EU Politicians Tell European Commission To Suspend Privacy Shield Data Transfer Framework

from the US-must-try-harder dept

A couple of months ago, we wrote about an important case at the Court of Justice of the European Union (CJEU), the region's highest court. The final judgment is expected to rule on whether the Privacy Shield framework for transferring EU personal data to the US is legal under EU data protection law. Many expect the CJEU to throw out Privacy Shield, which does little to address the earlier criticisms of the preceding US-EU agreement: the Safe Harbor framework, struck down by the same court in 2015. However, that's not the only problem that Privacy Shield is facing. One of the European Parliament's powerful committees, which helps determine policy related to civil liberties, has just issued a call to the European Commission to suspend the Privacy Shield agreement unless the US tries harder:

The data exchange deal should be suspended unless the US complies with it by 1 September 2018, say MEPs, adding that the deal should remain suspended until the US authorities comply with its terms in full.

There are a couple of reasons why the European Parliament's committee has taken this unusual step. One is the recent furore surrounding Cambridge Analytica's use of personal data collected by Facebook, which the EU politicians incorrectly call a "data breach". However, as they correctly point out, both companies were certified under Privacy Shield, which doesn't seem to have prevented the data from being misused:

Following the Facebook-Cambridge Analytica data breach, Civil Liberties MEPs emphasize the need for better monitoring of the agreement, given that both companies are certified under the Privacy Shield.

MEPs call on the US authorities to act upon such revelations without delay and if needed, to remove companies that have misused personal data from the Privacy Shield list. EU authorities should also investigate such cases and if appropriate, suspend or ban data transfers under the Privacy Shield, they add.

The other concern is the recently-passed Clarifying Lawful Overseas Use of Data Act (CLOUD Act), which grants the US and foreign police access to personal data across borders. This undermines the effectiveness of the privacy protections of the data transfer scheme, since it would allow the personal data of EU citizens to be accessed more easily. The head of the civil liberties committee, Claude Moraes, is quoted as saying:

While progress has been made to improve on the Safe Harbor agreement, the Privacy Shield in its current form does not provide the adequate level of protection required by EU data protection law and the EU Charter. It is therefore up to the US authorities to effectively follow the terms of the agreement and for the Commission to take measures to ensure that it will fully comply with the GDPR.

The mention of the new GDPR there is significant, since it raises the bar for the Privacy Shield framework's compliance with EU data protection laws. A greater stringency makes it more likely that the European Commission will suspend the deal, and that the CJEU will strike it down permanently at some point.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cjeu, data, eu, eu commission, eu parliament, privacy, privacy shield, safe harbor, surveillance, us
Companies: facebook

Irish Judge Slaps Down Facebook's Attempt To Halt EU's Top Court Examining The Legality Of Sending Personal Data To US

from the unquantifiable-and-incapable-of-being-remedied dept

A few weeks ago, we wrote about the Irish High Court referring to the EU's highest court, the Court of Justice of the European Union (CJEU), eleven questions concerning the legality of personal data transfer across the Atlantic.The questions were prompted by a case brought by the privacy expert Max Schrems challenging Facebook's data transfers. When the Irish High Court judge indicated that she intended to make an order for a so-called "preliminary ruling" by the CJEU -- that is, one which addresses the fundamental legal questions raised by the case -- Facebook applied for a stay in order to appeal against the judge's decision at other, higher Irish courts. That's hardly surprising: Facebook's business model depends on being able to move sensitive user data around as it wishes. If both Privacy Shield and the "Standard Contractual Clauses" (SCCs) are ruled illegal, then Facebook -- and many other companies -- will have big problems. Given the danger, it's no wonder that Facebook is trying everything it can to prevent the CJEU from answering those questions.

Considering Facebook's application, the same High Court judge who had made the reference to the CJEU explained that in her view (pdf) there is no right to appeal against that request for clarification under Irish law. However, she went on to consider what the relative harms to each party would be if she were in fact wrong on this matter, and came down firmly in favor of Schrems:

In my opinion, the very real prejudice is potentially suffered by Mr. Schrems and the millions of EU data subjects if the matter is further delayed by a stay as sought in this case. Their potential loss is unquantifiable and incapable of being remedied.

The High Court judge also tackled Facebook's main argument why the reference to the CJEU should be put on hold: because the EU's new General Data Protection Regulation (GDPR) was about to be enforced, and that would change the legal context dramatically. However, the judge was having none of this, not least because Facebook was trying to introduce a completely new argument at this very late stage of the legal process. As she wrote in her judgment:

The fact that the point is only now being raised gives rise to considerable concern as to the conduct of the case by Facebook and the manner in which it has dealt with the court.

