How Sketchy Data Scavengers Are Using Hatred Of 'Big Tech' To Attack Plans To Make The Web More Private

from the be-careful-what-you-wish-for dept

We warned that this was likely back when Google announced plans to phase out third-party cookies in Chrome (something all the other major browser makers had already done): that this would be used to attack Google as being anti-competitive, even as it was pro-privacy. Privacy and competition do not need to be in conflict, but they can be. And what's happening now is that more sketchy ad companies are abusing the constant drumbeat and fear over "Big Tech" to attack privacy protections -- but that behind the scenes story is getting missed as people are more focused on more breaking news about how Google has decided to push back its move on 3rd party cookies for two more years.

Issie Lapowsky, over at Protocol, has a must read story on how sketchy ad and data brokers have crashed the W3C, riding a wave of anti-big tech feelings to push for worse solutions for everyone as it comes to privacy (of course, Facebook is on the wrong side of this as well -- it's basically all the sketchy companies and Facebook against all the other companies). It's quite a story.

On one side are engineers who build browsers at Apple, Google, Mozilla, Brave and Microsoft. These companies are frequent competitors that have come to embrace web privacy on drastically different timelines. But they've all heard the call of both global regulators and their own users, and are turning to the W3C to develop new privacy-protective standards to replace the tracking techniques businesses have long relied on.

On the other side are companies that use cross-site tracking for things like website optimization and advertising, and are fighting for their industry's very survival. That includes small firms like Rosewell's, but also giants of the industry, like Facebook.

Much of the story focuses on James Rosewell, who runs a "data analytics" company, and joined the W3C apparently just to throw a wrench in any real effort to beef up privacy protections as a core element of the internet.

Rosewell has become one of this side's most committed foot soldiers since he joined the W3C last April. Where Facebook's developers can only offer cautious edits to Apple and Google's privacy proposals, knowing full well that every exchange within the W3C is part of the public record, Rosewell is decidedly less constrained. On any given day, you can find him in groups dedicated to privacy or web advertising, diving into conversations about new standards browsers are considering.

Rather than asking technical questions about how to make browsers' privacy specifications work better, he often asks philosophical ones, like whether anyone really wants their browser making certain privacy decisions for them at all. He's filled the W3C's forums with concerns about its underlying procedures, sometimes a dozen at a time, and has called upon the W3C's leadership to more clearly articulate the values for which the organization stands.

His exchanges with other members of the group tend to have the flavor of Hamilton and Burr's last letters — overly polite, but pulsing with contempt. "I prioritize clarity over social harmony," Rosewell said.

Rosewell and his companions are leaning hard on the idea that if privacy is actually protected, then only Google, Apple, and Microsoft will control the internet. But that's bullshit -- and thankfully, the privacy-focused browser Brave has people willing to call it out as such:

"They use cynical terms like: 'We're here to protect user choice' or 'We're here to protect the open web' or, frankly, horseshit like this," said Pete Snyder, director of privacy at Brave, which makes an anti-tracking browser. "They're there to slow down privacy protections that the browsers are creating."

The article also notes that these more sketchy data brokers (and Facebook) are not just looking to derail the more privacy protective approaches of the browser makers, but to create new standards that would enshrine the surveillance aspect of the web. And, again, they're playing on the general sentiment against "big tech" to try to push that across.

That's only the beginning of the article, it then goes into great detail on the history here (including the fight over "Do Not Track"), and how Rosewell and his colleagues are trying to throw sand in the gears of the W3C to basically wipe out any real movement towards better standards on privacy. And also how Facebook is quietly cheering on Rosewell and folks.

It may sound like a boring and wonky discussion, but it's hugely important for understand the future of the open internet and privacy, and how competition questions are impacted by these things. All of this is important, but the various things -- privacy, competition, content moderation, etc -- are often looked at as separate buckets. But bad choices in one will inevitably impact the others as well. For those who care about privacy online, this story (which goes into a lot more detail) is a must read.

