Whoops, Twitter The Latest To Use Two Factor Authentication Phone Numbers For Marketing

from the yeah-maybe-stop-doing-that dept

When you sign up for security services like two-factor authentication (2FA), the phone number you're providing is supposed to be explicitly used for security. You're providing that phone number as part of an essential exchange intended to protect yourself and your data, and that information is not supposed to be used for marketing. Since we've yet to craft a formal privacy law, there's nothing really stopping companies from doing that anyway, something Facebook exploited last year when it was caught using consumer phone numbers provided explicitly for 2FA for marketing purposes.

It's not only a violation of your users' trust, it incentivizes them to not use two-factor authentication for fear of being spammed, making everybody less secure. As part of Facebook's recent settlement with the FTC the company was forbidden from using 2FA phone numbers for marketing ever again.

Having just watched Facebook go through this, Twitter has apparently decided to join the fun. In a blog post, the company this week acknowledged that participants of the company's Tailored Audiences and Partner Audiences advertising system may have had their phone numbers used for 2FA used for marketing as well:

"We cannot say with certainty how many people were impacted by this, but in an effort to be transparent, we wanted to make everyone aware. No personal data was ever shared externally with our partners or any other third parties. As of September 17, we have addressed the issue that allowed this to occur and are no longer using phone numbers or email addresses collected for safety or security purposes for advertising."

Security conscious folks had already grumbled about the way Twitter sets up 2FA, and those same folks weren't, well, impressed:

While it's nice that Twitter came out and admitted the error, you have to think it's unlikely this would happen were there real federal penalties for being cavalier about user privacy and security.

Last year, the company admitted to storing passwords for 330 million customers unencrypted in plain text, and a bug in the company's code also exposed subscriber phone number data, something Twitter knew about for two years before doing anything about it. Earlier this year Twitter acknowledged that another bug exposed the location data of its users to an unknown partner. And of course Jack's own account was hacked thanks to an SMS hijacking problem agencies like the FCC haven't been doing much (read: anything) about.

While there's understandable fear about the unintended consequences of poorly crafted privacy legislation, having at least some basic god-damned rules in place (including things like penalties for storing user data in plaintext, or using security-related systems like 2FA as marketing opportunities) would likely go a long way in deterring these kinds of "inadvertent oversights." Outside of the problematic COPPA (which applies predominately to kids), there are no real federal guidelines disincentivizing the cavalier treatment of user data, though apparently we're going to stumble through another 10 years of daily privacy scandals before "conventional wisdom" realizes that's a problem.

Filed Under: 2fa, marketing, phone numbers, two factor authentication
Companies: twitter

Activism & Doxing: Stephen Miller, ICE And How Internet Platforms Have No Good Options

from the and-for-fun,-the-cfaa-and-scraping dept

Last month, at the COMO Content Moderation Summit in Washington DC, I co-ran a "You Make the Call" session with Emma Llanso from CDT. The idea was to turn the audience into a content moderation/trust & safety team of a fictionalized social media platform. We showed numerous examples of content or accounts that were "flagged" and then showed the associated terms of service, and had the entire audience vote on what to do. One of the fictional examples involved someone posting a link to a third-party website "contactinfo.com" claiming to have the personal phone and email contact info of Harvey Weinstein and urging people "you know what to do!" with a hashtag. The relevant terms of service included this: "You may not post personal information about others without their consent."

The audience voting was pretty mixed on this. 47% of the audience punted on the question, choosing to escalate it to a supervisor as they felt they couldn't decide whether to leave the content up or take it down. 32% felt it should just be taken down. 10% said to just leave it up and another 10% said to put a content warning flag on the content. We joked a bit during the session that some of these examples were "ripped from the headlines" but apparently we predicted the headlines in this case, because there are two stories this week that touch on exactly this kind of thing.

Example one is the story that came out yesterday, in which Twitter chose to start locking the accounts of users who were either tweeting Trump senior advisor Stephen Miller's cell phone number, or merely linking to a Splinternews article that published his cell phone number (which I'm guessing has since been changed...).