This is the judge's polite way of saying that Facebook's behavior is bloody outrageous. She goes on:

Clearly the existing delays have already potentially gravely prejudice[d] the [Irish Data Protection Commissioner] and Mr. Schrems. I do not propose to exacerbate this potential prejudice any further. If I had been prepared to grant a limited stay on the order of reference to allow for an application to be made to the [Irish] Supreme Court for leave to appeal, I am firmly of the view that this argument clearly weighs against the grant of any stay in the circumstances.

I am of the opinion that the court will cause the least injustice if it refuses any stay and delivers the reference immediately to the [EU] Court of Justice. I so order.

That's a "no", then...

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cjeu, data, ireland, privacyshield
Companies: facebook

DOJ Asks Supreme Court To Dump Microsoft Case, Let It Use New CLOUD Act To Demand Overseas Data

from the sighs-and-eyerolling-from-DOJ-counsel dept

As expected, the DOJ has asked the Supreme Court to toss the Microsoft case. The appeal sitting before the court deals with collecting data overseas using US-issued warrants, rather than mutual assistance treaties. As the DOJ argues in its motion to vacate [PDF], the passage of the CLOUD Act -- stapled to the tail end of 2,200-page budget bill -- makes this argument moot. For all intents and purposes, the new law (which apparently still has no effective date) grants the government the power to demand production of data stored overseas by US companies using a regular magistrate's warrant.

The motion goes further than just asking the Supreme Court to drop the case. It also takes some time to complain about Microsoft inconveniencing the DOJ by forcing it to acquire another warrant for the same info under the newly-granted authority. The DOJ, despite its apparent compliance with Microsoft's request, spends a few paragraphs explaining why it shouldn't need to do the thing it already did.

The application of the CLOUD Act to the original Section 2703 warrant at issue in this case would not be retroactive. Microsoft’s production of the requested information has not been “completed,” Landgraf, 511 U.S. at 270, as it remains possible for Microsoft to comply fully with the government’s demand for disclosure. The Section 2703 warrant remained valid after the CLOUD Act, and no real consequences have attached to Microsoft’s failure to comply with the warrant up to this point.

[...]

Nevertheless, Microsoft has refused to acknowledge either that the CLOUD Act applies to the Section 2703 warrant at issue in this case or that Microsoft plans to disclose the required information under the original warrant.

Microsoft's objection hinges on unresolved contempt charges stemming from the case it successfully appealed twice. According to Microsoft, its compliance with the old warrant might trigger retroactive charges, which would be problematic for it. The DOJ points out no sanctions were ever threatened by the district court, which only entered contempt charges to allow the decision to be appealed.

Nonetheless, an exasperated DOJ has complied with Microsoft's demand that a new warrant issued under the CLOUD Act be provided.

Accordingly, on March 30, 2018, the government applied for a new warrant covering the relevant information requested in the Section 2703 warrant at issue in this case. A magistrate judge issued the warrant that same day. Under the new warrant, which will replace the original warrant and which the CLOUD Act indisputably governs, Microsoft must produce any covered information within its “possession, custody, or control.” CLOUD Act § 103(a). Microsoft no longer has any basis for suggesting that such a warrant is impermissibly extraterritorial because it reaches foreign-stored data, which was the sole contention in its motion to quash.

And it returns to the subject again to remind the court how much of a pain in the ass Microsoft is being about all of this.

The government does not believe that seeking a new warrant was necessary in order to compel Microsoft to act: In light of the CLOUD Act, Microsoft should have simply complied with the existing warrant, to which it can have no valid legal objection...

The last loose end the government seeks to have tied up is the appeals court decision, which the DOJ claims could cause future jurisdictional issues for warrants issued by that circuit. It also lets the Supreme Court know it thinks the lower decision should also be vacated because it's just so (subjectively) wrong.

Leaving the court of appeals’ decision in place as circuit precedent could therefore generate uncertainty in future extraterritoriality, Fourth Amendment, or subpoena cases arising in the Second Circuit. Given the serious flaws in the court’s reasoning, this case implicates the traditional need for vacatur to “clear[] the path for future relitigation of the issues” and to “eliminate[] a judgment, review of which was prevented through happenstance.”

The DOJ gets the win it wanted, but won't have circuit precedent to rely on. Instead, it got a whole new law to use to force US companies to turn over data stored outside of the US. It will now be able to meddle in international affairs and open the door for similar meddling by other countries not quite as respectful of civil liberties as we are.

Filed Under: 4th amendment, cloud act, data, doj, due process, overseas data, privacy, subpoenas, supreme court, surveillance, warrants
Companies: microsoft

Hey Mark Zuckerberg: Don't Lock Down Everyone's Data, Open It Up To Services That Give Your Users More Control Over Their Data

from the there-are-other-solutions dept

As we've been discussing all week, a lot of people are reacting to the wrong thing in the whole Facebook / Cambridge Analytica mess. The problem was not that Facebook had an open API -- but that its users were unaware of what was happening with their own data. Unfortunately, many, many people (including the press and politicians) are running with the narrative that Facebook failed to "protect" data. And, just as we warned, the coming "solutions" won't help matters, but will actually make them worse.

