Smart TV Makers Will Soon Make More Money Off Your Viewing Habits Than The TV Itself

from the what-could-possibly-go-wrong dept

"Smart" televisions have long been the poster child for the abysmal privacy and security standards inherent in the "internet of things" space. Such televisions have been routinely found to have the security and privacy standards of damp cardboard, making the data they collect delicious targets for hackers and intelligence agencies alike.

At the same time these companies have failed repeatedly to secure (or sometimes even encrypt) consumer data, their data collection revenue is positively exploding. Vizio, for example, recently noted that it made $38.4 million in one quarter just from tracking and monetizing consumer viewing and usage data. It made $48.2 million on hardware (both TVs, soundbars, and other products) in that same period, and that gap (if not already closed) is quickly closing:

"Its device business (the part that sells TVs, sound bars and the like) had a gross profit of $48.2 million in the same period, up from $32.5 million last year. While the hardware business has significantly more revenue, profits from data and advertising spiked 152 percent from last year, and are quickly catching up."

The problem researchers keep pointing out is not enough of that revenue is being put back into device security research and privacy standards, which is why Vizio, like most "smart" TV manufacturers, has been repeatedly caught in privacy scandals. Like that time it had to shell out $2.2 million to the FTC and NJ AG for failing to inform consumers this data was even being collected. By the time consumers got their share of that settlement, it wound up being about $20 per person. And it's not really clear anything would have happened at all if not for a 2015 ProPublica investigation into Vizio's lack of transparency.

The problem of course is that regulators, when they do bother to act, act half a decade after the fact, and only if a journalist exposes the problem first. Consumers then get a tiny pittance. And it shouldn't be too hard to understand how a $2.2 million fine -- for a company pulling down $38.4 million every three months off of consumer data alone -- probably isn't going to be an effective deterrent against future privacy abuses. It's viewed as just a light gnat on the nose and the cost of doing business.

Consumers do have a bit of control. They can disable a set's WiFi features entirely, even though in many instances doing so can disable core set functionality in obnoxious and unforeseen ways. Ideally I'd love to be able to buy a "dumb" TV that's just a great display with HDMI ports and no "smart" internals, but because consumer data is now so profitable, most TV vendors no longer even sell such an option.

It's also worth remembering that your smart TV is just one in a long line of systems collecting and monetizing your data, including the streaming hardware you're using (Roku, etc.), your ISP, any additional internet of things devices you've connected to your network, and even your energy company. While folks intent on downplaying modern privacy abuses often like to pretend this is the age of consumer empowerment, it's not really possible for consumers to "opt out" of data collection and monetization at the scale it's now occurring. Even with a lot of elbow grease, technical innovation, and external help.

Organizations like Consumer Reports have been pushing hard for improved efforts to warn consumers about potential privacy abuses at the point of sale, including them in product reviews and even on product packaging. And while their "open source" efforts on this front are really interesting, we're a long way away from this kind of transparency being the norm.

Filed Under: data, privacy, smart tvs
Companies: vizio

Irony Alert: US Could Block Personal Data Transfers To Ireland, European Home Of Digital Giants, Because GDPR Is Not Being Enforced Properly

from the biter-bit dept

Last year, the EU's top court threw out the Privacy Shield framework for transferring personal data between the EU and US. The court decided that the NSA's surveillance practices meant that the personal data of EU citizens was not protected to the degree required by the GDPR when it was sent to the US. This was the second time that such an agreement had been struck down: before, there was Safe Harbor, which failed for similar reasons. The absence of a simple procedure for sending EU personal data to the US is bad news for companies that need to do this on a regular basis. No wonder, then, that the US and EU are trying to come up with a new legal framework to allow it, as this CNBC story notes:

Officials from the EU and U.S. are "intensifying negotiations" on a new pact for transatlantic data transfers, trying to solve the messy issue of personal information that is transferred between the two regions.

