Senators Warn Feebly Regulated Ad Data Is Being Exploited By Governments Worldwide

from the too-profitable-to-care dept

Back when the whole TikTok hysteria was taking root, we noted how people were generally obsessing over the wrong things. Yes, there are concerns about what a Chinese company does with your data. But there was nothing TikTok was doing that was particularly unique in an adtech sector that's massively complex, sees little meaningful regulatory oversight, isn't big on the whole ethical behavior thing, operates in many countries with no real internet privacy laws, and is comprised of thousands of foreign and domestic app makers, data brokers, telecoms, tech giants, and others -- all dashing toward a hugely profitable trough.

Last week, a bipartisan coalition of lawmakers warned that this entire ecosystem is being exploited by governments around the world. There's simply so much data being collected, and efforts to secure this data (if you hadn't noticed from the steady parade of hacks, breaches, leaks, and avoidable fuck ups) aren't particularly consistent:

"This information would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns," a letter signed by Senators Ron Wyden, Mark Warner, Kirsten Gillibrand, Sherrod Brown, Elizabeth Warren, and Bill Cassidy, reads. The lawmakers sent the letter last week to AT&T, Verizon, Google, Twitter, and a number of other companies that maintain advertisement platforms."

The Senators seemed particularly concerned about "bidstream" data, which offers detailed insights into users and is collected by a long list of companies during the ad auction process, even if said companies don't win the bid for that particular ad placement. Much like location, clickstream, and other data, bidstream data is then being sold to pretty much any idiot with a nickel, with nothing in the way of meaningful oversight, the lawmakers warned:

"Few Americans realize that some auction participants are siphoning off and storing 'bidstream' data to compile exhaustive dossiers about them. In turn, these dossiers are being openly sold to anyone with a credit card, including to hedge funds, political campaigns, and even to governments," the letter continued."

Granted as the steady parade of location data scandals routinely show, bidstream data is just a tiny part of this messy ecosystem. And the US government is itself part of the problem. Israeli surveillance companies Rayzone and Bsightful routinely sell this data. Companies like Venntel also sell this data, frequently to US government agencies like ICE. Experts warn that Congressional oversight into this arena is long overdue given the potential for widespread abuse:

"This is a deeply problematic practice when Western governments are abusing the data flows, and it becomes a national security emergency when these same global advertising companies are not vetting their own partners," Zach Edwards, a researcher who has closely followed the supply chain of various sources of data, told Motherboard in an online chat.

"It's long overdue for Congress to begin asking the largest tech companies in the world tough questions about their real-time-data-breach technology that underpins global advertising auctions and user data supply chains," Edwards continued. "Every time a person loads a website or a mobile app, it's likely that their data is being shared with at least dozens of companies, and when that user is interacting with an app or site with banner ads, typically several thousand companies could be receiving data about that visit in order to give those companies 'the opportunity to bid to show ads to that user.'"

The US government's love of ad data as a way to tap dance around warrants reduces any incentive for meaningful oversight of the sector, which is why "investigations" routinely end with few meaningful changes. When you have a universe of connected industries and governments all happily exploiting a single market and lobbying against meaningful change, it begins to make more sense why the US can't even pass a basic internet privacy law. But it also shouldn't be hard to see why obsessing exclusively about TikTok (which wound up being more about cronyism than privacy and security) was a waste of time in broader context.

Filed Under: ad data, bill cassidy, data, elizabeth warren, kirsten gillibrand, mark warner, ron wyden, sherrod brown
Companies: at&t, google, twitter, verizon

ICE Performs Warrantless Raid Of Private Farm; Draws Heat From State And Federal Officials

from the 'rule-of-law,'-my-ass dept

A recent ICE raid of a New York farm made national headlines thanks to the agency's apparent disregard for the Fourth Amendment, among other things. The show of force, coupled with the lack of Constitutional compliance, presented ICE as ruthless enforcers of the law. But there's not much respect for the "rule of law" contained in these actions, no matter how the current administration -- with its emphasis on expelling foreigners from the US -- presents itself.

John Collins was standing outside the milk house at his dairy farm this morning when he heard yelling coming from inside. He ran in, he says, and saw his worker, Marcial de Leon Aguilar, pinned up against the window by armed men.

The men did not identify themselves and were screaming at Aguilar, Collins said.

"I run and say, 'What the hell is going on in here?'" Collins said.

Then the men told Collins they were officers with Immigration and Customs Enforcement. He asked them for a warrant or some paperwork to explain what they were doing. They had none, he said, so he ordered them to get off his property and leave Aguilar alone.