Case in point: when Mark Zuckerberg finally made his big press tour on Wednesday evening, he repeatedly told people that, the public has spoken and Facebook will lock down your data now.

I do think early on on the platform we had this very idealistic vision around how data portability would allow all these different new experiences, and I think the feedback that we’ve gotten from our community and from the world is that privacy and having the data locked down is more important to people than maybe making it easier to bring more data and have different kinds of experiences.

This is the wrong solution for two reasons: (1) It makes Facebook that much more central and dominant to online activities, making it that much more difficult for upstarts and competitors to compete and (2) it takes away power from the end users to do more with their own data. For all the people whining about Facebook having too much of your data, this is not the solution you want. This is effectively giving Facebook even more power over your data, not less.

If people were to take the time to actually understand the issue, then they wouldn't be pressuring Facebook to react this way. And there are better solutions: give people more access to their own data. That means, as Cory Doctorow suggested, the better way out is for Facebook to open itself up in a different way: to open itself up to third party app developers not to suck up data for marketing databases, but to give end users more control over their own data and how it is used.

People are so focused on Facebook sucking up their data, that they're responding by demanding Facebook be a better steward of their data... rather than demanding that they get to manage their own data.

Nearly a decade ago, EFF suggested a social media bill of rights that it hoped sites like Facebook would adopt. It included giving users transparency into who wants their data and who gets it, giving users full control over their data, and finally enabling them to export their data in a useable format to bring to other sites on their own terms. If we lived in such a world, then we wouldn't have to worry about the Cambridge Analytica situation, because users would know that some creepy personality test app was requesting their info, and they could deny it (or they could set filters that would automatically block it).

So, if Mark Zuckerberg really wants to respond to this crisis in a way that's helpful, he should be opening up his platform... to a different set of app developers. It shouldn't go to the developers who are siphoning up everyone's data, but to those who can provide tools for end users to have full transparency and control over their data.

Unfortunately, the political and media reality is that if Zuckerberg actually went down this path, he'd probably be slammed for "opening up" user data, rather than locking it down.

Filed Under: apis, competition, control, data, data portability, mark zuckerberg, ownership, transparency
Companies: cambridge analytica, facebook

How 'Regulating Facebook' Could Make Everyone's Concerns Worse, Not Better

from the it's-a-mess dept

In my last post, I described why it was wrong to focus on claims of Facebook "selling" your data as the "problem" that came out over the weekend concerning Cambridge Analytica and the data it had on 50 million Facebook users. As we described in detail in that post, that's not the problem at all. Instead, much of the problem has to do with Facebook's utter failure to be transparent in a way that matters -- specifically in a way that its users actually understand what's happening (or what may happen) to their data. Facebook would likely respond that it has tried to make that information clear (or, alternatively, it may say that it can't force users to understand what they don't take the time to understand). But I don't think that's a good answer. As we've learned, there's a lot more at stake here than I think even Facebook recognized, and providing much more real transparency (rather than superficial transparency) is what's necessary.

But that's not what most people are suggesting. For example, a bunch of people are calling for "Know Your Customer" type regulations similar to what's found in the financial space. Others seem to just be blindly demanding "oversight" without being able to clearly articulate what that even means. And some are bizarrely advocating "nationalizing Facebook", which would literally mean giving billions in taxpayer dollars to Mark Zuckerberg. But these "solutions" won't solve the actual issues. In that article about "KYC" rules, there's the following, for example:

“They should know who’s paying them,” said Vasant Dhar, a professor of information systems at New York University, “because the consequences are very serious.” In December, Dhar wrote an op-ed calling for social media regulation — specifically, something similar to the “know your customer” laws that apply to banks. “The US government and our regulators need to understand how digital platforms can be weaponized and misused against its citizens, and equally importantly, against democracy itself,” he wrote at the time.

Antonio García-Martinez, Facebook’s first targeted ads manager, thinks so too. “For certain classes of advertising, like politics, a random schmo with a credit card shouldn’t just be able to randomly run ads over the entire Facebook system,” he told me.

Except... that has literally nothing to do with what the Cambridge Analytica controversy is all about. And, anyway, as we've discussed before, the Russians bent over backwards to pretend to be Americans when buying ads, so it's not like KYC rules would really have helped for the ads. And the whole Cambridge Analytica may have involved some ads (and lots of other stuff), but Facebook knew who "the customer" was in that instance. And it knew how an "academic" was slurping up some data for "academic research." Knowing your customer wouldn't have made the slightest difference at all here.

