AT&T Proclaims It Cannot Be Sued For Selling Your Location Data To Random Nitwits

from the ill-communication dept

You'll of course recall that wireless carriers are in the midst of a massive, ongoing scandal involving your location data. As in, they've been repeatedly caught collecting and selling your daily movement habits to a rotating crop of random nitwits, including stalkers and folks pretending to be law enforcement. And while they say they've stopped the practice there's no way to be sure, given that the current industry-friendly FCC has yet to pressure (or even mildly scold) them, much less conduct any real investigation into whether mobile carriers have actually stopped, or what they've done with location data collected over the last decade.

With regulatory capture ensuring that government is feckless in the face of the scandal, the EFF sued AT&T back in July on behalf of several California AT&T users who say they were never informed, nor gave consent, for their location data to be used and sold in this fashion. The lawsuit alleges that AT&T violated the Federal Communications Act by not protecting location data, and California's Unfair Competition Law and the Consumers Legal Remedies Act by misleading consumers as to the sale of this data. The group also pushed to have AT&T delete the trove of valuable location data it has already collected.

AT&T being AT&T, the company has responded by proclaiming that it cannot be sued because its customers have agreed to mandatory binding arbitration in their user contracts:

"AT&T is arguing that its customers can’t sue the company for selling location data to bounty hunters, according to recently filed court records. AT&T says the customers signed contracts that force them into arbitration, meaning consumers have to settle complaints privately with the company rather than in court."

For years, mobile carriers used contract fine print to prohibit its customers from suing them. Instead, users were forced to participate in binding arbitration, a system whereby company-employed arbitrators weigh the evidence -- and unsurprisingly rule in favor of the company employing them a dramatic majority of the time. Initially, lower courts repeatedly derided this behavior as an "unconscionable" curtailing of consumer rights and abuse of the law. But in 2011 the Supreme Court's AT&T Mobility v. Concepcion ruling declared that what AT&T was doing was perfectly okay, resulting in countless companies now following AT&T's lead.

AT&T's problem is this new case is pending in the US District Court for the Northern District of California. Last year this same court declared that AT&T couldn't use these binding arbitration agreements to avoid class action lawsuits over accusations AT&T had repeatedly lied to users about their "unlimited" data plans being throttled. Why? Because the California Supreme Court ruled in McGill v. Citibank that "an arbitration agreement that waives the right to seek the statutory remedy of public injunctive relief in any forum is contrary to California public policy and therefore unenforceable."

Enter AT&T, which is effectively arguing that because the EFF is only representing a handful of pissed off customers and not the public as a whole, that ruling doesn't apply:

" In the new case, AT&T argues that the McGill decision does not apply "because the injunctive relief Plaintiffs seek is directed at a subgroup of AT&T customers, not the general public as a whole."

Granted AT&T's tap dancing to avoid anything even vaguely resembling accountability is a thing to behold. Like other ISPs it had argued that states can't hold it accountable for wrong doing because it would violate the company's First Amendment rights. It has also tried to tap dance in and out of the lines of FTC and FCC authority making conflicting arguments on agency authority when convenient. Here, AT&T had previously denied that selling phone location data was illegal, despite the fact that Section 222 of the Communications Act clearly says it is "without the express prior authorization of the customer."

But other court rulings on other subjects (like this one on roaming fees in the Ninth Circuit U.S. Court of Appeals) have been poking holes in AT&T's arbitration arguments, suggesting it's not quite the bullet proof "get out of jail free card" AT&T's lawyers seem to think it is.

Filed Under: arbitration, data, privacy
Companies: at&t

Police Use Of Force Data Remains A Mess And The FBI's Involvement Isn't Making Anything Any Better

from the no-one-really-knows-and-those-that-might-now-don't-really-care dept

Trust me, it all goes downhill very fast from the opening statement.

The federal government recently released what some hoped would be the most accurate data on how police departments resolve civilian complaints of police brutality.

"Civilians" were really the only ones holding onto this hope. The FBI -- which has failed for years to collect reliable data on police shootings -- certainly isn't hoping it will ever compile a definitive dataset on cops killing citizens.

The law enforcement agencies who were voluntold to send in this data aren't hoping that, at some point in the distant future, they'll provide enough info that citizens can make informed decisions about their protectors/servants level of trigger-happiness.

Since no one with any power is truly interested in accurate data, it falls to private parties. For everyone else, there's the annual data dumps by the Bureau of Justice Statistics, which don't come anywhere close to telling the whole story about law enforcement use of force.