As this happened, Collins said, Aguilar's children watched. They were waiting nearby for the school bus to come. Collins said the officers put Aguilar in handcuffs and took him across the rural road to their vehicles. At least seven officers had come onto the small farm, Collins said.

This resulted in immediate backlash from prominent New York government officials. Governor Andrew Cuomo sent an angry letter [PDF] to the agency chastising it for its apparent refusal to respect Constitutional protections.

Your agency's aggressive claims of upholding the rule of law belie the fact that the pattern of conduct and blatant constitutional violations committed by both agents in the field and regional leadership actually reflect a readiness to sink to lawlessness.

[...]

The persistent failure of your agents to properly identify themselves or produce required documentation to conduct lawful searches and arrests is illegal and creates significant risk of harm to all New Yorkers, including law enforcement who have also been left unaware of your activities within the communities they are entrusted to protect.

NY Senator Kirsten Gillibrand followed the governor's letter with a demand for a federal investigation.

Unbelievably, ICE thinks its actions -- a warrantless raid conducted on private property -- are Constitutional.

Agents were within their rights to be on the farm and did not need a warrant, ICE spokesperson Khaalid Walls told [Vice Media's Eoin Higgins] in an email. The agency said that its actions were justified because de Leon-Aguilar's wife Virginia, who is enrolled in the Alternatives to Detention program, which allows her to stay out of immigration detention while she goes through immigration court proceedings, had missed a number of appointments.

"After having missed several scheduled reporting dates," said Walls, "the resident was deemed to be out of compliance with the terms of the program, necessitating a home visit, which does not require a judicial warrant."

This is wrong. First of all, the raided farm was private property. Even if a home visit was in order, the home resided on property owned by someone else. This wasn't a rental property with only a door separating residents from the outside world. And this was no "home visit." The plainclothes ICE officers showed up, trespassed on private property, and effected an arrest. No permission to enter was sought and no warrant was presented.

ICE can't honestly say it doesn't need warrants to perform these actions. Its own training manual (published by Unicorn Riot) stresses the need for warrants. Searches still require warrants, even if they're looking for illegal activity. ICE can search businesses for illegal workers, but it still needs "Blackie's" warrants (named after a 1981 case brought against the INS), which allow the government to search for people, rather than property. There is no known warrant exception to intrude on private land to search for illegal workers. ICE may feel the Alternatives to Detention program gives it the right to search homes occupied by members of the program (and it does), but when the home resides on property owned by a US citizen, the barrier to entry remains a search warrant. The immigrant arrested in this case had proper documentation to work and resided in a house owned by John Collins on the Collins' property. To reach the house, ICE had to enter private property owned by someone ICE had zero interest in: a legal resident and American citizen.

The lawsuit that's certain to follow this intrusion will sort out the Constitutionality of ICE's actions. At this point, they appear completely unconstitutional, but qualified immunity and the good faith exception may allow the agency to escape liability for the actions of its officers.

Filed Under: 4th amendment, andrew cuomo, ice, immigration, john collins, kirsten gillibrand, marcial de leon aguilar, new york, private property, warrants

Senators Introduce Anti-Aaron's Law To Increase Jail Terms For 'Unauthorized Access' To Computers

from the someone-buy-these-senators-a-clue dept

Yesterday, we wrote about an important new bill, Aaron's Law, from Senators Ron Wyden and Rand Paul and Rep. Zoe Lofgren. It's a fix to many of the problematic aspects of the Computer Fraud and Abuse Act (CFAA). If you're unaware, the CFAA is supposed to be a law to be used against people doing malicious hacking, but the wording is so broad and problematic, it has been used against people for merely violating the terms of service on a website, or someone using a work computer for non-work-related items -- which could lead to excessively long jail terms. The reason Aaron's Law is named that is because of Aaron Swartz, the guy that Federal Prosecutors publicly announced was facing 30 years in jail under the CFAA because he downloaded too many academic journal articles from JSTOR -- despite the fact that he did so on the MIT campus where the campus had a site license that allowed anyone on their network to download all the JSTOR papers.