Filed Under: 3rd party cookies, data brokers, privacy, standards, tracking, web browsing
Companies: apple, facebook, google, w3c

Maine Legislature Enacts Strictest Facial Recognition Limitations In The Country

from the hopefully-there-are-49-competitors-seeking-to-top-this dept

From out of nowhere, the state of Maine has taken the lead in protecting its residents from the steady encroachment of facial recognition technology. A bill [PDF] recently passed by both sides of the state legislature has become law and makes Maine the standard bearer for future facial recognition tech bans.

Maine has enacted the country’s strongest statewide facial recognition law. Maine’s law prohibits the use of facial recognition technology in most areas of government, including in public schools, and for surveillance purposes. It strictly regulates how law enforcement officials may use facial recognition technology.

This law is more restrictive than anything else passed by a state legislature to date. California's ban on facial recognition tech only prevents law enforcement from utilizing the tech in their body cameras, ensuring these tools remain more focused on police accountability, rather than just an extension of existing surveillance programs.

The state of Washington also passed its own ban recently. But that bill -- which was supported by law enforcement agencies -- isn't really a ban or a moratorium. The tech is still permitted to be used. There are new restrictions in place, though. Using it to engage in real-time surveillance now requires a warrant. And if any state agency wants to start using the tech, it needs to provide public notice, hold at least three community meetings to hear objections, and perform a privacy impact assessment before deploying it.

Maine's new regulations have none of those drawbacks or concessions. No government agency at any level is permitted to use or acquire this tech. And use of the tech is limited to a small list of exceptions, which should prevent state and local agencies from asking federal agencies or those in nearby states to launder their facial recognition searches for them.

Here is the single exception to the ban and the stipulations that accompany it.

Under Maine’s rules, law enforcement may request a facial recognition search from the FBI and the state’s Bureau of Motor Vehicles (BMV) if they have probable cause to believe an unidentified person in an image has committed a serious crime. The BMV and the Maine State Police are required to collect data on search requests from law enforcement. The law stipulates that the results of a facial recognition search do not alone constitute probable cause for law enforcement officers to arrest or search a person. Individuals may bring a lawsuit if they believe a government agency or official has violated the law.

And this exception for serious crimes actually means serious crimes, rather than whatever cops want to declare "serious" to access the tech.

I. "Serious crime" means:

(1) A crime under the laws of this State that:

(a) Is punishable by a term of imprisonment of one year or more; or

(b) Is a Class D or Class E crime under the laws of this State that is a violation 18 of Title 17-A, chapter 9, 11, 12, 13 or 35; Title 15, section 1092, if the violation is based on a condition under Title 15, section 1026, subsection 3, paragraph A, subparagraph (5) or (8); or Title 19-A, section 4011…

That list of crimes includes murder, assault, kidnapping, sexual assault, sexual assault of minors, and sex trafficking. Also included: violating protective orders or bail conditions. This should keep cops from pestering the FBI to find who's been shoplifting or whatever. Anything that doesn't comply with this law is de facto unlawful and cannot be used as evidence in prosecutions.

The law also gives residents the right to sue if they feel they've been illegally subjected to this tech.

It's the strongest facial recognition ban in the nation. And it still allows law enforcement to make use of it through a couple of conduits if they're willing to jump through the very reasonable hoops the law has erected.

Filed Under: facial recognition, government, maine, police, privacy, schools

Canadian Privacy Commissioner Says RCMP Broke The Law By Doing Business With Clearview

from the nice-work,-law-enforcers dept

Since its unceremonious exposure by the New York Times, internet-scraping facial recognition tech company Clearview has been the subject of nothing but negative press, lawsuits, and law enforcement denials of its self-proclaimed crime fighting abilities. Apparently to the surprise of Clearview, few people were receptive to the idea of having their personal info scraped from the web by the company and served up to law enforcement officers, private companies security personnel, and any billionaire wondering about what to throw their money at.