Splinternews decided to publish Miller's phone number after multiple news reports attributed the inhumane* decision to separate children of asylum seekers from their parents to Miller, who has defended the plan. Other reports noted that Miller is enjoying all of the controversy over this policy. Splinternews, citing Donald Trump's own history of giving out the phone numbers of people who anger him, thought it was only fair that people be able to reach out to Miller.

This is -- for fairly obvious reasons -- a controversial decision. I think most news organizations would never do such a thing. Not surprisingly, the number spread rapidly on Twitter, and Twitter started locking all of those accounts until the tweets were removed. That seems at least well within reason under Twitter's rules that explicitly state:

You may not publish or post other people's private information without their express authorization and permission.

But, that question gets a lot sketchier when it comes to locking the accounts of people who merely linked to the Splinternews article. A la our fictionalized example, those people are not actually publishing or posting anyone's private info. They are posting a link to a third party that purports to have that information. And, of course, in this case, the situation is complicated even more than our fictionalized example because Splinternews is a news organization (owned by Univision), and Twitter also has said that it has a "newsworthy" exception to its rules.

Personally, I think it's the wrong call to lock the accounts of those linking to the news story, but... as we discovered in our own sample version, it's not an easy call and lots of people have strong opinions one way or the other. Indeed, part of the reason why Twitter may have decided to do this was that supporters of Trump/Miller started calling out the article as an example of doxxing and claiming that leaving it up showed that Twitter was unfairly biased against them. It is a no win situation.

And, of course, it wouldn't take long before people started coming up with clever workarounds, such as Parker Higgins (citing the infamous 09F9 controversy in which the MPAA tried to censor the revelation of a cryptographic key that broke the MPAA's preferred DRM, and people responded by posting variations on the code, including a color chart in which the hex codes of the colors were the code), who posted the following:

Would Twitter lock his account for posting a two color image? At some point, the whole thing gets... crazy. That's not to argue that revealing someone's private cell phone number is a good thing -- no matter how you feel about Miller or the border policy. But just on the content moderation side, it puts Twitter in a no win situation in which people are going to be pissed off no matter what it does. Oh, and of course, it also helped create something of a Streisand Effect. I certainly hadn't heard about the Splinternews article or that people were passing around Miller's phone number until the story broke about Twitter whac'ing at moles on its site.

And that takes us to the second example, which happened a day earlier -- and was also in response to people's quite reasonable* anger about the border policy. Sam Lavigne decided to make something of a public statement about how he felt about ICE by scraping** LinkedIn for profile information on everyone who works at ICE (and who has a LinkedIn public profile). His database included 1595 ICE employees. He wrote a Medium blog post about this, posted the repository to Github and another user, Russel Neiss, created a Twitter account (@iceHRgov) that tweeted out info about each of those employees from that database. Notice that none of those are linked. That's because all three companies took them down (though you can still find archives of the Medium post). There was also an archive of the Github repository, but it has since been memory-holed as well.

Again... this raises a lot of questions. Github claimed that it removed the page for "violating community guidelines" -- specifically around "doxxing and harassment, and violating a third party's privacy." Medium claimed that the post violated rules against "doxxing" and specifically the "aggregation of publicly available information to target, shame, blackmail, harass, intimidate, threaten or endanger." Twitter, in Twitter's usual way, is not commenting. LinkedIn put out a statement saying: "We do not support or condone what immigration authorities are doing at the border, but we can’t allow the illegal use of our member data. We will take appropriate action to ensure our members’ data is protected and used properly."

Many people point out that all of this feels kind of ridiculous, seeing as this is all public info that the individuals chose to reveal about themselves on a public website. While Medium's expansive definition of doxxing makes things interesting by including an intent standard in releasing the info, even if it is publicly available, the whole thing, again, demonstrates how complex this is. I know that some people will claim that these are easy calls -- but, just for fun, try flipping the equation a bit. If you're anti-Trump, how would you feel if a prominent alt-right person compiled and posted your info -- even if publicly available -- on a site where alt-right folks gather, with the clear intent of having hoards of Trump trolls harassing you. Be careful the precedent you set.