Even Tim Berners-Lee, who recently stirred the pot by suggesting regulations for social media doesn't seem to have much concrete information that would have mattered here.

What’s more, the fact that power is concentrated among so few companies has made it possible to weaponise the web at scale. In recent years, we’ve seen conspiracy theories trend on social media platforms, fake Twitter and Facebook accounts stoke social tensions, external actors interfere in elections, and criminals steal troves of personal data.

We’ve looked to the platforms themselves for answers. Companies are aware of the problems and are making efforts to fix them — with each change they make affecting millions of people. The responsibility — and sometimes burden — of making these decisions falls on companies that have been built to maximise profit more than to maximise social good. A legal or regulatory framework that accounts for social objectives may help ease those tensions.

I don't think Tim is wrong per se in arguing that there are issues in how much power is concentrated between a small group of large companies -- but I'm not sure that "a legal or regulatory framework" actually fixes any of that. Indeed, it seems highly likely to do the reverse.

As Ben Thompson notes in his own post about this mess, most of the regulatory suggestions being proffered will lock in Facebook as an entrenched incumbent. That's because it will (a) create barriers that Facebook can deal with, but startups cannot and (b) focus on "cementing" Facebook's model (with safeguards) rather than letting the next wave of creative destruction take down Facebook.

It seems far more likely that Facebook will be directly regulated than Google; arguably this is already the case in Europe with the GDPR. What is worth noting, though, is that regulations like the GDPR entrench incumbents: protecting users from Facebook will, in all likelihood, lock in Facebook’s competitive position.

This episode is a perfect example: an unintended casualty of this weekend’s firestorm is the idea of data portability: I have argued that social networks like Facebook should make it trivial to export your network; it seems far more likely that most social networks will respond to this Cambridge Analytica scandal by locking down data even further. That may be good for privacy, but it’s not so good for competition. Everything is a trade-off.

Note that last bit? A good way to take away Facebook's dominance is to enable others to compete in the space. The best way to do that? Make it easy for people to switch from Facebook to upstart competitors. The best way to do that? Make it easier for Facebook users to export their data... and use it on another service. But as soon as you do that, you're actually right back into the risky zone. Why is Facebook in so much hot water right now? Because it made it too easy to export user data to third party platforms! And, any kind of GDPR-type solution is just going to lock down that data, rather than enabling them to help seed competition.

Cory Doctorow, over at EFF, has what I think is the most reasonable idea of all: enable third parties to build tools that help Facebook's (and every other platform's!) users better manager and understand their privacy settings and what's being done with their data. That's an actual solution to the problem we laid out in the previous post: Facebook's failed transparency. Doctorow compares the situation to ad-blockers. Ads became too intrusive, and users were able to make use of 3rd party services to stop the bad stuff. We should be able to do something similar with privacy and data controls. But, thanks to some pretty dumb laws and court rulings (including a key one that Facebook itself caused), that's really not possible:

This week, we made you a tutorial explaining the torturous process by which you can change your Facebook preferences to keep the company’s “partners” from seeing all your friends’ data. But what many folks would really like to do is give you a tool that does it for you: go through the tedious work of figuring out Facebook’s inscrutable privacy dashboard, and roll that expertise up in a self-executing recipe — a piece of computer code that autopiloted your browser to login to Facebook on your behalf and ticked all the right boxes for you, with no need for you to do the fiddly work.

But they can’t. Not without risking serious legal consequences, at least. A series of court decisions — often stemming from the online gaming world, sometimes about Facebook itself — has made fielding code that fights for the user into a legal risk that all too few programmers are willing to take.

That's a serious problem. Programmers can swiftly make tools that allow us to express our moral preferences, allowing us to push back against bad behavior long before any government official can be convinced to take an interest — and if your government never takes an interest, or if you are worried about the government's use of technology to interfere in your life, you can still push back, with the right code.

So if we really, truly, want to deal with the problem, then we need to push for more control by the end users. Let users control and export their data, and let people build tools that allow them to do so, and to control and transparently understand what others do with their data.

If someone comes up with a "regulatory regime" that does that, it would be fantastic. But so far, nearly every suggestion I've seen has gone in the other direction. They will do things like force Facebook to "lock down" its data even more, making it harder for users to extract it, or for third parties to provide users the tools they need to control their own data. They'll put useless, but onerous, Know Your Customer rules that Facebook will be able to throw money at to solve, but every smaller platform will find incredibly costly.

I'm not optimistic about how all of this works out. Even if you absolutely hate Facebook and think the company is evil, doesn't care one wit about your privacy, and is run by the most evil person on the planet, you should be especially worried with the regulatory suggestions that are coming. They're not going to help. They're going to entrench Facebook and lock down your data.