Even if they manage to come up with one, there's no guarantee that it won't be shot down yet again by the courts, unless the underlying issues of NSA surveillance are addressed in some way -- no easy task. Meanwhile, there's been a fascinating development on the US side, reported here by The Irish Times:

The US Senate is to debate a proposal to limit foreign countries' access to US citizens' personal data and to introduce a licence requirement for foreign companies that trade in this information.

The draft "Protecting Americans' Data From Foreign Surveillance Act", presented on Thursday by Democratic Senator Ron Wyden of Oregon, is aimed primarily at curbing the sale and theft of data by "shady data brokers" to "hostile" foreign governments such as China.

The law may be aimed primarily at China, but its reach is wide, and it could hit an unlikely target. As the Irish Council for Civil Liberties (ICCL) explains, the new Bill (pdf) aims to stop the personal data of US citizens being transferred to locations with inadequate data protection -- just as the EU's GDPR does. But according to the ICCL, one country that may fall into this category of dodgy data handling is Ireland:

ICCL understands from those who wrote the draft Bill that Ireland's failure to enforce the GDPR is of particular concern. The Bill intentionally uses language from the GDPR, and targets this enforcement failure. The draft Bill makes clear that merely enacting strong data protection law such as the GDPR is not enough. That law must be enforced.

Most digital giants have their European headquarters in Ireland. Under the GDPR, it is Ireland's Data Protection Commission (DPC) that must investigate and ultimately fine these companies for their GDPR infringements anywhere in the EU. The DPC has opened many data privacy inquiries (pdf), but has so far failed to impose serious fines. Without strict enforcement by the Irish authorities, there is a growing feeling that the GDPR could be fatally undermined. Hence the risk that the US might not allow personal data to be transferred to Ireland, if the new "Protecting Americans' Data From Foreign Surveillance Act" becomes law. Given the long-standing concerns over the protection of personal data flows from the EU to the US, that would be a rather ironic turn of events.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: data brokers, data transfers, gdpr, ireland, privacy, privacy shield, ron wyden, surveillance, us

Facebook's Distinction Between Data Breaches And Scraping Would Make A Lot More Sense If It Hadn't Argued Differently In Court

from the but-it's-important dept

A few weeks back, news broke that some hackers were offering up personal information on over 500 million Facebook accounts (there had been some earlier reports about this data availability as well). It was even highlighted that some of the "personal information" apparently included Mark Zuckerberg's phone number (though it's unclear if that data was confirmed to be accurate or not).

After there was more reporting on this data being available, some people noticed that Facebook had not alerted people about it. Various data breach laws require notification to effected users of a data breach, and so Facebook's decision raised some eyebrows. Facebook's explanation for not notifying users is that the company did not consider this to be a breach, but rather was done via scraping of information that people put on their own profiles:

Scraping is a common tactic that often relies on automated software to lift public information from the internet that can end up being distributed in online forums like this. The methods used to obtain this data set were previously reported in 2019. This is another example of the ongoing, adversarial relationship technology companies have with fraudsters who intentionally break platform policies to scrape internet services. As a result of the action we took, we are confident that the specific issue that allowed them to scrape this data in 2019 no longer exists. But since there’s still confusion about this data and what we’ve done, we wanted to provide more details here.

This may feel like weaseling out (and in some ways it absolutely is), but the distinction here is actually really important. As explained in a detailed Wired article, no one "hacked" into Facebook, so in some way the data wasn't breached the way many people think of a breach. Instead, it appears that the "import contacts" feature (which is wise to avoid using on basically any service if you can!) had a vulnerability in that malicious actors could basically try to import every possible phone number, and any "match" would give them access to the information those people shared with connections (so, personal info like phone numbers, names, date of birth, email, etc.).

It appears that data protection regulators around the globe are not happy with Facebook's response, and it would not surprise me at all to see Facebook eventually hit with another fine over this situation.

However, we should be at least somewhat wary of efforts to make data scraping a violation of privacy rules.