The report discussed here is the BJS's 2016 report. Working their way backwards from the official stats to the law enforcement agencies that supplied them, the Austin Statesman has found a whole lot of significant discrepancies.

For instance, the survey shows Austin police officers received 20 excessive force complaints in 2015, but Austin police officials said they actually received 22.

And while Austin police data and the survey both show authorities determined none of the complaints that year were sustained, there were some discrepancies. The survey says three complaints were unfounded, three were exonerated and 14 were closed administratively, but Austin police said their records show two complaints were unfounded, two were exonerated and 18 were closed administratively.

That one's a relatively minor blip, but when 4,000 law enforcement agencies are sending in bad stats, the numbers get skewed significantly. In some cases, the 4,000 participants (less than a quarter of all US law enforcement agencies) didn't provide any stats because they simply do not "formally document and store complaints." That was the excuse given by nearly 1,000 of the 4,000 "participating" agencies.

There are those who make it easy to under-report excessive force complaints simply by never bothering to collect this data. Then there are the 2,000 agencies who report obviously wrong numbers.

Of the other 3,000 agencies, two-thirds reported no excessive-force complaints in 2015, including police departments in San Diego and San Jose, Calif.

The San Jose internal affairs unit blamed this incredible discrepancy on the staffer who filled out the BJS form. Apparently, no corrective action was taken and the head of IA was left wondering why someone reporting complaints to the federal government might put down "0" instead of actually trying to get an accurate count. (Yeah it's a real mystery.)

That leaves about 1,000 reports that could be considered reliable. And these reports aren't going to make anyone believe accountability is spreading like wildfire through local law enforcement agencies. Nearly every excessive force complaint filed ends up being discarded.

[O]nly about 7% of formal excessive-force allegations are sustained.

[...]

Nationwide, around 26% of complaints are unfounded; among the rest, 34% end with exoneration and 22% are not sustained.

That's how it stands in the numbers that possibly can be trusted. Police agencies are exonerating their officers 93% of the time. The FBI is stepping up to make this collection more complete, expanding its coverage of police shooting data to cover times where officers shot at people, wounded them, or killed them. That small expansion won't make much difference. Most excessive force allegations don't involve deployments of deadly force. Those that do tend to result in lawsuits, not ignored complaints. The only thing the FBI is doing here is expanding its already-unreliable dataset -- one that tells an incomplete story about US policing as crafted by a few thousand unreliable narrators.

Filed Under: data, fbi, law enforcement, police, use of force

The DMV Is Selling Your Data To Vast Array Of Third Parties

from the dysfunction-junction dept

Another day, another data privacy scandal. This time the focus is on the Department of Motor Vehicles, which has been busted selling DMV user data to a laundry list of third parties, without always making such financial relationships or data transfers clear to patrons. Some of the data wound up being sold to the usual suspects (auto insurance companies being the most obvious), but much of it is routinely sold to more dubious third-party outfits and private investigators. And while some of the data is in bulk and "anonymized," we've long noted that doesn't mean what you think it does.

The collection and sale of sensitive user data is particularly problematic for those dealing with stalkers or other jackasses:

"The selling of personally identifying information to third parties is broadly a privacy issue for all and specifically a safety issue for survivors of abuse, including domestic violence, sexual assault, stalking, and trafficking," Erica Olsen, director of Safety Net at the National Network to End Domestic Violence, told Motherboard in an email. "For survivors, their safety may depend on their ability to keep this type of information private."

Granted all of this is perfectly legal due to the Driver's Privacy Protection Act (DPPA), a 90's law that critics say is in dire need of an update. That law was created in response to a series of abuses of DMV data, including the 1989 murder of actress Rebecca Schaeffer, after her killer obtained her home address from the DMV. And while the law was intended to stop the abuse of DMV data, it contained (surprise!) plenty of loopholes making it okay to sell this data to a wide variety of individuals, including PIs, bail bondsmen, and consumer credit reporting agencies.