As we noted in our post, there are still some who are pushing in the other direction -- and they didn't waste much time. The very same day that Aaron's Law was introduced, Senators Mark Kirk and Kirsten Gillibrand introduced a competing law that appears to be a "We Should Have Threatened Aaron With More Years In Jail" Act. Okay, technically it's called the Data Breach Notification and Punishing Cyber Criminals Act -- and as I type this, no one seems willing to release the text. Both Senators have press releases out about the bill, but neither link to it, and Congress's website has a placeholder saying that it hasn't received the actual text yet either. Hopefully that will change soon.*

It's bizarre that they're lumping together data breach notifications and CFAA expansion in a single bill. These are two separate issues. And yet, from the press release quotes and the few small articles about these bills, it appears that everyone's focusing on the data breach notification stuff (which has its own problems) and thus we should be worried that the CFAA expansion could get included as something of a "throw in." The quotes, however, on this part of the bill are ridiculous. Here's Senator Kirk's press release:

This bipartisan legislation increases the maximum allowable fines and imprisonment for many of the most common cyber-crimes, including identity theft and theft of personal information. Current law does not sufficiently punish cyber criminals, and incidences like these recent devastating breaches of confidential information must be punished more aggressively. By modernizing these punishments, as many prosecutors have requested, we will better align punishments to the degree of harm that these crimes may inflict on victims.

And Senator Gillibrand's:

The bill raises the maximum allowable fines and imprisonment for many of the statutes which cyber criminals are charged: identity theft, conspiracy to commit access device fraud, obtaining information from a protected computer without authorization and computer hacking with intent to defraud.

It's the whole "obtaining information from a protected computer without authorization" that is a serious concern here, as that's part of what's been widely abused. Both Kirk and Gillibrand use a lot of populist rhetoric about protecting people from all these scary data breaches out there, but it demonstrates a serious ignorance of how widely the CFAA (with insanely large existing punishments) has been used repeatedly for activities no one legitimately thinks of as malicious hacking. Furthermore, it suggests a pretty serious cluelessness about the incentives and motivations of those who commit many of those breaches. Increasing the number of years they could spend in time from crazily high to insanely high isn't going to change a damn thing. And if these two Senators can't understand that, they shouldn't be touching the CFAA at all.

* As an aside, it's plainly ridiculous for anyone to announce a new bill without releasing the actual text. Even more ridiculous: in searching for the text of the actual bill on both Senators websites, I note that the very first item highlighted on Senator Gillibrand's website is "Transparency" where it says "Senator Gillibrand believes that more openness and transparency in government leads to more accountability and better results." Well, you know what might helps with that transparency? If you actually release the text of the bills you're introducing when you introduce them so that people can take a look at them.

Filed Under: aaron swartz, cfaa, cfaa reform, hacking, kirsten gillibrand, mark kirk

Sad Statement: Senators Behind Two Largest Tech Communities In The US Support PIPA Against Those Communities

from the anyone-else-want-to-step-up? dept

Charlie O'Donnell has an excellent post noting just how ridiculous it is that New York's two Senators, Chuck Schumer and Kirsten Gillibrand, both support PIPA. He notes that NY has become an up-and-coming tech hub these days. Indeed, over the last decade, NYC has emerged as the widely agreed upon "second" hub of tech startups after SF/Silicon Valley. However, having both of NY's Senators support PIPA, despite near universal condemnation from the tech sector is an embarrassment:

It’s an embarrassment, frankly, to our tech community. If you support this bill, you are not supportive of us. All of our local politicians--our Senators, Mayor Bloomberg... and other policymakers need to be fighting this.

Chuck Schumer and Kristin Gillibrand need to switch their positions immediately on these bills, which should really aptly be named the “Stop Innovation on the Internet” bill. If NYC is going to fulfill its potential as an innovation hub, we can't have our senators supporting SOPA. They’re on the wrong side of history here, and they don’t understand enough about the internet and how it came to be to see why.

Of course, it's even worse than that for tech hubs. Here in Silicon Valley... we also have both of our Senators supporting the bill. Senators Feinstein and Boxer are both supporters, with Feinstein being so incredibly out of touch, she doesn't even realize that there are complaints about the bill.

This is a really sad statement on both politics and the nature of innovation in America today. For all the talk politicians say about how they're in favor of creating jobs, and despite multiple studies showing that startups are the ones who actually create the jobs... when it comes time to figure out actual policy positions to take, these Senators "follow the money" and support Hollywood's position, because Hollywood funds their campaigns. While perhaps you can make the claim that Feinstein and Boxer represent both Silicon Valley and Hollywood -- the fact that all four of these Senators support an anti-innovation, anti-tech, anti-jobs bill like PIPA is a huge travesty.

Filed Under: barbara boxer, california, chuck schumer, dianne feinstein, kirsten gillibrand, new york, pipa, politics, protect ip, sopa, tech hubs