Admittedly, Facebook is now trying to lean heavily on the distinction to get out of trouble here. In an email someone from Facebook accidentally sent to a Dutch reporter, it was revealed that Facebook was going to try to "normalize" data scraping efforts as both common and different than data breaches (Facebook later confirmed to Vice that the email was legitimate):

'In the long term we expect more scraping incidents and it is important to frame this as a sector problem and normalize that this happens regularly. To do this, the team proposes a follow-up post in the coming weeks that talks more broadly about our anti-scraping work and provides more transparency around the work we do here. This may reflect much of the scraping activity, we hope this helps normalize the fact that this is ongoing and avoid the criticism that we are not transparent about specific incidents. '

And there is some truth to the fact that this kind of thing happens regularly. There were recent reports on similar "data scrapes" from Clubhouse and LinkedIn.

And here's where things get a bit trickier. If we demonize all data scraping, that would create much bigger problems. Data scraping is actually really important for many non-nefarious situations. Hell, search engines are giant data scrapers, and that's incredibly useful. Similarly, many academic researchers use data scraping to analyze various things online (including the activities of big companies like Facebook). Demonizing all data scraping as if it's functionally equivalent to a data breach would lead to bad results.

Indeed, in many ways, being able to scrape data can help lead to a more competitive internet. As people like Cory Doctorow are pushing for competitive compatibility, some of that may include the ability to scrape data to get it out of a silo like Facebook.

Notably, both Facebook and LinkedIn -- both of whom have just recently faced public reports of this kind of scraping -- have, in the past, sued companies that scraped their sites, claiming it violated the Computer Fraud and Abuse Act (CFAA) for "unauthorized access." As you may recall, Facebook won its case against Power, blocking Power's attempt to create an out-of-Facebook dashboard that users could use to post content to Facebook and other social networks without having to use Facebook directly.

LinkedIn, on the other hand, lost its very similar case, because of an important distinction that Facebook is now conveniently ignoring. In the LinkedIn case, the court found that LinkedIn couldn't use the CFAA to stop scraping because the information in question was publicly available. The court distinguished it from the Power case by saying that, with Power, it was scraping (with permission from the end users) data that was not "publicly available."

And, thus, I think that a lot of people are -- somewhat cynically perhaps -- conflating a bunch of different situations to their own advantage. People who are mocking Facebook for trying to distinguish between data breaches and data scraping are perhaps going too far. There is a difference, and that difference matters. Jumping to the extreme position that data scraping is bad would lead to really bad results. The distinction that people should be making is who has authorization to access the data. So, for example, with the recent Clubhouse data scraping, all of the information that was scraped was publicly available to anyone on Clubhouse. No secret information was revealed.

Similarly, with the LinkedIn/HiQ case, the court rightly found that HiQ should be able to scrape public data from LinkedIn. That was a good ruling because scraping public data is an important factor in how the web works.

But, now let's look at the Facebook situation. In the Power case, which I think was decided incorrectly, Facebook argued that scraping data with the permission of the end user who created that data was bad hacking that violated the law. The courts agreed, but that still seems very, very wrong. The key factor here should have been that the end user gave their authorization, and thus the data scraping should have been allowed.

But with this latest situation with the over 500 million accounts... well... now it gets more complicated. This data was available because of the sloppy way in which Facebook set up its "import contacts" feature. The people who put their own data in did not authorize it to be shared that widely (or if they technically did so through convoluted terms of service, it certainly was not with the intent that that data would then be available in a database anyone could hunt through to find their personal info). Given that -- that this data was accessed without the end user's authorization -- this feels a hell of a lot worse than what was happening with Power. Yet, in Power's case, Facebook ran to the courts to claim a "breach." But with the latest story, Facebook is trying to downplay it as not a breach.

At the very least, Facebook is being cynically hypocritical.

And that worries me. I fear that too many people will not sort through the different issues at play here, and will argue that any kind of data scraping is the equivalent of a data breach. Dangerously, that could play right into Facebook's hands, allowing it to put up even larger walls, and create more impenetrable silos, that make it that much more difficult to extract your data from Facebook and move it to alternative and competing platforms.