While the data sold can vary from state to state, it generally includes names, addresses, zip codes, dates of birth, phone numbers, and email addresses. The documents obtained by Motherboard show that the Wisconsin DMV, for example, has personal data sales relationships with more than 3,100 different entities. The practice is, unsurprisingly, hugely profitable:

"DMVs are making a lot of money from the sale of this data. The Rhode Island DMV made at least $384,000 selling personal data between 2015 and this year, according to a spreadsheet obtained by Motherboard. When asked how much the Wisconsin DMV made from selling driver records, a spokesperson wrote in an email "Per these 2018 DMV Facts and Figures, $17,140,914 was collected in FY18 for driver abstract fees." Examining that document shows that Wisconsin's revenue for selling driver records has shot up dramatically since 2015, when the sale drew in $1.1 million. The Florida Department of Highway Safety and Motor Vehicles made $77 million in 2017 by selling data, a local outlet found."

Most DMVs say that they inform customers (in fine print) that their data may be sold, and that they've cut off access to data by firms that they've found to have abused the access. But given the wild west nature of US privacy law (read: we don't have many and the ones we do have are riddled with issues and loopholes), there's not much of a mechanism to confirm this data isn't being abused, or that DMVs are doing a particularly good job of dealing with issues when the data is being access by malicious parties. In response to the investigation, Presidential hopeful Bernie Sanders demanded more comprehensive oversight:

"The DMV should not use its trove of personal information as a tool to make money. While the internet has been an enormous source for good, all that convenience and connection has come with a price: our privacy has been invaded in an unprecedented way, in a manner that would have been unthinkable even 20 years ago. Nobody—from agencies like the DMV to large corporations like Facebook and Google—should be profiting from sharing or selling personal information without meaningful consent. Congress must get serious about ending practices that violate the privacy of ordinary Americans.

Granted it's hard to reform US privacy law when a broad coalition of industries are using every lobbying trick in the book to prevent said reform from taking place. And while a lot of companies publicly state they want a new privacy law, what they really mean is for Congress to pass another flimsy, loophole-filled law their lawyers wrote, that will primarily serve to pre-empt more comprehensive state and federal privacy proposals.

Filed Under: data, dmv, privacy, selling data

White House Now Thinks Harvesting Fitness Tracker Data Could Stop The Next Mass Shooting

from the no-conceivable-downsides-no-sir dept

In the wake of more mass shootings, everything coming from up top has been bat shit insane. The Trump Administration has a bunch of suggestions, and they're no better than those offered by a bunch of policy makers who think pulling the plug on certain areas of the internet will somehow reduce the frequency of mass shootings in the US.

Despite being able to do actually useful things at the federal level, Trump has decided preventing gun violence should be everyone else's job. First, he declared it's time for social media companies to engage in even greater vetting of users' posts, apparently in hopes of finding the next mass shooter before they start shooting.

We're headed to pre-crime territory, with the feds in tow. Working together, these entities can be expected to create a massive mess -- one that criminalizes words and will result in plenty of non-dangerous people spending more time interacting with federal agents. This isn't going to solve the problem. It's only going to create a new set of problems, waste limited law enforcement resources, and deprive people of their rights and liberties.

So, of course, the Trump administration is out there trying to make a bad situation even worse. Working backwards from a stillborn idea to come up with a catchy acronym, the White House brain trust is planning on inflicting this on America:

Last week, the Washington Post reported that the White House had been briefed on a plan to create an agency called HARPA, a healthcare counterpart to the Pentagon’s research and development arm DARPA. Among other initiatives, this new agency would reportedly collect volunteer data from a suite of smart devices, including Apple Watches, Fitbits, Amazon Echos, and Google Homes in order to identify “neurobehavioral signs” of “someone headed toward a violent explosive act.” The project would then use artificial intelligence to create a “sensor suite” to flag mental changes that make violence more likely.

According to the Post, the HARPA proposal was discussed with senior White House officials as early as June 2017, but has “gained momentum” after the mass shootings in El Paso, Texas, and Dayton, Ohio. The latest version of the plan, reportedly submitted to the Trump administration this month, outlined the biometric project called “SAFE HOME,” an acronym for “Stopping Aberrant Fatal Events by Helping Overcome Mental Extremes.”

Jesus Christ. Doesn't take long for dystopia to take hold. We already knew every fitness tracking device is, first and foremost, a TRACKING device. They generate the sort of data cops and terrorists alike like getting their hands on. Now, the administration is suggesting this data will be able to stop killers before they kill by looking for elevated pulse rates or, I don't know, heart conditions common to mass shooters. Or whatever.

Somehow, this patchwork of "volunteer data" will be Frankensteined into a "multi-modality solution" that can provide the government with "early diagnoses of neuropsychiatric violence." Ok, then. But can it even do this? Or will analysts pore over tons of garbage data looking for patterns that don't actually exist -- all while being pressured to prevent mass shootings? If so, the desire to show the program works might overwhelm the desire to proceed in a scientific manner, leading to garbage outputs more aligned with numerology enthusiasts and that Timecube guy.