The dubious legality of its efforts has seen Clearview exit certain markets in the United States. It has also exited an entire nation, pulling the plug in Canada while under investigation by the country's Privacy Commissioner.

Earlier this year, the Privacy Commissioner released part of its report, finding that Clearview's offering was mass surveillance that was illegal under federal and provincial laws. The second half of its investigation deals with the Royal Canadian Mounted Police and its use of Clearview during investigations. The Commissioner's conclusion? The RCMP also broke the law.

[O]ur most recent investigation has concluded that the RCMP contravened the federal public sector law, the Privacy Act, when it collected information from Clearview. In our view, a government institution simply cannot collect personal information from a third party agent if that third party’s collection was unlawful in the first place.

According to the Privacy Commissioner, RCMP violated the Privacy Act by using Clearview to search for information about citizens. It doesn't matter that the database used to perform these searches was owned and maintained by a private company. If Clearview violated Canadian laws collecting and providing access to this data, the RCMP similarly broke the law when it accessed it.

The Commissioner notes the RCMP still does not believe it did anything wrong.

The RCMP is no longer using Clearview AI as the company ceased to offer its services in Canada in July 2020 in the wake of our then ongoing investigation. However, we remain concerned that the RCMP did not agree with our conclusion that it contravened the Privacy Act. The RCMP argued section 4 of the Privacy Act does not expressly impose a duty to confirm the legal basis for the collection of personal information by its private sector partners. Requiring the RCMP to ensure a third party’s legal compliance with PIPEDA would create an unreasonable obligation on the RCMP, the RCMP maintained.

That's a pretty interesting counterpoint by the RCMP. It basically argues it should be able to do business with outside vendors that break the law. Despite its spicy take on the legalities of paying third parties to break the law for it, the RCMP has agreed to revamp its policies and procedures to provide more control and direct oversight of tech use by its investigators and officers.

But if the RCMP was so sure it was in the right, one has to wonder why it attempted to downplay its use of Clearview to mislead the Commission's investigators.

We were also concerned that the RCMP at first erroneously told our office it was not using Clearview AI. When it later acknowledged its use, it said publicly it had only used the company’s technology in a limited way, primarily for identifying, locating and rescuing children who have been, or are, victims of online sexual abuse.

However, our investigation found the RCMP did not satisfactorily account for the vast majority of the searches it made.

These don't appear to be the actions of an agency that firmly believes it's in the clear, legally speaking. The most generous take is that the RCMP wasn't tracking use of Clearview by its employees, which is its own problem and one hopefully addressed by the recommendations of the Commission. But more realistically it suggests the RCMP knew it probably shouldn't be using the highly questionable facial recognition product and tried to cover up how often it had actually been used.

Most damning of all is the undeniable fact that the RCMP continued to use Clearview while it was under investigation by the government. It only stopped because Clearview decided to exit the Canadian market rather than risk any additional scrutiny of its software and site scraping efforts.  

Filed Under: canada, facial recognition, privacy, rcmp
Companies: clearview

Buried Apple Privacy Scandal Undermines Its Attacks On Right To Repair Legislation

from the do-as-we-say,-not-as-we-do dept

Apple has never looked kindly upon users actually repairing their own devices. The company's ham-fisted efforts to shut down, sue, or otherwise imperil third-party repair shops are legendary. As are the company's efforts to force recycling shops to shred Apple products (so they can't be refurbished and re-used). As is Apple's often comical attacks on essential right to repair legislation, which usually involves the company insisting that allowing broader independent and consumer repair of their devices would be a security and privacy nightmare.

Yeah, about that. Apple last week was revealed to have paid a multi-million dollar settlement to an Oregon woman after iPhone repair technicians uploaded explicit images and videos to the internet from a phone that she sent in for repair. In this case, the culprits were employed by one of Apple's "authorized" repair contractors, Pegatron Technology Service in California. These authorized techs then uploaded the woman's private conversations and photos to the internet, making it look as if she had done it:

"The videos were uploaded to appear as though the woman herself had shared them on purpose, according to the documents, causing the woman “severe emotional distress”. The woman was made aware of the incident when friends saw the videos and images on Facebook. The woman sued Apple and eventually settled with the company for a multi-million dollar sum. But Apple was never directly named in the lawsuit in an effort to keep the matter confidential."