Filed Under: data, elections, know your customer, openness, platforms, regulations, social media, transparency
Companies: cambridge analytica, facebook

Facebook Has Many Sins To Atone For, But 'Selling Data' To Cambridge Analytica Is Not One Of Them

from the let's-at-least-be-accurate dept

Obviously, over the past few days there's been plenty of talk about the big mess concerning Cambridge Analytica using data on 50 million Facebook users. And, with that talk has come all sorts of hot takes and ideas and demands -- not all of which make sense. Indeed, it appears that there's such a rush to condemn bad behavior that many are not taking the time to figure out exactly what bad behavior is worth condemning. And that's a problem. Because if you don't understand the actual bad behavior, then your "solutions" will be misplaced. Indeed, they could make problems worse. And... because I know that some are going to read this post as a defense of Facebook, let me be clear (as the title of this post notes): Facebook has many problems, and has done a lot of bad things (some of which we'll discuss below). But if you mischaracterize those "bad" things, then your "solutions" will not actually solve them.

One theme that I've seen over and over again in discussions about what happened with Facebook and Cambridge Analytica is the idea that Facebook "sold" the data it had on users to Cambridge Analytica (alternatively that Cambridge Analytica "stole" that data). Neither is accurate, and I'm somewhat surprised to see people who are normally careful about these things -- such as Edward Snowden -- harping on the "selling data" concept. What Facebook actually does is sell access to individuals based on their data and, as part of that, open up the possibility for users to give some data to companies, but often unwittingly. There's a lot of nuance in that sentence, and many will argue that for all reasonable purposes "selling data" and my much longer version are the same thing. But they are not.

So before we dig into why they're so different, let's point out one thing that Facebook deserves to be yelled at over: it does not make this clear to users in any reasonable way. Now, perhaps that's because it's not easy to make this point, but, really, Facebook could at least do a better job of explaining how all of this works. Now, let's dig in a bit on why this is not selling data. And for that, we need to talk about three separate entities on Facebook. First are advertisers. Second are app developers. Third are users.

The users (all of us) supply a bunch of data to Facebook. Facebook, over the years, has done a piss poor job of explaining to users what data it actually keeps and what it does with that data. Despite some pretty horrendous practices on this front early on, the company has tried to improve greatly over the years. And, in some sense, it has succeeded -- in that users have a lot more granular control and ability to dig into what Facebook is doing with their data. But, it does take a fair bit of digging and it's not that easy to understand -- or to understand the consequences of blocking some aspects of it.

The advertisers don't (as is all too commonly believed) "buy" data from Facebook. Instead, the buy the ability to put ads into the feeds of users who match certain profiles. Again, some will argue this is the same thing. It is not. From merely buying ads, the advertiser gets no data in return about the users. It just knows what sort of profile info it asked for the ads to appear against, and it knows some very, very basic info about how many people saw or interacted with the ads. Now, if the ad includes some sort of call to action, the advertiser might then gain some information directly from the user, but that's still at the user's choice.

The app developer ecosystem is a bit more complicated. Back in April of 2010, Facebook introduced the Open Graph API, which allowed app developers to hook into the data that users were giving to Facebook. Here's where "things look different in retrospect" comes into play. The original Graph API allowed developers to access a ton of information. In retrospect, many will argue that this created a privacy nightmare (which, it kinda did!), but at the same time, it also allowed lots of others to build interesting apps and services, leveraging that data that users themselves were sharing (though, not always realizing they were sharing it). It was actually a move towards openness in a manner that many considered benefited the open web by allowing other services to build on top of the Facebook social graph.

There is one aspect of the original API that does still seem problematic -- and really should have been obviously problematic right from the beginning. And this is another thing that it's entirely appropriate to slam Facebook for not comprehending at the time. As part of the API, developers could not only get access to all this information about you... but also about your friends. Like... everything. From the original Facebook page, you can see all the "friend permissions" that were available. These are better summarized in the following chart from a recent paper analyzing the "collateral damage of Facebook apps."

If you can't read that... it's basically a ton of info from friends, including their likes, birthdays, activities, religion, status updates, interests, etc. You can kind of understand how Facebook ended up thinking this was a good idea. If an app developer was designing an app to provide you a better Facebook experience, it might be nice for that app to have access to all that information so it could display it to you as if you were using Facebook. But (1) that's not how this ever worked (and, indeed, Facebook went legal against services that tried to provide a better Facebook experience) and (2) none of this was made clear to end-users -- especially the idea that in sharing your data with your friends, they might cough up literally all of it to some shady dude pushing a silly "personality test" game.

But, of course, as I noted in my original post, in some cases, this set up was celebrated. When the Obama campaign used the app API this way to reach more and more people and collect all the same basic data, it was celebrated as being a clever "voter outreach" strategy. Of course, the transparency levels were different there. Users of the Obama app knew what they were supporting -- though didn't perhaps realize they were revealing a lot of friend data at the same time. Users of Cambridge Analytica's app... just thought they were taking a personality quiz.