So, yes, Facebook is being cynical and opportunistic (and inconsistent) in arguing that this scraping situation is different than a data breach. But there is an underlying kernel of truth that shouldn't be ignored. Not all data scraping is bad. It's often quite good and important. The real issue is what data is public and what is private -- and who is given the authorization to make more private data public.

If the end result of this is for regulators to say that Facebook has to lock down more data, that would be bad, as it would continue to raise the competitive barriers for new entrants, and give Facebook even more power. That doesn't mean anyone should let Facebook off the hook for its stupidly implemented contact importer, but understanding the nuances here is important.

Filed Under: cfaa, competition, data breaches, interoperability, privacy, scraping
Companies: clubhouse, facebook, linkedin

Not All Tech Regulatory Desires Are Equal: And We Should Stop Pretending They Are

from the c'mon-people dept

The NY Times has a big (and quite interesting) article this week about how we've supposedly "reached a global tipping point" on "tech regulation." And if you look around, it may feel that way. And, sure, it's easy to point to lots of examples of tech regulation happening around the globe, as the article does:

China fined the internet giant Alibaba a record $2.8 billion this month for anticompetitive practices, ordered an overhaul of its sister financial company and warned other technology firms to obey Beijing’s rules.

Now the European Commission plans to unveil far-reaching regulations to limit technologies powered by artificial intelligence.

And in the United States, President Biden has stacked his administration with trustbusters who have taken aim at Amazon, Facebook and Google.

However, it does a disservice to readers and the truth to suggest that all of these moves towards tech regulation are coming from the same intent. The article does acknowledge that the "motivation varies" but I think that underplays reality:

Around the world, governments are moving simultaneously to limit the power of tech companies with an urgency and breadth that no single industry had experienced before. Their motivation varies. In the United States and Europe, it is concern that tech companies are stifling competition, spreading misinformation and eroding privacy; in Russia and elsewhere, it is to silence protest movements and tighten political control; in China, it is some of both.

Even within governments (hell, take the US government for example), the motivations in discussing tech regulation are extremely different and often diametrically opposed. Some are pushing for tech companies to be more aggressive in combatting "disinformation," while others are seeking to pressure them to leave up disinformation (usually the disinformation that is politically convenient for those demanding that information be left online).

It's difficult to discuss this concept without recognizing that while there are some people exploring tech regulation with an intellectually honest recognition that there are issues concerning power concentration, privacy, data control, and more -- the vast majority of the "motivation" behind these tech regulation bills is completely self-serving garbage. In some cases, it's simply about power and control. In some cases, it's about trying to limit competitors or to try to for successful tech companies to prop up failed companies (such as the news business). In other cases, it's about trying to clamp down on the tools that allow the public to speak out and call out hypocrisies.

And that's why it's unfair to lump all "global" tech regulation into one bucket, as if it's all coming from the same place and meant to do the same thing. A huge part of the push for tech regulation these days is cynical opportunism, and any story that doesn't recognize that fails its readers. The NY Times piece certainly recognizes that there are varying approaches, and that fights over "power" are driving much of movement here, but it fails to distinguish good faith efforts to explore the negative consequences of some of the tech world with the cynical exploiters of those concerns, who are simply seeking to use that momentum for their own power and benefits.

Yet while governments agree that tech clout has grown too expansive, there has been little coordination on solutions. Competing policies have led to geopolitical friction. Last month, the Biden administration said it could put tariffs on countries that imposed new taxes on American tech companies.

There's little coordination because of the extremely different -- and often competing -- interests at play. It feels like the article should have been much more explicit on that point.

There is an interesting discussion to be had about this focus on tech regulation around the globe, but I think the NY Times article fails to have that. You could read the article and come out of it with the conclusion that Myanmar and China's internet restrictions come from the same core place as explorations by thoughtful lawmakers on how to deal with misinformation online. And that's fundamentally wrong. It's a kind of "both siderism" or "view from nowhere" reporting that does tremendous disservice, and fails to enlighten.