Expecting anything "advanced" from a fitness tracker is asking for trouble. As Emily Gorecenski points out on Twitter, a FitBit can somehow detect the heartbeat in the breast from a chicken that's been killed, butchered, processed, packaged, sent to a grocery store, and purchased by a consumer.

These are the tools we're going to use to do pre-crime? This is the scientific wonder that's going to track down mass shooters before they can kill anybody? If we're lucky, we'll all live long enough to regret this.

Once you get past the HARPA buzzwords and the shininess of the tech toys, you're left with the unpleasant feeling this is going to result in people being hustled off the street by black-clad government agents and rushed to the nearest reeducation center.

“Creating a watchlist of citizens who most likely will never act violently based on their mental health is a very dangerous proposal with major ethical considerations,” Emma Fridel, a doctoral candidate at Northeastern University specializing in mass murder, told Gizmodo in an email. “Doing so to predict the unpredictable is utterly absurd.”

This system will be little more than an efficient generator of false positives. Adopting as much intrusive surveillance as possible as quickly as possible is bound to result in a few prevented crimes. So would random house searches and 24-hour police checkpoints. Backing into this with a catchy acronym, technobabble, and a bunch of junk science isn't acceptable. The government may feel obligated to do something about mass shootings, but everything it has come up with so far has been resolutely terrible, if not terrifying.

Filed Under: data, fitness trackers, guns, mass shootings, school shootings, surveillance, trump administration

The GDPR Is A Wide Open Vulnerability For Identity Fraud And Scams

from the how-does-this-help-privacy-again? dept

We've spent the last year and a half or so pointing out that, while it may have been well-intentioned, there are all sorts of consequences -- whether intended or not -- to the EU's General Data Protection Regulation (GDPR), including giving more power to the giant internet companies (when many argued the GDPR was necessary to curb their power), censorship of media, and a way for the rich and famous to harass people. But, of course, some might argue that those are worthy trade-offs if it did a better job protecting people's privacy.

About that... Last year, we pointed out that one consequence of the GDPR was that, in making it easy to "download" your data, it could open up serious privacy consequences for anyone who has their accounts hacked. In that story, we talked about someone having their Spotify account hacked, and having all the data downloaded -- a situation that might not be that impactful. However, last week, at Black Hat, James Pavur, a PhD student at Oxford, explained how he exploited the GDPR to access a ton of private info about his fiancee.

In a presentation at the Black Hat security conference in Las Vegas James Pavur, a PhD student at Oxford University who usually specialises in satellite hacking, explained how he was able to game the GDPR system to get all kinds of useful information on his fiancée, including credit card and social security numbers, passwords, and even her mother's maiden name.

"Privacy laws, like any other infosecurity control, have exploitable vulnerabilities," he said. "If we'd look at these vulnerabilities before the law was enacted, we could pick up on them."

In other words, in giving more "protection" over data, the EU has also opened up a new vulnerability. Here's how it worked:

Over the space of two months Pavur sent out 150 GDPR requests in his fiancée's name, asking for all and any data on her. In all, 72 per cent of companies replied back, and 83 companies said that they had information on her.

Interestingly, five per cent of responses, mainly from large US companies, said that they weren’t liable to GDPR rules. They may be in for a rude shock if they have a meaningful presence in the EU and come before the courts.

Of the responses, 24 per cent simply accepted an email address and phone number as proof of identity and sent over any files they had on his fiancée. A further 16 per cent requested easily forged ID information and 3 per cent took the rather extreme step of simply deleting her accounts.

That last one is kind of fascinating. What companies delete the accounts of people making a GDPR request? At least some of the companies required login info, but Pavur noted that in one case, he told the company he'd forgotten the login... and they gave him the data anyway.

"An organisation she had never heard of, and never interacted with, had some of the most sensitive data about her," he said. "GDPR provided a pretext for anyone in the world to collect that information."

This could be fixed, and one could argue that companies handing out this info without real proof of ID are, themselves, in violation of the GDPR. But, given that the GDPR is so strict -- you have a very short time frame to return the info or face massive fines), the incentive structure is designed to ignore those formalities and just fork over the information -- even if it's right into the hands of a scammer.