And that brings us to the final point here: Cambridge Analytica, like many others, used this setup to suck up a ton of data, much of it from friends of people who agreed to install a personality test app (and, a bunch of those users were actually paid via Mechanical Turk to basically cough up all their friends' data). There are reasonable questions about why Facebook set up its API this way (though, as noted above, there were defensible, if short-sighted, reasons). There are reasonable questions about why Facebook wasn't more careful about watching what apps were doing with the data they had access to. And, most importantly, there are reasonable questions about how transparent Facebook was to its end users through all of this (hint: it was not at all transparent).

So there are plenty of things that Facebook clearly did wrong, but it wasn't about selling data to Cambridge Analytica and it wasn't Cambridge Analytica "stealing" data. The real problem was in how all of this was hidden. It comes back to transparency. Facebook could argue that this information was all "public" -- which, uh, okay, it was, but it was not public in a way that the average Facebook user (or even most "expert" Facebook users) truly understood. So if we're going to bash Facebook here, it should be for the fact that none of this was clear to users.

Indeed, even though Facebook shut down this API in April of 2015 (after deprecating it in April of 2014), most users still had no idea just how much information Facebook apps had about them and their friends. Today, the new API still coughs up a lot more info than people realize about themselves (and, again, that's bad and Facebook should improve that), but no longer your friends' data as well.

So slam Facebook all your want for failing to make this clear. Slam Facebook for not warning users about the data they were sharing -- or that their friends could share. Slam Facebook for not recognizing how apps were sucking up this data and the privacy implications related to that. But don't slam Facebook for "selling your data" to advertisers, because that's not what happened.

I was going to use this post to also discuss why this misconception is leading to bad policy prescriptions, but this one is long enough already, so stay tuned for that one next. Update: And here's that post.

Filed Under: apps, breach, data, selling data, social media, transparency, users
Companies: cambridge analytica, facebook

Both Facebook And Cambridge Analytica Threatened To Sue Journalists Over Stories On CA's Use Of Facebook Data

from the this-is-bad dept

I'm going to assume that you weren't living in an internet-proof cave this weekend, and caught at least some of the stories about Cambridge Analytica and Facebook. The news first kicked off with the announcement of a data protection lawsuit filed against Cambridge Analytica in the UK on Friday evening (we'll likely have more on that lawsuit soon), followed quickly by an attempt by Facebook to get out ahead of the coming tidal wave by announcing that it was suspending Cambridge Analytica and some associated parties from its platforms, claiming terms of service violations. This was quickly followed on Saturday with two explosive stories. The first, from Carole Cadwalladr at The Guardian, revealing a "whistleblower" from the very early days of Cambridge Analytica (who more or less set up how it works with data profiles) named Christopher Wylie. This was quickly followed up by another story at the NY Times, which was a bit more newsy, providing more details on how Cambridge Analytica got data on about 50 million people out of Facebook.

Admittedly -- much of this isn't actually new. The Intercept had reported something similar a year ago, though it only said it was 30 million Facebook users, rather than 50 million. And that story built on the work of a 2015 (yes, 2015) story in the Guardian discussing how Cambridge Analytica was using data from "tens of millions" of Facebook users "harvested without permission" in support of Ted Cruz's presidential campaign.

There's a lot of heat on this story right now, and a lot of accusations being thrown around, and I'll admit that I'm not entirely sure where I come down on the details yet. I assume people on basically both sides of this issue will scream at me and call me names over this, but there's too much going on to fully understand what happened here. I will note that, in that Guardian story in 2015, Cruz told the publication that this data collecting and targeting effort was "very much the Obama model." And political consultant Patrick Ruffini has a well worth reading Twitter thread arguing that people are overreacting to much of this, and that the 2012 Obama campaign did the exact same thing, and was celebrated for its creative use of data and targeting on the internet. Ad tech guy Jay Pinho makes the same point as well. Here's a Time article from 2012 excitedly talking up how the Obama campaign used Facebook in the same way:

That’s because the more than 1 million Obama backers who signed up for the app gave the campaign permission to look at their Facebook friend lists. In an instant, the campaign had a way to see the hidden young voters. Roughly 85% of those without a listed phone number could be found in the uploaded friend lists.

Of course, there is one major difference between the Obama one and the Cambridge Analytica one, which involves the level of transparency. With the Obama campaign, people knew they were giving their data (and friend's data) to the cause of re-electing Obama. Cambridge Analytica got its data by having a Cambridge academic (who the new Guardian story revealed for the first time is also appointed to a position at St. Petersburg University) set up an app that was used to collect much of this data, and misled Facebook by telling them it was purely for academic purposes, when the reality is that it was setup and directly paid for by Cambridge Analytica with the intent of sucking up that data for Cambridge Analytica's database. Is that enough to damn the whole thing? Perhaps.