We can look at issues regarding internet regulations, and explore the ins and outs of it by looking at what problems actually need solving and then exploring what proposed solutions will actually work and which won't. But simply lumping all kinds of internet regulations into one big article, without highlighting how a very large percentage of them are simply opportunistically exploiting a general anti-internet narrative to their own cynical purposes, is a failed attempt at journalism. The NY Times should do better. At the very least, these reporters might want to admit or acknowledge that their own company has been actively engaged in some of the cynical attempts to push for regulations on internet companies that is designed just as a wealth transfer mechanism from the companies that innovated, to the NY Times itself. But apparently that wasn't worth including.

Filed Under: antitrust, big tech, censorship, content moderation, privacy, regulations

The Privacy Paradox: When Big Tech Is Good On Privacy, They're Attacked As Being Bad For Competition

from the tradeoffs.-it's-all-tradeoffs dept

For many years I've tried to point out that no one seems to have a very good conceptual framework for "privacy." Many people act as if privacy is a concrete thing -- and that we want our information kept private. But as I've pointed out for years, that doesn't make much sense. Privacy is a set of tradeoffs. It's information about ourselves, that we often offer up freely, if we feel that the tradeoff is worth it. And, related to that, there's a big question about who is controlling the data in question. On top of that, things get confusing when we consider just who is controlling what data. If we're controlling our own data, then we have some degree of autonomy over our privacy trade-offs. But when we hand that data off to a third party, then they have much more say over our privacy -- and even if they agree to "lock down and protect" that data, the end result might not be what we want. For one, we're giving those companies more power of our data than we, ourselves have. And that can be a problem!

Because of this, privacy questions are often highly contextual -- and often conflict with other issues. For example, after the Cambridge Analytica scandal, Facebook was yelled at over and over again regarding its poor data privacy efforts -- leading the company to say "okay, fine we'll lock down your data, and just keep it for ourselves." Which is a totally reasonable response to the complaints that "Oh, Facebook leaked our data." But, of course, the end result of that is... worse. Then we've handed Facebook even more control over our data, and given significantly less ability for competitors to come along. That's not good!

There's a similar issue with advertising and privacy, that we discussed just last month. Google clarified its plans to block 3rd party cookies. In many ways, this is good for privacy. 3rd party cookies are often abused in creepy ways to track people. So it's good that Google won't support them (Firefox and Safari already made this move earlier). But lots of people then vocally complained that this would only give more power to Google, because it can deal with the lack of data, while competitive (smaller) advertising firms cannot.

These issues are often in conflict -- and many of the big tech critics out there don't want to recognize that. In fact, it lets them attack these companies no matter what they do. If they do something that's good for privacy, but bad for competition, focus on how it's bad for competition. If they do something that's good for competition, but bad for privacy, focus on how it's bad for privacy.

A recent article in Wired by Gilad Edelman highlights this tension in the antitrust context. Noting that in the big antitrust fights against Facebook and against Google, the two companies are being attacked in very different ways: one for being more protective of private data in a way that gives the company more power, and one for violating privacy of users.

HERE’S SOMETHING TO puzzle over. In December, the Federal Trade Commission and a coalition of states filed antitrust lawsuits against Facebook, alleging that as the company grew more dominant and faced less competition, it reneged on its promises to protect user privacy. In March, a different coalition of states, led by Texas, accused Google of exclusionary conduct related to its plan to get rid of third-party cookies in Chrome. In other words, one tech giant is being sued for weakening privacy protections while another is being sued for strengthening them. How can this be?

Edelman tries to solve this seeming paradox by suggesting that there might be a way to sort out the actual intent of these actions:

Maybe, then, the right way to think about what should happen when the privacy and competition dials diverge is to ask whether a company is cutting off access to personal data that it intends to keep using itself. That could help distinguish between a case like the Privacy Sandbox, on the one hand, and Apple’s App Tracking Transparency framework, on the other. Apple’s new policy will force all iPhone app developers to ask for permission before tracking users. That is expected to hurt companies that make money by tracking users across the web, most notably Facebook, which has reportedly considered filing an antitrust lawsuit to block the change. But since Apple doesn’t make its money by selling personalized ads based on surveilling user behavior, it’s harder to argue that it is hoarding access to user data for its own purposes. That makes the tension between privacy and competition easier to resolve.

