One Vote Short: FISA Amendment Requiring Warrants For Browser & Search Data Fails

from the this-is-why-we-can't-have-nice-things dept

As noted yesterday, Congress this week is considering a new bill (the USA FREEDOM Reauthorization Act of 2020) that would not only renew already widely abused and heavily criticized FISA (Federal Intelligence Surveillance Act) powers, but extend the law to include warrantless access to American browsing and search data, a longstanding goal of the "there's no such thing as too much domestic surveillance" set. Given the well documented problems with the existing system, there's a large bipartisan coalition that believes this is, well, idiotic.

Enter Senators Ron Wyden and Steve Daines, who introduced one of three amendments today aimed at making a fleeting effort to rein in FISA authority and abuse. Their amendment would have required a warrant before law enforcement and government could peruse your browsing and search data, which seems like a good idea in normal times, but even more so in the Bill Barr era. Wyden had this to say today about the threat posed by the expansion:

"Back in 2001 when Congress passed the Patriot Act, Americans were rightly concerned about the government collecting their library borrowing records without a warrant. What we're talking about here today, looking at web history browsing history, it is thousands of times more invasive of privacy."

Despite significant support for the Wyden/Daines amendment, it failed with a vote of 59-37, just missing the 60 vote threshold needed to pass. You can find a total roll call here.

Ironically, many of the same GOP Senators you'll routinely see going on at length about the perils of the "deep state" voted to give said deep state more power than ever. 10 Democratic Senators quick to lament Trump's abuse of government institutions (like Tim Kaine) similarly somehow voted to give him more capability to do so. Four other Senators didn't vote on the Wyden/Daines amendment, including Bernie Sanders (who hasn't yet explained his absence) and Senator Patty Murray, whose staffers say she would have voted for it if she had, you know, bothered to vote for it:

Wyden, unsurprisingly, was politely unimpressed by his Senate colleagues:

This is, as they say, why we can't have nice things.

Filed Under: browser data, doj, fbi, fisa, mass surveillance, mitch mcconnell, ron wyden, steve daines, surveillance, usa freedom act, warrants, william barr

Should Your Antivirus Software Be Spying On You?

from the there-is-no-privacy dept

Back in August, Wladimir Palant, the creator behind Adblock Plus, wrote a blog post detailing how Avast Online Security and Avast Secure Browser were collecting and selling the browsing data of the Czech company's 400 million users. In response, both Opera and Mozilla pulled Avast extensions from their respective add on markets, forcing Avast CEO Ondrej Vlcek to go on a PR tour last month to downplay the issue.

Vicek's going to have another busy week. A joint investigation by both Motherboard and PC Magazine (you should read both) obtained documents highlighting how the company collects the browsing data of its 450 million active antivirus customers, then, with the help of a third party outfit named Jumpshot, sells access to that data to a laundry list of companies:

"The data obtained by Motherboard and PCMag includes Google searches, lookups of locations and GPS coordinates on Google Maps, people visiting companies' LinkedIn pages, particular YouTube videos, and people visiting porn websites."

Throughout the scandal, Avast, like so many other companies trafficking in your daily habits, insisted that this collection wasn't that big a deal because this collected data was "anonymized." But there's an endless list of studies showcasing how anonymized data isn't really anonymous, and user data of this type can easily be identifiable with just a small number of additional data points. "Anonymization" is treated as some silver bullet magical get out of jail free card in countless privacy policy conversations, and it really shouldn't be.

PC Mag, for example. highlights how it would take Amazon seconds to identify you from the data they buy from Avast based on the timing of purchases at Amazon. For example a single chunk of anonymized data like this on your clicking habits:

"Device ID: abc123x Date: 2019/12/01 Hour Minute Second: 12:03:05 Domain: Amazon.com Product: Apple iPad Pro 10.5 - 2017 Model - 256GB, Rose Gold Behavior: Add to Cart"

...can pretty easily be used to identify you and build a not-so anonymous profile:

"At first glance, the click looks harmless. You can't pin it to an exact user. That is, unless you're Amazon.com, which could easily figure out which Amazon user bought an iPad Pro at 12:03:05 on Dec. 1, 2019. Suddenly, device ID: 123abcx is a known user. And whatever else Jumpshot has on 123abcx's activity—from other e-commerce purchases to Google searches—is no longer anonymous."

Given we long ago prioritized profits over user security, this certainly isn't new behavior. The telecom sector has been engaged in the same behavior for years, often either outright lying or denying that detailed data collection was happening. It was also reflected by the wireless industry's cellular location data scandals, which highlighted how your wireless carrier collects your every waking movement and then sells access to that data to pretty much any nitwit with a nickel. Nobody cared how that data could or would be abused, ensuring that it repeatedly was -- by everyone from stalkers to law enforcement.

While telecom, app makers, and a laundry list of other companies have been doing this sort of thing for years, you'd think we'd hold security software to a higher standard. Apparently not.

Update: After this article was written, Avast's CEO came out with a statement stating that the company would be shutting down its data collection and sale efforts, and terminating its relationship with Jumpstart. Again, something that would have never happened if a journalist hadn't discovered it:

"As CEO of Avast, I feel personally responsible and I would like to apologize to all concerned. Protecting people is Avast’s top priority and must be embedded in everything we do in our business and in our products. Anything to the contrary is unacceptable. For these reasons, I – together with our board of directors – have decided to terminate the Jumpshot data collection and wind down Jumpshot’s operations, with immediate effect.

That's of course the right way to respond to such a scandal. That said, since there's no real privacy rules for the internet era and no real penalties for companies that routinely lie about this sort of thing, there's really not much (aside from journalists and bad PR) stopping Avast from reconstituting this program in a more modest form at a later date under a different name. And for every CEO like Palant, there's probably 10 executives who couldn't give any less of a shit about user privacy, and see it as their god-given right to hoover up your data and sell it to every nitwit with a nickel.

Filed Under: antivirus, browser data, data, ondrej vlceck, security, spyware
Companies: avast