Filed Under: data, downloads, fraud, gdpr, privacy

The Great Hack Wasn't A Hack And Big Tech's Problems Aren't Really About Big Tech

from the symptoms-not-the-disease dept

There must be some irony in the fact that the well-hyped documentary film about Cambridge Analytica/Facebook, called The Great Hack was released by Netflix -- a company who really is kinda famous for trying to suck up as much data as possible to build a better algorithm to keep you using its service more -- and potentially violating people's privacy in the process. I know it's ancient history in terms of internet years, and everyone has decided that Facebook and Google are the root of all internet/data evils, but back in 2006, Netflix launched a contest, offering $1 million to anyone who could "improve" its recommendation algorithm over a certain threshold. It took a few years, but the company awarded the $1 million to a team that improved its algorithm -- though, it never actually implemented that algorithm, claiming that the benefits "did not seem to justify the engineering effort."

But, perhaps more interesting, was that while the contest was ongoing, some computer scientists de-anonymized the dataset that Netflix had released, leading some to point out that the whole project almost certainly violated the law. Eventually, Netflix shuttered its plans for a follow up contest as part of a legal settlement regarding the privacy violations of the original.

So, perhaps feel a bit conflicted when Netflix's vaunted algorithm recommends "The Great Hack" for you to watch.

This is not to say the documentary is not important, but it does highlight our troubling desire to immediately point fingers and describe certain things as "evil." Even the name -- The Great Hack -- is ridiculously misleading. Nothing Cambridge Analytica did involved a "hack" in the way most people think of the word. Yes, you could argue that it was a "hack" of the larger system -- using Facebook's platform in a way that was not intended, but easily done, but it didn't involve any technical proficiency. Just a willingness to use the data that way.

But, it's interesting to me to see the press rush in to use the documentary as the exclamation point to the narrative that's become popular these days: that Silicon Valley is too obsessed with collecting data as a business model. Janus Rose, at Vice, has a big piece that describes the movie as a condemnation of "surveillance capitalism."

The real “great hack” isn’t Cambridge’s ill-gotten data or Facebook’s failure to protect it. It’s the entire business model of Silicon Valley, which has incentivized the use of personal data to manipulate human behavior on a massive scale.

Emily Dreyfuss at Wired, paints a similar portrait:

In that way, The Great Hack is a modern horror story. The villain is Cambridge Analytica, yes, but also Facebook, and all the systems that let people become manipulated by the digital psychological clues they leave through their lives. It's terrifying because it's true.

Natasha Lomas at TechCrunch, points out that Netflix is revealing "the defining story of our time" in the transactional nature of data on social platforms:

But in displaying the ruthlessly transactional underpinnings of social platforms where the world’s smartphone users go to kill time, unwittingly trading away their agency in the process, Netflix has really just begun to open up the defining story of our time.

Oddly, none of them mention Netflix's algorithm and history. Ah, right. Because the narrative these days is Facebook/Google/Silicon Valley. Netflix has mostly migrated south to Hollywood. And, Hollywood and the media industry have no history at all of "manipulating" the public. Nope, no history of that at all.

None of this is to absolve Silicon Valley and the big tech companies -- who really have done a piss poor job of thinking through the consequences of basically anything they've done, but forgive me for being marginally skeptical when the same industries that have a long history of pushing propaganda and trying to manipulate audiences in one direction or another suddenly start clutching pearls at the new kids on the block.

And if you want to point fingers, there are lots of directions they could go as well. All the internet haters seem to have glommed onto Shosana Zuboff's term "Surveillance Capitalism" as a sort of shibboleth to the savvy to show that you know (you know) those internet companies are truly evil in their hearts. But taken to its logical extreme, one might as well blame Wall Street. When you have a company, say, like Pinterest, that tries to avoid social media "growth hacking" then Wall St. punishes it. Witness the ongoing freakout through the past few months from Wall St. as it grapples with Alphabet/Google's revenue growth slowing.

If companies are constantly being told that they have a "fiduciary duty" to increase the stock, and Wall Street flips out any time they can't keep growing at insane, unsustainable rates, is it any wonder that all of the incentives lead us to a place where companies focus heavily on growth?

Again, this is not an excuse. It's all a problem. But we don't solve large societal problems by picking off one symptom of the disease that's really just a link in a larger societal chain. Surveillance capitalism is a symptom. Abusive data practices are a symptom. Propaganda and political grandstanding are symptoms. There are big societal problems at the root of all this -- but very few seem to be interested in exploring what they are and how to deal with them. Instead, we just get one part of the surveillance capitalist propaganda machine to convince everyone that another part of the surveillance capitalist propaganda machine is the problem. And, because that bit of propaganda is successfully manipulative and compelling, lots of people buy into it.