Not that Apple will always come out ahead in this analysis. Contrast the Facebook spat with the ongoing feud between Apple and Tile, which sells tracking technology to help users find lost stuff and thus competes with Apple’s own “Find My” software. According to Tile, Apple has discriminated against the company by prohibiting certain practices, like background location tracking, that it requires to function. Apple says the rules are meant to protect user privacy. If it were to sue, Tile might have a stronger case than Facebook because its product competes more directly with Apple.

That's an interesting idea -- but I'm not sure it would be so easy in practice. There are so many competing interests at play, and so many actions may seem good for one particular concern, but less good for others.

Obviously, I've long been an advocate of simply removing much of the data from these large companies' control entirely -- via a system of protocols that moves control out to the end users. But in most versions of that system, most users are going to eventually entrust that data to some third party company, and in some ways that puts us back where we're started. My hope is that such a world would end up with more neutral 3rd party "data banks" and you could even suggest that there could be an information fiduciary model, in which these companies are legally required to act in your best interests.

But, even that model runs into some trouble, and we end up talking about questionable ideas like a DMCA for privacy, which seems like it would be a true horror online.

It would be nice, though, if we could have this kind of debate and conversation in a reasonable manner, rather than everyone jumping immediately to their own corners about who's evil and who's good. Every one of these decisions has tradeoffs, and it would be more productive if we could recognize that and debate the relative merits of all of those tradeoffs. But, having nuanced discussions about subjects with no easy answers does not seem to be in fashion these days.

Filed Under: antitrust, big tech, competition, narrative, privacy
Companies: facebook, google

Wireless Provider Openly Shares Private Data Of Subscribers

from the whoops-a-daisy dept

Editor's Note, May 7, 2021 Q Link Wireless has contacted us to dispute that the privacy failure impacted Q Link customers, stressing that its Hello Mobile brand is separate from Q Link. We will note that the two companies are connected, as Q Link made clear in its press release announcing its “new prepaid phone brand, Hello Mobile,” stating that the CEO of both companies is the same, Issa Asad. Both companies are listed in the FCC’s telecommunications companies database as having the same address and being owned by the same parent firm, Quadrant Holdings, which also has the same CEO, Issa Asad. The “My Mobile” iOS app Ars Technica revealed to have exposed consumer data is listed as having been developed by Q Link Wireless. The maker of the corresponding Android app is a separate company, Vector Holdings. According to publicly filed FCC documents, Vector Holdings is also a subsidiary of Quadrant Holdings and run by Issa Asad. We have updated the post to reflect that the public evidence shows the data being exposed specifically for Hello Mobile users.

Another day, another notable privacy scandal we won't do much about.

Q Link Wireless's Hello Mobile service is the latest company to be under fire for particularly lax security and privacy standards after it was found to have exposed the private data of its wireless customers. The company's My Mobile Account app (for iOS and Android) is supposed to let subscribers monitor their wireless accounts, while letting them track remaining data allotments and buy more data when needed. But for users, the app also displays the name, addresses, phone and text histories, last four digits of their credit card, and the account number needed to port your number out.

And all of this data was left openly exposed for anybody to access, provided you had the phone number of any Hello Mobile customer.

The problem was first spotted by Reddit users and subsequently confirmed by Ars Technica:

"Since at least December and possibly much earlier, My Mobile Account has been displaying this information for every customer account whenever it is presented with a valid Q Link Wireless phone number. That’s right—no password or anything else required.
When I first saw a Reddit thread discussing the app, I thought for sure there was some kind of mistake. So I installed the app, got the permission from another thread reader, and entered his phone number. I was immediately viewing his personal information, as the redacted images above demonstrate."

It's not clear how long this screw up has been live, but complaints began popping up on Reddit sometime last year. When Ars reached out to the company it couldn't be bothered to respond:

"I began emailing the carrier about the insecurity on Wednesday and followed up with almost a dozen more messages. Q Link Wireless CEO and founder Issa Asad didn’t respond despite my noting that every hour he allowed the data exposure to continue compounded the risk to his customers."