The revelation comes on the heels of a previous instance where an Apple store employee did something very similar. The latest screw up, subsequent payoff, and attempt to bury the settlement rather undermines Apple's longstanding argument that its own repair process is somehow superior to independent repair shops, and that by making it easier to repair consumer devices, consumers face all manner of alleged privacy and security harm (even if a recent bipartisan FTC report found that wasn't actually true).

The inconsistency was quickly seized upon by right to repair advocates, who note that Apple has lobbied intensely against the right to repair legislation that has been proposed in more than half of states in 2021 alone. Usually using what right to repair advocates describe as the "benevolent monopoly" argument

"Paul Roberts, a Right to Repair advocate and founder of SecuRepairs.org, calls this argument the “benevolent monopoly” argument. Yes, we have taken your choices away from you, the reasoning goes, but we did it to protect you from making the wrong choice or being tricked. Science fiction author and activist Cory Doctorow describes Apple’s model as “digital feudalism,” with the company acting as “warlord,” forcing citizens to stay within its walls and to abide by its rules."

But the choice of who should repair devices consumers, John Deere tractor owners, or hospitals own shouldn't be left up to the manufacturer. Especially if that manufacturer is attempting to monopolize repair in a way that's not only harmful to customers, but the planet itself.

Filed Under: authorized repair, privacy, revenge porn, right to repair
Companies: apple

State Court Confirms The Obvious: There's No Expectation Of Privacy In Text Messages Sent To Other People

from the yet-another-'going-dark'-option dept

A Massachusetts court recently sent out the useful reminder that a person's reasonable expectation of privacy does not extend to other people. In other words, there's an expectation of privacy in sent communications, but only up to the point that someone receives them. (via FourthAmendment.com)

In this case [PDF], the defendant in a drug conspiracy hoped to suppress evidence against him obtained from another person's phone. The lower court allowed Jorge Delgado-Rivera to join a motion to suppress filed by another defendant whose phone was searched by law enforcement following a traffic stop.

The higher court says this was the wrong thing to do.

We conclude that, in the circumstances at issue here, the judge erred in deciding that Delgado-Rivera could join in the motion to suppress to challenge the stop and subsequent search.

Delgado-Rivera should not have been allowed to join in the motion to suppress because he enjoyed no reasonable expectation of privacy, under either State or Federal law, in the text messages sent by him that were stored on a cellular telephone belonging to, and possessed by, another person.

This is a simple enough finding -- one that hasn't been contradicted by any case law here in the United States. (The Supreme Court of Canada, however, has decided the expectation of privacy of the sender carries over to the recipient of communications.) The only analogous case -- cited by the lower court in its ruling-- deals with the findings of the Washington state Supreme Court, which held in 2014 that a message's sender still retains an expectation of privacy. But the twist there is that it only covered messages sent -- but never received -- by the intended recipient. That finding deals with law enforcement's interception of these messages, with an officer posing as the intended recipient in hopes of collecting incriminating communications.

In this case, the messages were sent to the person whose phone was searched. And once they're sent and received, the recipient is free to share the communications with anyone, including law enforcement. That's what happened here, although the "sharing" question has been answered in another opinion, granting the message recipient his motion to suppress. That's detailed in a footnote which shows the supposedly consensual search of the phone most likely wasn't.

At an evidentiary hearing on his motion to suppress, Leonel Garcia-Castaneda argued that Officer Jose Tamez's search of his cellular telephones was non-consensual, at least in part because Garcia-Castaneda can speak and read only in Spanish, and the consent form he signed to authorize the searches was in English. The Commonwealth called Tamez to testify on this issue, but he invoked his right not to incriminate himself under the Fifth Amendment to the United States Constitution and therefore was not available to testify regarding the details of the stop and the subsequent searches. The Commonwealth presented no other evidence regarding the stop. The judge thus determined that the fruits of the search in Texas could not be used as evidence against Garcia-Castaneda.