As for the claims that this is just the same old Facebook model of selling everyone's data... that was not true and still is not accurate. Facebook doesn't sell your data. It sells access to its users via the data it has on you. That may not seem different, but it is different. But the lines do seem to get a bit blurry, as it appears that Cambridge Analytica, via its partnership with the professor Dr. Aleksander Kogan (who apparently briefly changed his name to -- I kid you not -- Dr. Spectre) and his "Global Science Research," basically paid people via Amazon's Mechanical Turk to do a "personality assessment" on Facebook that, as part of the process, exposed information about their entire social graph, which GSR apparently hoovered up and passed along to Cambridge Analytica.

At the very least, it can be said that Facebook should have recognized much earlier that this could and would be done, and to understand the potential privacy problems related to it. Facebook has a fairly long and painful history of not quite realizing how what it does impacts people's privacy, and this is one more example.

But, it's raising a bigger question, as well, and it's one that caused Facebook to do something that I'll definitively call as "incredibly stupid," which is that it threatened to sue the Guardian over its story, mainly because the Guardian story refers to this whole mess as a "data breach" for Facebook's data.

And, of course, Facebook wasn't the only one who threatened to sue. Cambridge Analytica did too:

The Observer also received the first of three letters from Cambridge Analytica threatening to sue Guardian News and Media for defamation.

There are issues of terminology here. Facebook, in its post, is adamant that what happened is not a "breach"

The claim that this is a data breach is completely false. Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.

There are legal reasons why Facebook is so concerned about whether or not this is a "breach" and, let's face it, the company is about to face a million and a half lawsuits over this, not to mention government investigations (already Senator Amy Klobuchar has demanded Mark Zuckerberg's head on a platter testimony before the Senate and Massachusetts' Attorney General Maura Healey has announced the opening of an investigation, and there have also been rumblings out of the UK and the EU, as well as the FTC). But, there are also some fairly important legal obligations if this was a "breach" in the traditional sense, such as disclosing that to those impacted by the breach.

I'm not entirely sure where I come down on the breach question. It doesn't feel like a traditional breach. It wasn't that Facebook coughed up this info, it was its users coughed up the info... and Facebook just made it easy for this outside "academic" to hoover up all that info by paying a bunch of people to take dopey personality quizzes. However, as the Guardian's Alex Hern points out, how do you distinguish what Kogan/GSR/Cambridge Analytica did from social engineering to get information.

Of course, there is something of a difference: it still wasn't Facebook per se coughing up the info. It was Facebook's own users. And, you might even argue that if you believe that Facebook doesn't "own" all this data in the first place, that it was actually those Facebook users coughing up a bunch of their own data -- including lots of data about their friends. Needless to say, this is a mess where a lot more transparency might help, and that transparency is going to be forced upon Facebook with a sledgehammer in the near near future.

But, regardless of where you come down on all of this, Facebook threatening defamation against the Guardian for calling this a data breach is ludicrous and Facebook should be ashamed and apologize. Even as it clearly disagrees with how the Guardian characterized much of the story, that's no excuse to whip out defamation threats. Not only is it incredibly stupid from a Facebook PR perspective (and makes the company look like a giant bully), it suggests that the company still has absolutely no fucking clue how to communicate with the press and the public about how its own platform works.

It's actually quite incredible to recognize just how big Facebook has gotten in the face of how little it seems to understand about what its own platform does.

Filed Under: aleksander kogan, christopher wylie, data, data breach, data sharing, elections, transparency
Companies: cambridge analytica, facebook, global science research

Judge Tells Prosecutors They Need To Prove Contractor Knew He Had Classified Docs In His 50-Terabyte Stash

from the go-big-AND-go-home dept

The federal judge presiding over the prosecution of a government contractor who took home 50 terabytes of sensitive national security documents home with him has sent a message. And the message is this: collect it all.

Harold Martin did what surveillance agencies do best. He built himself a haystack of government documents, some of them designated "top secret." The prosecution is counting on this haystack to put Harold Martin in prison on espionage charges. But the judge has just ordered prosecutors to prove the few "top secret" needles justify a conviction for the entire haystack. Josh Gerstein at Politico has the details.

Baltimore-based U.S. District Court Judge Marvin Garbis suggested in his Feb. 16 order that the sheer volume of information may be a problem for prosecutors because their case is based on 20 felony charges that Martin illegally retained individual classified documents without permission.

Garbis asked the prosecution and defense to explain whether the government must prove that Martin knew he had those specific documents in his possession or whether he could be convicted of the claimed Espionage Act violations without such proof.