It's worth noting that Q Link Wireless customers are generally lower-income users enrolled in the FCC's Lifeline program (which doles out a modest $9.25 monthly subsidy to be used for wireless, wired broadband, or phone service) and as such are potentially the least likely to be able to afford issues related to identity theft and fraud. Also worth reminding folks: in 2015 the FCC passed some relatively basic broadband privacy rules that were subsequently demolished by the GOP at the behest of the telecom lobby before they could take effect. So, good job all around, I guess.

Filed Under: data leak, exposed data, privacy, security
Companies: q link wireless

Oracle's Projection: As It Accuses Google Of Snooping On You, It Has Built A Huge Data Operation That It Doesn't Want Regulated

from the ah,-look-at-that dept

Over the last decade or so, the fight between Oracle and Google has seemed incredibly personal -- at least on the Oracle side. Of course, many have argued the main reason for Oracle's attacks on Google were to pressure the company into settling its long-running fight over the Java API -- and the Supreme Court just put an end to that -- so it will be interesting to watch whether or not the attacks continue. But there's an important point buried in all of this. Almost everything Oracle accuses Google of doing... it does itself. Often in much more nefarious ways. I mean, Oracle even copied an API without a license. But Oracle's grand projection in blaming Google for the things that Oracle actually does (in much worse ways) goes way further than that.

Late last year reports came out noting that various regulatory attacks on Google around the globe clearly had Oracle's fingerprints all over them -- including claims that Google is a disaster for persona privacy. From a big Bloomberg article:

What's less known is that Oracle Corp. spent years working behind the scenes to convince regulators and law enforcement agencies in Washington, more than 30 states, the European Union, Australia and at least three other countries to rein in Google's huge search-and-advertising business. Those efforts are paying off.

Officials in more than a dozen of the states that sued Google received what has been called Oracle’s “black box” presentation showing how Google tracks users’ personal information, said Ken Glueck, Oracle’s top Washington lobbyist and the architect of the company’s antitrust campaign against Google. Glueck outlined for Bloomberg the presentation, which often entails putting an Android phone inside a black briefcase to show how Google collects users’ location details — even when the phones aren’t in use — and confirmed the contours of the pressure campaign.

“I couldn’t be happier,” said Glueck about the barrage of lawsuits. “As far as I can tell, there are more states suing Google than there are states.”

Oracle's attacks on Google have taken other forms as well, including its now infamous "Shadow Profiles" report that it has submitted to various governments, detailing claims that Google is sucking up tons of data on everyone and doing sketchy things with it.

Whether or not this is true, it kind of leaves out an important fact: Oracle is doing the same thing. And Oracle seems to be doing it in an even sketchier way. You may recall that, last summer, a sneaky data collection company BlueKai leaked tons of personal info on an unsecured server. BlueKai is owned by Oracle. Many years ago, we had been approached about using the service, which seemed incredibly sketchy because it was much more involved in building "shadow profiles" of users in ways that users had no idea about (at least with Google, you can go in and see what the company has on you and can delete much of the info).

But, it gets worse. In a new article from The Markup, it details how various "data brokers" are now bigger lobbyists in DC than many of the big tech firms, maneuvering to make sure that legislators don't cut them off from their data sources. And guess who the biggest such data broker of them all is? Yup. It's Oracle, which has spent the last few years buying up every sketchy data collector it can get its hands on.

Oracle has its own data collection arm but has also built its portfolio by buying up companies like DataRaker, Compendium, and Crosswise. The companies, which were acquired in 2012, 2013, and 2016, respectively, take data from a variety of sources. DataRaker gets data from millions of smart meters and sensors for utilities companies, while Compendium delivers targeted ads. Crosswise allows Oracle to track people across devices, claiming to process data from billions of devices every month. 

Oracle also acquired Datalogix, in 2014, which connected offline purchases to online profiles. Additionally, Oracle combines datasets from more than 75 other data brokers, which it calls “the world’s largest collection of third-party data.” 