This raises a question that is never answered in this opinion. If messages being used as evidence against Jorge Delgado-Rivera were obtained with an apparently illegal search of Garcia-Castaneda's phone, wouldn't this invalidate the evidence obtained against Rivera from Castaneda's phone? Apparently not. The court notes it in passing and makes no further mention of it in the rest of the ruling.

It does, however, suggest it would view the expectation of privacy in sent communications a little differently if the messages were encrypted or otherwise protected from being seen by anyone other than the intended recipient:

The Commonwealth notes the absence of evidence suggesting "that [Delgado-Rivera] took any steps to protect the contents of those messages [he sent to Garcia-Castaneda] by, for example, using encrypted messaging applications like Signal or Telegram, or an application that defaults to content deletion such as Snapchat." While the use of such applications, or similar efforts to enhance the privacy or security of the messages at issue, likely would be relevant to the extent that it reveals a defendant's efforts to protect his or her privacy, we leave for another day an issue that was not briefed by the parties and is not presently before us.

But the addition of encryption/self-destruction to messaging won't necessarily establish an expectation of privacy. Recipients can decrypt messages and share them or take screenshots of messages before they're destroyed. The senders of messages generally aren't expecting to share the contents of those communications with law enforcement, but there's very little preventing law enforcement from obtaining the contents from the receiving end of those communications.

Even with the seemingly illegal phone search in the mix, the court is right: there's no expectation of privacy. But there appears to be an unanswered question about the legality of the evidence being used against Delgado-Rivera. If was obtained via an illegal search, it should be suppressed, even if there's no expectation of privacy in messages he sent to someone else. But from what's said here, it appears Rivera will need to submit his own motion to suppress, rather than hitchike on his codefendant's suppression attempt.

Filed Under: 3rd parties, expectation of privacy, privacy, recipients, text messages

Amazon's Idea For A Mesh Network Is Cool; Its Method Of Rolling It Out Is Not

from the c'mon-guys dept

Over the weekend there was a bit of a reasonable fuss raised after Ars Technica noted that all of the various Amazon connected devices (including Alexa, Echo, Ring, etc.) would become part of a mesh network called Amazon Sidewalk, in which the devices would be sharing a tiny tiny bit of bandwidth across the network of devices. The idea behind the mesh network is kind of cool, and there are some clear benefits to using it.

But, of course, this is Amazon we're talking about -- a giant company, and the method of rolling this out seems to have caught a ton of people by surprise: namely opting everyone into the program with a short timeline to opt-out. That seems less than ideal. Lots of privacy folks are concerned, in general, with two aspects of this: the fact that people may be suddenly sharing data with their neighbors without necessarily realizing it, and the tie-in to Amazon, which is (again) a large company that tends to collect quite a bit of data on people. To its credit, Amazon released a pretty comprehensive whitepaper exploring the privacy and security protections they've built in to Sidewalk, and my guess is that for many consumers the benefits of easier setup and better connectivity via Sidewalk will seem worth it to them.

The real issue, then, is forcing everyone into the network. Obviously, it's no surprise why this was done. A mesh network really only works if you have enough nodes on the network to make it useful. So it makes sense that Amazon would want as many of the devices to be on the network on day one as possible. However, given the company and the public scrutiny it has received of late, it seems like it should have anticipated these concerns a lot more, pushed for an opt-in setup (perhaps with incentives), rather than jumping to the "hey, we're adding this automatically" approach.

While it's possible that Amazon is betting that the concerns over this will blow over, and having so many nodes on the network will make it worthwhile to take the short-term heat, it still surprises me that the big internet companies don't take more steps to alleviate these kinds of concerns up front, including taking a more cautious approach. But, perhaps that's why I don't run a giant internet company.

