will need to do more to protect citizens from increasing surveillance as technology continues to advance and high-powered surveillance tools not only become ubiquitous, but deployed by citizens themselves for their own use.

Barring a transformation in governing law, we expect this chronicle of cameras to repeat itself again and again with the evolution of far more invasive technologies. Today’s pole cameras will be tomorrow’s body cameras, “protracted location tracking using [automatic license plate readers],” drones, facial recognition, Internet-of-Things and smart devices, and so much more that we cannot even begin to envision. New technologies of this sort will not disappear, nor will the complicated Fourth Amendment problems that accompany them. If anything, we should expect technology to continue to grow exponentially. And if current technologies are any indication, that technological growth will predictably have an inverse and inimical relationship with individual privacy from government intrusion, presenting serious concerns for Fourth Amendment protections.

And it's probably time for the Supreme Court to rethink the conclusions of Katz, should the opportunity arrive. What was once impossible is now mundane.

Indeed, almost four decades ago, when considering a respondent’s argument that “twenty-four hour surveillance of any citizen of this country will be possible, without judicial knowledge or supervision,” the Court reserved judgement because, “if such dragnet type law enforcement practices as respondent envisions should eventually occur, there will be time enough then to determine whether different constitutional principles may be applicable.” Knotts, 460 U.S. at 283–84. As this case illustrates, round-the-clock surveillance for eighteen months is now unextraordinary.

This denial of Tuggle's motion to suppress is well-written and well-reasoned, even if it comes to a conclusion that does nothing to rein in extensive, prolonged surveillance by the government. While most opinions have a few highlights worth reading, the Seventh Circuit has delivered a comprehensive discussion that addresses the complicated issue without dragging the reader through the case law weeds. While it would have been nice to see the Seventh join the Fifth in prohibiting long-term surveillance without a warrant, at least this decision appears to have been handled with incredible care and raises questions Congress and other courts will need to answer sooner rather than later.

Filed Under: 4th amendment, 7th circuit, pole-mounted cameras, privacy, surveillance