And then when you look at how these data brokers are lobbying, you may notice that Oracle stands out way above the rest:

It kind of makes you wonder how much of that lobbying is attacking Google by claiming that Google is doing... what Oracle is actually doing in undermining privacy. And, yes, in case your wondering, the Markup notes that Google spent less than Oracle on lobbying the US government during this period (the year 2020).

None of this is to say that Google is a good player here. There are plenty of reasons to be concerned about what Google does as well. But considering how much effort Oracle seems to be putting into demonizing Google's practices, and how much it's spending on lobbying, when it appears that Oracle's own strategy is to be much more abusive in secretly collecting data on everyone, it seems worth questioning just what Oracle's actual strategy here is, beyond attacking a competitor.

Filed Under: data, data brokers, lobbying, privacy
Companies: google, oracle

Documents Show Hundreds Of Cops Have Run Clearview Searches, Often Without Their Employers' Knowledge Or Permission

from the doing-stuff-just-because-no-one-said-not-to dept

An impressive trove of public records obtained by BuzzFeed shows just how pervasive facial recognition tech is. Law enforcement agencies are embracing the tech, often with a minimum of accountability or oversight. That's how toxic tech purveyors like Clearview -- whose software relies on a multi-billion image database scraped from the web -- get their foot in the door to secure government contracts.

Despite being used for years, facial recognition tech has yet to prove it's capable of recognizing the right faces more often than the wrong ones. The accuracy gets even worse when it's deployed to recognize faces of women and minorities -- and given law enforcement's history of disproportionate enforcement -- it will be minorities harmed by the inaccurate tech more often than not.

What BuzzFeed has done with these Clearview records is compile a searchable database that allows readers to see if their local agencies have tried out the tech. Clearview's tech has yet to be subjected to outside review and its method of obtaining images -- scraping them from public posts on the web -- leaves a lot to be desired in terms of accuracy. (Unfortunately, as the EFF's Dave Maas points out, this doesn't mean BuzzFeed has made the dataset public -- only its interpretation of the data. But we'll take what we can get.)

The upshot? Lots and lots of experimentation. The downside? Very little oversight or explicit permission. According to the information BuzzFeed obtained, more than 335 US law enforcement agencies have at least tried out Clearview's facial recognition AI, and many of those searches had nothing to do with investigations.

Several of the responding agencies appear to be paying little attention to the actions of their employees:

Officials at 34 of those organizations said they were unaware that their employees had signed up for free trials until our questions prompted them to look.

Meanwhile, others pretended they had no responsive documents until asked twice:

Officials at another 69 entities at first denied their employees had used Clearview but later determined that some of them had.

While a tally of 335 law enforcement agencies may seem minute in comparison to the total number of law enforcement agencies in the United States, it would be wise to remember this dataset is far from complete. Nearly 100 agencies refused to answer definitively whether or not their employees had explored Clearview's offerings. Nearly 1,200 agencies have yet to turn over requested documents.

Meanwhile, Clearview has been out there touting law enforcement successes few law enforcement agencies will acknowledge. It also encourages the perception it is currently partnering with hundreds of cop shops while trying to divert attention away from its willingness to grant access to anyone interested in its unproven tech, including government agencies in countries known for their human rights abuses.

This data shows there's more interest in Clearview than law enforcement (as a whole) is willing to admit publicly. It also shows cops are playing with unproven tech -- quite possibly using images of people who aren't suspected of anything -- without the knowledge of their supervisors or government officials charged with overseeing their actions. What's left unsaid -- or unresponded to -- is at least as concerning as what has been admitted publicly. There's a rogue AI on the loose that links cops to a database filled with billions of images scraped from websites without their -- or their end users' -- approval.

Clearview is entirely problematic. But these agencies' willingness to exploit and examine this tech is even more so, considering the damage to rights and civil liberties the careless use of unproven facial recognition tech can cause.

Filed Under: facial recognition, police, privacy
Companies: clearview