Filed Under: alexa, amazon sidewalk, echo, iot, mesh network, opt-in, opt-out, privacy, ring, sharing
Companies: amazon

Rep. Zoe Lofgren Recognizes The Nuances And Complexities Of Regulating Internet Companies

from the there-are-so-many-tradeoffs dept

It's taken as given among many politicians (and much of the media) that "something must be done" about "big tech" companies. The public seems a lot less concerned about it all. Unfortunately, as we've noted repeatedly, many in the government are focused on specific regulatory levers that seem incredibly unlikely to work (and which have a high likelihood of making any of the problems discussed even worse). A big one is antitrust. We keep hearing grandstanding politicians talk about how they need to break up "big tech" without any of them getting into how that will solve any particular issue. In the House, Rep. David Cicilline has been the poster child of this approach -- insisting that antitrust is the answer, but refusing to actually explore the nuances and tradeoffs of that approach.

One of the big problems with the antitrust approach is that the traditional remedies of antitrust do very little to fix the issues that people insist come about due to the big internet companies. Big fines seem mostly meaningless to them (though they will shift some behavior). And breaking them up really doesn't do very much at all. The value of the internet is the ability to communicate with everyone, and you can't create "BabyBooks" for Facebook in the same way it was possible to create "BabyBells" out of AT&T in the 1980s (and, we can all see how well that worked in the long run).

Some of us have suggested alternative approaches that might lead to more real competition and better end-user control over data. Over the last few months, I have been having more discussions with various different government officials about exploring some of these alternative remedies, but I have been less and less sure if any government official would ever actually pay attention.

So it's actually nice to see Rep. Zoe Lofgren, responding to Cicilline's giant confusing mess of a "Digital Markets" report by posting her own thoughts on better ways to think about regulating the internet. I don't agree with all of Lofgren's points, but it's one of the most sane and reasonable documents I've seen coming from a government official in a long, long time regarding issues on regulating internet companies. Unlike so many, it acknowledges the nuances and trade-offs inherent to this discussion, and the lack of any silver bullet fix.

The more difficult questions are in deciding how and when to regulate single-firm conduct, which the report often describes as a platform exercising its “gatekeeper power” over who uses it and under what terms. Our laws should promote open platform ecosystems as a central objective, but this is far from a simple matter in practice, because many of a digital platform’s assertions of gatekeeping power can be good faith efforts to serve user interests – such as privacy, security, and/or quality of service – and may protect the long-term health of the larger ecosystem. In certain instances, platforms may need to exclude certain parties or content outright – for example, moderating hate speech and the advertisement of fraudulent or harmful products – to ensure that a platform otherwise remains open and vibrant for other speakers and transactions.

A platform company could also abuse gatekeeping power – to promote its own products and services, to lock in users from leaving for other platforms, and so on. The challenge for Congress is to craft a legal framework to allow regulators to distinguish abusive gatekeeping from legitimate efforts to serve user interests and prevent ecosystems from breaking down. These sorts of cases will often resist easy categorizations and generalized answers, as regulators are forced to consider how deeply to intervene in the details of a platform’s operations, such as its precise terms of services or particular design aspects of its user interface.

The document also talks about privacy issues, and whether or not antitrust is truly the tool to deal with that.

The Report contends that privacy abuses by online platforms are symptoms of inadequate competition. This can be true in some cases, and in those instances competition policy could play a useful supporting role to give consumers more privacy-protective alternatives in the marketplace. But it is a mistake to treat privacy largely as a competitive problem with competition-focused remedies. Abusive data practices are found not only in large platforms but also from many smaller companies, as the latter are more likely to buy and sell sensitive user data to data brokers and other third parties. Even in more competitive digital markets, users often do not have enough visibility or understanding into how their personal data is being collected, used, and disseminated, and face insurmountable barriers to defending their own privacy interests, through either individual or collective action.