If it were up to me, I think I would have come down differently than Medium, Github and Twitter in this case. My rationale: (1) all of this info was public information (2) that those individuals chose to place on a public website, knowing it was public (3) they are all employed by the federal government, meaning they are public servants and (4) while the compilation was done by someone who is clearly against the border policy, Lavigne never encouraged or suggested harassment of ICE agents. Instead, he wrote: "While I don’t have a precise idea of what should be done with this data set, I leave it here with the hope that researchers, journalists and activists will find it useful." He separately noted that he believed "it's important to document what's happening, and by whom." That seems to actually make a strong point in favor of leaving the data up, as there is value in documenting what's happening.

That said, reasonable people can disagree on this question (even if there should be no disagreement about how inhumane the policy at the border has been*) of what is the appropriate way for different platforms to handle these situations -- taking into account that this situation could play out with very different players in the future, and there is value in being consistent.

This is the very point that we were demonstrating with that game that we ran at COMO. Many people seem to think that content moderation decisions are easy: you just take down the content that is bad, and leave up the content that is good. But it's pretty rare that the content is easily classified in one of those categories. There is an enormous gray area -- and much of it involves nuance and context, which is not always easy to come by -- and which may look incredibly different depending on where you sit and what kind of world you think we live in. I still think there are strong arguments that the platforms should have left much of the content discussed in this post up, but I'm not the one making that call.

When we ran that game in DC last month, it was notable that on every single example we used -- even the ones we thought were "easy calls" -- there were some audience members who selected every option in the game. That is, there was not a single situation in our examples in which everyone agreed what should be done. Indeed, since there were four options, and all four were chosen by at least one person in every single example, it shows just how difficult it really is to make these calls. They are subjective. And what plays into that subjective decision making includes your own views, your own perspective, your own reading of the content and the rules -- and sometimes third party factors, including how people are reacting and what public pressure you're getting (in both directions). It is an impossible situation.

This is also why the various calls to mandate that platforms do this or face legal liability are even more ridiculous and dangerous. There are no "right" answers to these decisions. There are solutions that seem better to lots of people, but plenty of others will disagree. If you think you know the "right" way that all of these questions should be handled, I guarantee you're wrong, and if you were in charge of these platforms, you'd end up feeling just as conflicted as well.

This is why it's really time to start thinking about and talking about better solutions. Simply calling on platforms to be the final arbiters of what goes online and what stays offline is not a workable solution.

* Just a side note: if you are among the small minority of ethically-challenged individuals who gets upset that I describe the policy as inhumane: fuck off. The policy is inhumane and if you're defending it, you should seriously take time to re-evaluate your ethics and your life choices. On a separate note, if you are among the people who are then going to try to justify this policy as "but Obama/others did it too," the same applies. Whataboutism is no argument here. The policy is inhumane no matter who did it, and pointing out that others did it too doesn't change that. And, as inhumane as it may have been in the past, it has been severely ramped up. There is no defense for it. Attempting to defend it only serves to out yourself as a horrible person who has issues. Seriously: get help.

** This doesn't even fit anywhere in with this story, but scraping LinkedIn is (stupidly) incredibly dangerous. Linkedin has a history of suing people for scraping public info off of LinkedIn. And even if it's lost some of those cases, the company appears to take a pretty aggressive stance towards scrapers. We can argue about how ridiculous this is, but, dammit, this post is already too long talking about other stuff, so discuss it separately.

Filed Under: activism, content moderation, doxing, harassment, ice, internet platforms, phone numbers, stephen miller, takedowns
Companies: github, linkedin, medium, twitter

The DHS Says 'No' To Requests For Public Affairs Contact Numbers; Hysterically Cites 'Privacy' Concerns

from the surely-public-affairs-numbers-should-be-public,-non? dept

Not to continue to beat on this dead horse of administration promises, but statements were made about adopting a "presumption in favor of disclosure" when it came to Freedom of Information Act requests and a general mindset of "transparency" was supposed to be on its way, washing away 8 years worth of privacy erosion and compartmentalization.