Espionage prosecutions are a mess. This mess usually works in the government's favor. The rules surrounding these prosecutions severely restrict the defenses the accused can raise and the evidence they can submit. The sensitivity of the underlying documents results in plenty of ex parte submissions seen only by the judge and the government. In this case, though, the judge is asking the government to prove Martin knowingly took top secret documents, rather than just ending up with some in his massive collection of government paperwork. If it can't, Martin might walk away from charges on the premise he had no idea what was in the 50 terabytes in his possession. Here's law prof Steve Vladeck's take on the order:

"There has not been a lot of really sophisticated litigation about the awkwardness of treating piles of information as being subject to the Espionage Act because of one piece of that pile," said University of Texas law professor Stephen Vladeck. "It's a rare situation where the defendant has a plausible argument that he grabbed the wrong pile of documents."

Prosecutors aren't happy with this order. Their response says they have no obligation to prove Martin knew he had sensitive documents in his stash. This is a questionable assertion, considering the accusing party carries the burden of proof in all criminal cases. The government apparently believes it can secure a conviction without this key evidence.

But prosecutors also make a solid point: a requirement like this encourages people exfiltrating government documents to take as many as possible. The more you grab, the harder it is for prosecutors to prove you knowingly possessed classified material.

If this proves to be a sticking point, prosecutors may decide to go after Martin for theft. It probably won't net them the sentence a 20-count indictment normally would, but probably looks more palatable than accepting Martin's unsolicited offer to plead guilty to a single count of the charges brought against him.

Hopefully, the judge won't back down from this demand. The government's track record with espionage prosecutions is terrible. They've severely harmed people who've done nothing more than try to be a good employee. Lots of people take work home with them. Only a very small percentage of those do anything more nefarious with government documents than work off the clock.

Filed Under: data, harold martin, hoarding, nsa, secrets, top secret

FCC Broadband Availability Data Derided As Inaccurate, 'Shameful'

from the rose-colored-glasses dept

We've long-noted how the government doesn't do a very good job tracking broadband availability and pricing, in large part because incumbent ISPs like Comcast, Verizon and AT&T don't want them to. ISPs (and the lawmakers paid to love them) whined incessantly about the last FCC's efforts to raise the standard definition of broadband, given it only highlighted the fact that two-thirds of Americans can't get "broadband" (25 Mbps) from more than one ISP. ISPs also fight revealing pricing data, which is why our $300 million broadband availability map doesn't contain any price data whatsoever.

ISPs have also routinely lobbied against efforts to improve broadband availability mapping, since more clearly highlighting competition and deployment shortcomings might result in somebody actually doing something about it. As a result, government reports on the health of the clearly-dysfunctional U.S. broadband market tend to have a decidedly unrealistic and rosy timbre, which is often worse if the regulators in question are of the revolving door variety (as we're currently seeing under current agency boss Ajit Pai).

And while Pai is busy insisting that he's all about transparency, hard economics, and "closing the digital divide," his policies repeatedly and consistently undermine those claims.

Case in point: folks in West Virginia have complained about particularly awful broadband for years. The state is the poster child for what horrible broadband (and the corruption that helps protect it) looks like. Verizon neglected the state's infrastructure for years, then offloaded its unwanted DSL customers to Frontier Communications, who not only bungled the acquisition, but has been caught repeatedly ripping off taxpayers thanks to regulatory apathy. The end result has been millions of state residents who either can't get broadband at all, or are forced to pay an arm and a leg for sub 3 Mbps DSL straight from 1999.

So when a recent FCC broadband availability report tried to claim the state was awash in broadband availability, the people who actually live there were understandably annoyed:

"Numbers in a federal report about West Virginians who have access to broadband internet services are “not even close to being correct,” the chairman of the state’s broadband council said Thursday. The Federal Communications Commission released the report last week. It claims, among other things, that seven West Virginia counties have 100-percent access to a fixed broadband connection.

"To me, this goes beyond having inaccuracies,” Hinton said. “It’s just disappointing. That’s all it is. At what point next year are they going to say West Virginia has 100 percent coverage?" "It’s shameful,” Hinton said. “It’s just disappointing that moving forward, this is the kind of data that will dictate where we can invest infrastructure dollars."

Again, this kind of errant data isn't a mistake, it's intentional. ISPs spend millions of dollars annually to ensure broadband availability and pricing data isn't particularly accurate. And while they claim providing more accurate data than currently obligated under the form 477 process would be expensive and "burdensome," the reality is they don't want anybody pointing out that these companies enjoy vast last-mile monopolies across huge swaths of the country. And, thanks to many telcos refusing to upgrade aging DSL lines the problem is getting notably worse in many areas.

Again, were government mapping efforts to provide a more accurate understanding of competition and deployment shortcomings, it might result in somebody pushing policies that actually do something about it, and we most certainly wouldn't want that.

Filed Under: ajit pai, broadband, competition, data, fcc