Effective privacy and data regulations can and will promote competition, both by restricting abusive business models that otherwise can trigger a race to the bottom, and by giving users more practical control over who holds their data and how it is used. The Report’s call for greater authority to promote data portability and interoperability is important. However, as with other privacy measures, it’s unlikely this can be accomplished through the ex post enforcement of generalized antitrust laws. Instead, it requires more specialized, expert, and prospective privacy regulation.

I still worry that we run into the same issues with most privacy legislative proposals as we run into with antitrust remedies: those putting in place the rules will misunderstand the nature of the problem and the remedy, and create results that only favor the largest companies who can comply with silly rules that don't always make sense.

But taking approaches that (1) lead to more interoperability, (2) more end-user control, and (3) greater transparency have always seemed to be the approach that might eventually have a real impact. It's good to see that Lofgren seems to be thinking along similar lines.

And, she also notes that many other private interests are trying to use these discussions to get their own favored results, and Congress should be wary of that. She doesn't name them, but Hollywood, the telcos, and the legacy newspaper business (not to mention big lumbering old tech companies like Oracle and IBM) have been actively trying to co-opt this process in a punitive way against companies which effectively out-innovated them. This gets far too little discussion, but it's great to see Lofgren point out the risk:

In all of this – competition, privacy, and or any other fundamental objective in platform regulation – we must be vigilant against regulatory and legislative agendas being co-opted to serve narrower interests. As I noted above, the rise of digital platforms unleashed a flood of new competition for earlier incumbents in many other industries. While these incumbents can have legitimate complaints about their treatment within platform ecosystems, this does not justify special regulatory protections that would lock down such ecosystems, favor conventional business models against digitally-native content and services, or attempt to restore markets to their pre-digital states.

Exactly.

Filed Under: antitrust, competition, david cicilline, gatekeepers, privacy, tradeoffs, zoe lofgren

Defense Department Is Buying Domestic Internet Metadata From Data Brokers

from the bringing-the-war-back-home-via-bulk-purchases dept

Joseph Cox broke the news for Motherboard late last year: the US military was also making use of location data purchased from data brokers, joining a host of other federal agencies that seemed to feel buying from brokers was an acceptable alternative to respecting the Fourth Amendment.

Of particular interest to the Defense Department was location data generated by apps popular with the world's Muslims, including the Muslim Pro prayer app and Muslim Mingle, a Muslim-centric Tinder. The DoD didn't have much to say in its… um… defense at that time, obviously preferring everyone to assume the focus on Muslim-focused apps was indicative of its good and righteous work fighting terrorist organizations around the world.

Unfortunately, the data came from brokers who also collect plenty of location info from US located app users and there was no information provided by the government that showed the military made an effort to steer clear of acquiring this data.

More confirmation has arrived, via some half-answers, redactions, and "can we talk about this in private?" responses to Senator Ron Wyden's demand for more information from the Defense Department. Once again, it's Joseph Cox and Motherboard bringing us the latest:

The Pentagon is carrying out warrantless surveillance of Americans, according to a new letter written by Senator Ron Wyden and obtained by Motherboard.

Senator Wyden's office asked the Department of Defense (DoD), which includes various military and intelligence agencies such as the National Security Agency (NSA) and the Defense Intelligence Agency (DIA), for detailed information about its data purchasing practices after Motherboard revealed special forces were buying location data. The responses also touched on military or intelligence use of internet browsing and other types of data, and prompted Wyden to demand more answers specifically about warrantless spying on American citizens.

Unfortunately, further details have yet to be released. For the moment, Senator Wyden is indulging the Pentagon's demands for further secrecy. But his letter lets the public know some of what he knows -- even if the Defense Department has refused to make this information public.

"I write to urge you to release to the public information about the Department of Defense's (DoD) warrantless surveillance of Americans," the letter, addressed to Secretary of Defense Lloyd J. Austin III, reads.

The DoD may not have publicly admitted to this surveillance of Americans but Wyden is willing to make that disclosure on its behalf.