The narrative is here and it won't be changed.

Now, what does Netflix recommend we watch next?

Filed Under: algorithms, data, growth, influence, innovation, privacy, recommendations, surveillance capitalism, the great hack, wall st.
Companies: facebook, google, netflix

Once More With Feeling: 'Anonymized' Data Is Not Really Anonymous

from the nothing-to-see-here dept

As companies and governments increasingly hoover up our personal data, a common refrain to keep people from worrying is the claim that nothing can go wrong because the data itself is "anonymized" or stripped of personal detail. But time and time again, we've noted how this really is cold comfort; given it takes only a little effort to pretty quickly identify a person based on access to other data sets. Yet most companies (including cell phone companies that sell your location data) act as if "anonymizing" your data is iron-clad protection from having it identified. It's simply not true.

The latest case in point: in new research published this week in the journal Nature Communications, data scientists from Imperial College London and UCLouvain found that it wasn't particularly hard for companies (or, anybody else) to identify the person behind "anonymized" data using other data sets. More specifically, the researchers developed a machine learning model that was able to correctly re-identify 99.98% of Americans in any anonymised dataset using just 15 characteristics including age, gender and marital status:

"While there might be a lot of people who are in their thirties, male, and living in New York City, far fewer of them were also born on 5 January, are driving a red sports car, and live with two kids (both girls) and one dog,” explained study first author Dr Luc Rocher, from UCLouvain."

And using fifteen datasets is actually pretty high for this sort of study. One investigation of "anonymized" user credit card data by MIT found that users could be correctly "de-anonymized" 90 percent of the time using just four relatively vague points of information. Another study looking at vehicle data found that 15 minutes’ worth of data from just brake pedal use could lead them to choose the right driver, out of 15 options, 90% of the time.

The problem, of course, comes when multiple leaked data sets are released in the wild and can be cross referenced by attackers (state sponsored or otherwise), de-anonymized, then abused. The researchers in this new study were quick to proclaim how government and industry proclamations of "don't worry, it's anonymized!" are dangerous and inadequate:

"Companies and governments have downplayed the risk of re-identification by arguing that the datasets they sell are always incomplete,” said senior author Dr Yves-Alexandre de Montjoye, from Imperial’s Department of Computing, and Data Science Institute. "Our findings contradict this and demonstrate that an attacker could easily and accurately estimate the likelihood that the record they found belongs to the person they are looking for."

It's not clear how many studies like this we need before we stop using "anonymized" as some kind of magic word in privacy circles, but it's apparently going to need to be a few dozen more.

Filed Under: anonymity, anonymized data, data, privacy

The FTC And Facebook: Why The $5 Billion Fine Is Both Too Little And Too Much

from the pointless-gestures dept

By now, you've certainly heard the news that was very likely leaked by Facebook late on Friday that the FTC, by a narrow 3 to 2 party line vote, had approved a $5 billion fine for Facebook for violating its earlier consent decree in the way it allowed an app to suck up lots of data that eventually ended up in Cambridge Analytica's hands. Most of the reaction to this fine (by far, the largest in the FTC's history) is anger.

Many people focused on one key point to argue that the fine wasn't enough: Facebook's stock jumped upwards after the news broke, to the point that Facebook's valuation probably went up more than the amount of the fine itself (never mind the difference between the value of equity and actual cashflow...). However, I wouldn't read too much into the stock jump. After all, Facebook had already said back in April that it was expecting a $5 billion fine, meaning that Wall Street had already priced in exactly that. If the $5 billion fine had come out of the blue it might have been a different story. The bump, then, could be explained by investors reacting to the end of any uncertainty and the fear that the fine might have been larger.

That said, there are good arguments for why this is a really significant fine. And for that, I'll turn to the former acting-CTO of the FTC, Neil Chilson, who knows a thing or two about how the FTC works, and points out that this sort of thing is extremely aggressive (and this part is important): given the FTC's mandates and powers. As he notes:

The FTC is using an extremely general law intended to stop or redress practices that harm consumers. It is reportedly getting a settlement that is 225x larger than the prev. record. And it got this for practices where AFAIK no consumer lost a penny. Laws have meaning. There is only so far an agency can push the commands of Congress before a court will slap them back (as has happened to the FTC a few times recently.) This settlement is, I think, probably at the bleeding edge of the FTC's litigation risk. If you're angry about this settlement, calling the FTC a "co-conspirator" is ridiculous. The FTC has been an aggressive privacy enforcer using a statute that isn't specifically intended to protect privacy. That's on Congress. If you don't like it, talk to your lawmaker.

