Ajit Pai Refuses To Brief Congress On What He Plans To Do About Wireless Location Data Scandals

from the thanks-but-no-thanks dept

So last week yet another location data scandal emerged for the wireless industry, highlighting once again how carriers are collecting your location data, then selling it to a universe of sometimes shady partners with little to no oversight or accountability. Like the Securus and LocationSmart scandals before it, last week's Motherboard report highlighted how all manner of dubious dudebros (and law enforcement officers) have been abusing this data for years, and the Ajit Pai FCC has yet to so much as mention the problem, much less spend a single calorie addressing it in any meaningful way.

Shortly after the scandal broke last week, Frank Pallone, the Chair of the House Committee on Energy and Commerce, asked Pai (pdf) to brief Congress on the steps the agency was taking to address the wireless sector's long-standing failure to adequately address location data abuse. Pai's response? Yeah, no thanks.

In a statement issued by Pallone, he says Pai's office claimed that since the location data scandal wasn't putting lives at risk, Pai could not attend such a briefing during the government shutdown:

"Today, FCC Chairman Ajit Pai refused to brief Energy and Commerce Committee staff on the real-time tracking of cell phone location, as reported by Motherboard last week. In a phone conversation today, his staff asserted that these egregious actions are not a threat to the safety of human life or property that the FCC will address during the Trump shutdown.

While the FCC's working on a skeleton crew right now due to the shut down, there's nothing actually stopping Pai from wandering down the road to answer a few questions, something Pallone was quick to highlight in his statement:

"There’s nothing in the law that should stop the Chairman personally from meeting about this serious threat that could allow criminals to track the location of police officers on patrol, victims of domestic abuse, or foreign adversaries to track military personnel on American soil. The Committee will continue to press the FCC to prioritize public safety, national security, and protecting consumers."

Granted Pai wasn't doing much about this problem when the government was open, either.

Academics and other privacy experts have told me this could easily be addressed using the FCC and FTC authority we already have (read: we don't even need a new privacy law), we've just chosen to kowtow to telecom lobbyists instead. In fact the FCC's privacy rules would have addressed the issue by giving consumers more control of how their location data is shared and sold, but sector lobbyists made quick work of those rules back in 2017. Even having Pai publicly state that this behavior is unacceptable might go a long way toward addressing the issue, though he's yet to do even that.

Pai has made it fairly clear by now that he sees government consumer protection oversight as largely unnecessary, and all criticism of his unpopular policies as entirely political in nature, therefore making it OK to ignore (the myopia of that belief system most obviously exemplified by his attacks on net neutrality). As a result, you should expect the FCC to continue to do little to nothing about location data scandals. At least until there's enough scandals of this type to push public outrage past the breaking point, finally making it clear that doing absolutely nothing is no longer an option. So, 2025 or so?

Filed Under: ajit pai, congress, e&c, fcc, frank pallone, house energy & commerce committee, location, location data, privacy, shutdown

Congressional Committees Say Backdooring Encryption Is A Bad Idea

from the sorry,-Jim,-but-thanks-for-asking! dept

Two bipartisan Congressional committees are the latest to express their opposition to government-mandated encryption backdoors. The House Judiciary Committee and the House Energy and Commerce Committee have arrived at the same conclusion as the experts FBI director James Comey insists on ignoring: encryption backdoors are a net loss for everyone, no matter what gains might be experienced by law enforcement and intelligence agencies.

This is stated plainly in the first bullet point of its encryption report [PDF]:

Any measure that weakens encryption works against the national interest

While the committees acknowledge encryption can impede investigative efforts, the downsides of backdoors cannot be offset by making things easier for certain government agencies.

[S]takeholders from all perspectives acknowledged the importance of encryption to our personal, economic, and national security. Representatives of the national security community told the EWG that strong encryption is vital to the national defense and to securing vital assets, such as critical infrastructure. Civil society organizations highlighted the importance of encryption for individual privacy, freedom of speech, human rights, and protection against government intrusion at home and abroad. Private sector stakeholders—in particular, their information security officers—and members of the academic community approached the question from an engineering perspective—against a wide array of threats, foreign and domestic, encryption is one of the strongest cybersecurity tools available.

However, the committees still believe there might be a way to reconcile competing interests, even though it has more questions than answers at this point. The report suggests more "collaboration" between tech companies and law enforcement agencies -- a term that generally means most of the compromises will be made by the private sector. Whether this means companies collecting more data and communications and storing them where law enforcement can access them or creating "one time" backdoors in response to court orders remains to be seen.

More encouragingly, the report suggests the "smart guys" in law enforcement haven't fully taken advantage of the tools and data available to them.

It also remains unclear whether the law enforcement community is positioned to fully leverage the unencrypted information still held by many companies. A number of stakeholders acknowledged the potential benefit of improving law enforcement’s understanding of what data or information is available, who controls it, and how it could be useful to investigators. In particular, companies are often able to provide volumes of unencrypted metadata associated with their products or services. In some cases, this source of information could be useful to investigators. In others, one representative of a law enforcement agency told the EWG, access to a stream of metadata might be more like “looking for a particular grain of sand on the beach.”

This is probably the result of the law enforcement mindset. It often seems agencies are more interested in what is quickest and easiest, rather than what might be more productive, if just a bit more difficult. (A number of cases where warrants were never obtained, despite officers having both the time and probable cause to do so, is evidence of this mindset.) The report suggests this is one area where things could be improved by collaboration with private companies. It's not a terrible suggestion but it's one that requires agencies to move on from their defeatist attitudes and to stop pretending advances in technology are always far more beneficial to criminals than to law enforcement.

The report also inadvertently points out just how disingenuous it is to shrug off mass surveillance concerns by saying, "It's just metadata."

Metadata may not completely replace the loss of encrypted content, but metadata analysis could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations.

The report also touches on "legal hacking" as a potential solution -- albeit one with very limited practical application. If this is the route the government chooses to go more frequently in response to encrypted devices, it will signal the end of the already mostly-worthless Vulnerabilities Equity Process. It would also -- as the report acknowledges -- only further the "us vs. them" conflict between tech companies and law enforcement, as the government's interest in keeping vulnerabilities secret would tend to outweigh its obligation to divulge security holes to affected companies.

While the report breaks very little new ground in terms of issues raised, it does at least signal that legislative efforts to undermine encryption aren't likely to find much bipartisan support. So, for the time being, device encryption is still safe. It's the other issues raised -- legal hacking, compelled disclosure, etc. -- that will need to be watched closely in the future.

Filed Under: backdoors, congress, crypto wars, encryption, going dark, house energy & commerce committee, house judiciary committee, james comey