According to Wyden staffers, this refers to the DoD's bulk purchases of internet metadata that contain information about US persons' communications. Some of these are wholly domestic conversations. Some involve communications between Americans and people located in other countries. In either case, the DoD appears to be bypassing protections erected to prevent this sort of bulk surveillance. And while components of the Defense Department are in the intelligence business, their adversaries and targets are supposed to be foreigners. Incidental collection is one thing. Buying data in bulk and sifting through it with zero oversight is quite another.

Filed Under: 4th amendment, data brokers, defense department, dod, metadata, privacy

Time Magazine Lauds Clearview AI Despite Its Sketchy Facial Recognition Tech

from the but-why? dept

Time Magazine released its inaugural list of the 100 Most Influential Companies, featuring an array of large and small corporations that “are helping to chart an essential path forward.” Disturbingly, among its choices of “disruptors” is Clearview AI, the controversial facial recognition start-up known for illicitly scraping Americans’ images and demographic information from social media and selling the data to law enforcement. By celebrating a company that engages in illegal mass surveillance, Time is complicit in the degradation of our privacy and our civil liberties.

Even cursory scrutiny by Time would have uncovered Clearview AI’s disreputable practices. Perhaps Time was satisfied with the vague explanation from Clearview AI’s CEO, Hoan Ton-That, that the company is “working with law enforcement to balance privacy and security.” But it’s hard to understand why, after substantial reporting by other members of the media, Time chose to accept Ton-That’s word when there is conclusive evidence that Clearview AI continues to violate civil liberties by supplying law enforcement agencies, private banks and sports teams with billions of illegally collected images.

Widespread concern about facial recognition technology’s threats to civil liberties and its propensity for inaccuracy and racial bias fueled the public outcry that ensued after the New York Times first broke news about Clearview AI. Amid calls from civil rights advocates for lawmakers to ban the use of facial recognition technology, members of Congress questioned Clearview AI about its technology and its potential for abuse against First Amendment-protected activity. Since then, a growing list of U.S. cities have banned police use of the technology.

Despite the bans and lawsuits, both locally and internationally, against Clearview AI, the company’s indiscriminate collection of Americans’ personal data without specific links to criminality continues unabated. Clearview AI’s troubling history and ongoing illegal activity should have dissuaded Time from elevating it in the public sphere. Yet the outlet only vaguely summarizes serious concerns about Clearview AI in its profile, mentioning briefly that “civil rights advocates fear abuses” of its technology despite reports of both the company and its clients misleading the public. Without evidence, Time also credits Clearview AI for assisting in the arrest of individuals connected to the breach of the U.S. Capitol earlier this year, while sweeping aside Clearview AI’s ties to misinformation.

Clearview AI’s secretive practices that Time lauds as “influential” and “disruptive” represent a dangerous disregard for our social norms and expectations of privacy. We have come to expect to certain tradeoffs with technology providers: we share some demographic information in exchange for the ease, convenience and connectivity their products bring to our daily lives. However, any marginal benefits of Clearview AI do not hold up against its significant potential for harm, and Time should have acknowledged that. The company’s technology paves the way to a dystopian future devoid of privacy and anonymity, both online and offline. Clearview AI is creating an environment where anyone - an ICE agent, a stalker or an individual bad actor within government – can take a photo of an individual anywhere and automatically pull up that person’s Instagram, TikTok, blog, or other personal information without their knowledge or consent.

It is a future civil society advocates have long warned about and will continue to fight against. Time should acknowledge these warnings in its report, especially since its readers are among Clearview AI’s targets. As an iconic publication that has been a part of America’s media and social landscape for almost 100 years, Time has effectively chronicled the struggle for civil liberties over the decades. It is a disgrace that when it came to covering today’s most influential companies, Time instead chose to endorse a company that is distinguished only for its unrelenting commitment to destroying those same liberties.

Freddy Martinez is a policy analyst at Open The Government.

Filed Under: biometrics, disinformation, facial recognition, innovation, privacy
Companies: clearview