In short, given the FTC's powers and the details of what happened with Cambridge Analytica, where the "harms" are not directly quantifiable (you can argue harms against democracy, but that would require a bit more actual evidence and is not the FTC's mandate...), a $5 billion fine is quite a lot. So, frankly, attacking it as "an embarrassing joke" or "a tap on the wrist" or even "a victory for Facebook" seems to be missing the point.

That said, what I think all this anger is getting at -- and which I mostly agree on -- is that we still have not figured out a way to adequately deal with privacy in a digital age. And people are (partly reasonably, partly irrationally) very mad at Facebook for that. Part of the problem here, however, is expecting that a single FTC action is somehow magically going to fix all of that. It can't. No amount would have done that, and it's quite unlikely that any restrictions the FTC puts forth as part of this agreement are going to fix that either. So, I can totally understand the anger and annoyance at this particular settlement -- but it's not as if anything the FTC would have done here would have satisfied most people.

And, of course, this one FTC action is hardly the end of the line. The EU and other countries are still likely to come down hard on Facebook, and the company is still facing antitrust questions as well. And, then there's Congress. At some point, Congress will put forth various privacy bills (and various states may follow California's dubious lead in doing so as well).

In short: this is a significant fine, given the FTC's mandate and the issue at hand. And if you think it's "not enough" because it won't hobble Facebook, well, then you're correct. But the FTC's mandate isn't to randomly hobble companies because people are angry at them.

Facebook is going to be facing a long line of angry regulator and legislators, and that seems unlikely to change as a result of this fine (indeed, it appears to have inspired many to increase their efforts to "do something").

Filed Under: consumer harms, data, fines, ftc, privacy, punishment
Companies: facebook

Hackers Have Been Stealing User Data From Global Cell Networks Since 2012

from the whoops-a-daisy dept

We've noted for a long time that the wireless industry is prone to being fairly lax on security and consumer privacy. One example is the recent rabbit hole of a scandal related to the industry's treatment of user location data, which carriers have long sold to a wide array of middlemen without much thought as to how this data could be (and routinely is) abused. Another example is the industry's refusal to address the longstanding flaws in Signaling System 7 (SS7, or Common Channel Signalling System 7 in the US), a series of protocols hackers can exploit to track user location, dodge encryption, and even record private conversations.

This week, carriers were once again exposed for not being the shining beacons of security they tend to advertise themselves as. A new report emerged this week showcasing how, for years, hackers have been exploiting substandard security at more than 10 global wireless carriers to obtain massive troves of data on specific targets of interest. Researchers at Boston-based Cybereason, who first discovered the operation, say the hackers exploited a vulnerability on an internet-connected web server to gain a foothold into each cell providers internal network. Once inside, they exploited numerous machines to gain a deeper and deeper access to the cell network:

"You could see straight away that they know what they’re after,” said Amit Serper, head of security research at Cybereason. “They would exploit one machine that was publicly accessible through the internet, dump the credentials from that machine, use the credentials stolen from the first machine and repeat the whole process several times.”

Once the hackers gained access to the domain controller, the hackers had control of the entire network. “Everything is completely owned,” said Serper.

Comforting! Hackers, presumed to likely be state actors pilfering user data invisibly, then extracted gigabytes of data on targets without having to install malware on the target's local phone. It's not clear which state actors were involved; researchers suggest it was either China, or somebody eager to make it appear it was China:

"Cybereason did say it was with “very high probability” that the hackers were backed by a nation state but the researchers were reluctant to definitively pin the blame.

The tools and the techniques — such as the malware used by the hackers — appeared to be “textbook APT 10,” referring to a hacker group believed to be backed by China, but Div said it was either APT 10, “or someone that wants us to go public and say it’s [APT 10]."

So far the researchers say no North American cell providers have been confirmed as targets, but given the stealth nature of the intrusions and how long they were being conducted without detection, that's likely no guarantee intrusions didn't happen all the same. The full report indicates this effort has been underway since at least 2012, again highlighting how global cellular networks may not quite be the bastions of security wireless carriers often profess them to be.