But, privacy continues to be a one-way street paved with tax dollars. The Department of Homeland Security, which has expressed an interest in securing all information ever from U.S. citizens, is apparently concerned that releasing phone numbers for its Public Affairs department would result in a horrendous breach of privacy:

Some federal agencies post the office phone numbers of public affairs staff on their websites.

Not the Department of Homeland Security, which believes their release poses "a clearly unwarranted invasion" of employee privacy.

That was the department's response when it denied a Federal Times Freedom of Information Act request for the office phone numbers of its official spokesman. Personal privacy exemptions to FOIA are more commonly used to block disclosure of personnel or medical files.

This isn't an exception to the rule. Despite the clear wording of the 2009 directive, which instructed executive branch agencies not to withhold information just because they could, the end result has been an uneven distribution of compliance and stonewalling.

And it's not just intelligence agencies doing the stonewalling. The U.S. Post Office has also given FOIA requests the extended runaround:

In late 2009, for example, Federal Times asked the U.S. Postal Service for five years worth of data on its use of "standby time," when employees are paid to do nothing. Almost two years later, the Postal Service responded last month by withholding the information on the grounds it was covered by the "trade secrets" exemption. But along with that response, the Postal Service enclosed a copy of a recent inspector general's report that contains some of the same information Federal Times was seeking.

So much for "trade secrets." I'm sure that while FedEx and UPS would have enjoyed seeing the downtime numbers, they probably would have done little more than laughed at the USPS's inefficiency. And apparently the "trade secrets" weren't so secret that they couldn't be released through other channels.

But there is a ray of sunshine in all this mess (albeit, a ray swiftly being covered in black ink). The DHS finally responded to the FOIA request for Public Affairs phone numbers, in a way that only an intelligence agency could with a straight face:

The agency eventually released a 58-page directory of public affairs staff, but redacted every phone number under the privacy exemption.

Of course! Here's the information you requested! Please note that all of the information you've requested has been withheld! No refunds! An explanation of the decision to redact all of the requested information was delivered by Mary Ellen Callahan, head black marker wielder (Chief FOIA Officer) for the DHS:

"In many cases, information that identifies individual DHS employees does not directly shed light on the operations or activities of the government, and FOIA officers should withhold it," Callahan wrote last year. She added, however, that senior-level officials "have a lesser expectation of privacy than lower-level administrative employees."

If you can't even get the phone number for a PR flack, all hope (and some of the change) is lost. Great job, DHS!

(H/T to Radley Balko.)

Filed Under: freedom of information, homeland security, phone numbers, transparency

How Long Until Phone Numbers Are A Historical Relic?

from the bye-bye dept

I recently had a conversation with a friend about the obsolescence of telephone numbers these days. For the most part, I don't remember anyone's phone number anymore, because I just click on their name in my contacts list if I call them. In many ways, phone numbers are like IP addresses. On the internet, we've wisely obscured IP addresses for the most part with URLs, and these days, we've done something pretty similar by default with phone numbers thanks to built-in phone address books. But, the problems with phone numbers goes even further -- starting with the fact that they're tied to a single provider. Via Planet Money, we learn of this fun rant from Nilay Patel, detailing why it's time for phone numbers to die, and how Google, Microsoft and Apple are all working to speed along the death of the phone number:

I hate phone numbers. They’re a relic of an outmoded system that both wireless and wireline carriers use to keep people trapped on their services — a false technological prison built of nothing but laziness and hostility to consumers. In fact, I can’t think of a single telecom service that is as restrictive as the phone number: email can be accessed from any device, Skype makes apps for nearly every platform, IM works across any number of clients, there are web-based messaging solutions that transcend platforms entirely — the list goes on. We expect modern telecom services to be universal, cheap, and easily-accessible, and those that aren’t tend to be immediate failures. Ask Cisco how Umi went for them sometime.

As he notes, you can start to break out of those limits today, thanks to things like Google Voice and Skype, and as that advances, we may finally reach an age when the idea of a telephone number is a historical relic... like the people who used to say letters for the first two digits of their phone number.

Filed Under: phone numbers, telephony