Filed Under: data, hackers, mobile networks, ss7

Once Again: It's Not Clear The Internet Needs Creepy Targeted Ads

from the things-work-out dept

There seems to be a general argument, perhaps believed by folks at Google and Facebook in particular, that they need to suck up all this data about us to provide more and more targeted advertising. I'm still not at all convinced that's true. Earlier this year, I suggested that Google and Facebook might be better off if they just admitted that targeted advertising didn't work as well as people like to pretend it works. The fact is that it doesn't work all that well, and comes with massive costs in terms of everyone thinking that all these companies want to do is suck up more and more data. And the "advantage" over other forms of advertising (contextual, brand, etc.) are really not that great. Earlier this month we highlighted a study that showed that, for publishers, targeted advertising didn't show any real benefit, and that it was mainly being used to prop up the fees middlemen got, in being able to claim some magic sauce to better target ads.

Now, the NY Times has published an op-ed by DuckDuckGo CEO, Gabriel Weinberg making the exact same point: the internet doesn't need creepy advertising to have a workable business model. Indeed, what made Google a success in the first place was the fact that its non-creepy, non-privacy instrusive contextual advertising was so freaking profitable because it worked amazingly well:

There is no reason to fear that sites cannot still make money with advertising. That’s because there are already two kinds of highly profitable online ads: contextual ads, based on the content being shown on screen, and behavioral ads , based on personal data collected about the person viewing the ad. Behavioral ads work by tracking your online behavior and compiling a profile about you using your internet activities (and even your offline activities in some cases) to send you targeted ads.

Contextual advertising doesn’t need to know anything about you: Search for “car” and you get a car ad. Over the past decade, contextual ads have been displaced by behavioral ads, aided by the rise of real-time bidding technology that auctions off each ad on a site based on user profiling. These behavioral ads are the ones that leave a bad taste in your mouth. They follow you around from website to mobile app based on your private information and, intentionally or not, enable online discrimination, manipulation and the creation of filter bubbles.

I'd argue that Weinberg leaves out general brand advertising as well, which can work well. Part of the problem, though, is that behavioral and programmatic advertising gives the illusion of being "scientific" because you can show data (even if that data is meaningless or misleading). As soon as you can insist that you'll be able to show data, then people get wowed by it, and think that they've magically solved the "I know that half of my ad spending is wasted, I just don't know which half" problem. But the real problem is that even with all this behavioral targeting, most advertisers are still wasting way more than half their ad spend. It's just that they can show pretty charts and spreadsheets to pretend they have data to back up that they're doing the right thing.

This is a point we've raised before. We've been talking to companies for a few years now, trying to convince them to advertise on Techdirt in a non-creepy way with no tracking. And what has happened, multiple times, is that a marketing person gets excited and talks about how "this is great" and how they know that they can get a lot of people interested in what they're offering if they were to support Techdirt just knowing that our audience would appreciate them being cool enough not to track them. And then it gets handed off to an ad team or a digital agency or an ad firm that they outsource this stuff to, and eventually someone has a spreadsheet. And doing a branding campaign without creepy tracking doesn't fit into a spreadsheet. So they pass. And waste a bunch of money on someone who will give them data, no matter how meaningless.

Weinberg is right that there's no reason it needs to be this way. It's just that some people have become so enamored with "data" that they don't bother to understand what actually works.

On top of that, he points out that focusing on creepy ads has lots of other costs as well -- including pissing off your users who are much more open to alternatives.

What about compliance costs? Companies are quickly realizing that good privacy practices are a boon for business. People increasingly want to reduce their digital footprint and so choose companies that help them do so. Companies with good privacy practices in their DNA do not face significant compliance costs.

Much of Weinberg's op-ed is in support of stronger privacy laws, and I'm less in agreement with him there. I'm not against all privacy rules -- but I do worry about the unintended consequences of many of the approaches proposed. Not on the revenue prospects for Google or Facebook. As noted above, they don't need to be so creepy. But, on how it might impact other aspects of the internet. We've already seen this with the GDPR and how it's being used to stifle speech and actually entrench the power of Google and Facebook. I honestly just wish that companies -- both the internet ones and the advertisers who buy the ads -- would just start to realize that sucking up all this data may have sounded like a good idea, but has actually been a complete failure, and start to move away from that model. It's not necessary.

Filed Under: brand advertising, contextual advertising, data, privacy, privacy laws, surveillance capitalism, targeted advertising
Companies: duckduckgo, facebook, google