Telecom Sector Can't Stop Falsely Claiming That Net Neutrality Will Harm The Sick, Derail Smart Cars

from the just-can't-help-themslves dept

If you've paid attention to the net neutrality debate, you'll recall that large ISPs routinely threaten to hold back on network investment if governments pass rules protecting an open, healthy internet. They also routinely try to claim that the passage of such protections cause a massive slowdown in overall sector investment, something that simply isn't supported by actual facts (remember them?). Such rhetoric is fear mongering designed to scare regulators away from imposing "job killing regulations," even if those regulations make sense for a telecom market where limited competition fails to keep bad actors in check.

This hollow fear mongering has played a starring role as carriers worldwide begin to deploy faster fifth-generation wireless (5G) networks. You'll recall that both American and European telcos have routinely tried to claim that the deployment of these faster, more efficient wireless networks will be derailed by net neutrality.

Usually, this rhetoric is accompanied by claims that 5G will be the centerpiece of the smart cities of tomorrow, and that net neutrality rules will prevent ISPs from using these networks to provide prioritized connectivity for health and other related services. Ignored is the fact that this has never been a problem, since any well-crafted net neutrality rules carve out massive loopholes for all manner of essential services, especially on the medical front. Of course that doesn't stop ISPs from routinely claiming that net neutrality hurts sick people all the same.

With the Mobile World Congress trade show underway this week in Barcelona, all of this debunked rhetoric is being regurgitated like a bad hairball. Speaking at the trade show, Ericsson CEO Börje Ekholm tried to inform attendees that Europe's net neutrality rules must be weakened lest they derail Europe's efforts to build 5G Networks:

"The principle of net neutrality is not to discriminate [against], throttle or degrade based on content but not all traffic is created equally and we don't believe this will work in the 5G future," he told reporters and analysts. "There will be a need for a regulatory regime that allows service providers to create services that are differentiated based on user experience."

But that's not the principle of net neutrality. The principle of net neutrality is to not discriminate against traffic for anti-competitive reasons. Guys like Ekholm certainly realize they're being disingenuous here, they just hope their audience doesn't. As is industry tradition, Ekholm then tried to suggest that with net neutrality in place, carriers won't be able to provide access to essential, prioritized medical services:

"In relation to the hot topic of net neutrality, Ekholm said that while Ericsson believes in non-discriminatory access to information and data, he added that "not all traffic is created equal". Once remote surgery is being performed over 5G, for instance, it should be given priority over other traffic, he said."

Again, this is something carriers in both the United States and Europe like to parrot repeatedly despite not being true. Europe's rules, like the ones we're about to discard in the States, provided ample leeway for such services. But the idea that "government regulation" will harm the sick is apparently too enticing of a siren song for those looking to demonize protection of a healthy and competitive internet.

Not to be outdone, FCC boss Ajit Pai also parroted industry claims in a speech that net neutrality is a threat to the smart cities of tomorrow (pdf):

"We believe that our decision will give the private sector greater incentives to invest in the 5G networks of the future and bring greater digital opportunity to the American people. And we also believe that our decision is critical for another reason as well. To realize the promise of 5G, we will need smart networks, not dumb pipes. Dumb pipes won’t deliver smart cities. Dumb pipes won’t enable millions of connected, self-driving cars to navigate the roads safely at the same time. In short, dumb pipes won’t give us the networks needed to enable the 5G applications of the future."

Again, any idea that "net neutrality hurts the sick" or stops innovation (smart car or otherwise) dead in its tracks is aggressively misleading. Net neutrality rules almost always carve out ample exceptions to legitimate services, often to a fault. The only thing net neutrality rules traditionally harm is the entrenched telecom monopoly's ability to abuse the lack of industry competition for further anti-competitive gain -- the only thing this debate has ever truly been about. Net neutrality is only a "regulatory burden" if you're doing something anti-competitive. Since entrenched telecom operators can't candidly acknowledge this in the quest for fatter revenues, we're subject to a rotating crop of flimsy straw men instead.

Filed Under: 5g, borje ekholm, innovation, net neutrality, smart cars, telemedicine, wireless

Cars Are Delivering Tons Of Driving Data To Manufacturers With Minimal Security And Even Less Transparency

from the introducing-the-2015-Lexus-CI dept

Nothing's driving the acquisition of data faster than, well, driving. As new technology makes its way into vehicles, so does the apparent desire to harvest information about the vehicle itself. Between the outside harvesting (automatic plate readers that gather plate/location data, as well as photos of vehicle occupants) and the "inside" transmissions, there's very little any number of unknown entities won't know about a person's driving habits. And that's not even including what's transmitted and collected by drivers' omnipresent smartphones and their installed apps.

Sen. Edward Markey has expressed some alarm at the amount of data being collected (and distributed) by vehicle manufacturers. His office has produced a report [pdf link] showing that while many manufacturers are involved in collecting data, very few of them seem concerned about the attendant risks. Even worse, many respondents to his office's questionnaire seem to show very little understanding of the underlying technology and most have not made an effort to fully inform customers as to how much is being collected or how it's being distributed.

Drivers of today's connected cars aren't going to like the report's findings.

Nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions.

While some basic security measures have been implemented, the fact remains that transmitting data always poses a risk. Three of the 14 manufacturers that responded to Markey's questions had actually let their security measures stagnate or decrease from 2013 to 2014, even as the amount of data transmitted rose. Worse, many of the respondents deployed security measures in a "haphazard and inconsistent" fashion, and nearly all respondents seemed unable to fully process the questions posed by Markey's office.

Of the 16 automobile manufacturers that responded to the letter, 13 of them addressed these questions in some way. Chrysler, Mercedes-Benz, and Mazda did not respond to the question at all, and five other manufacturers provided general responses that addressed the question as a whole instead of providing specific responses to the questions’ sub-parts.

[...]

Seven of the manufacturers stated that they use third-party testing to verify their security measures, while 5 stated that they do not and 4 did not respond to this part of the question.

[...]

The manufacturers were also asked about how they secure this type of software delivery [updates/patches]. Each manufacturer responded with descriptions of how they provide such software through authorized dealers with the appropriate tools. Automobile security experts consulted by Senator Markey’s staff said that all of the responses are similar in that they presume a malicious actor could not access or acquire the technologies that mechanics have. They state that software updates for systems should be cryptographically verified by the ECU being updated in order to effectively prevent intrusions.

These four-wheeled tracking devices are collecting and transmitting tons of data, including GPS location, sudden accelerations/decelerations, seatbelt usage, destinations entered into navigation systems, last location parked, distance and time traveled and a variety of information on other driving components. Almost all of this is transmitted back to the manufacturer for their own use.

Nearly 100% of 2014 vehicles record and transmit driving history. Most of these manufacturers could not provide a satisfactory answer as to how they secure this data during transmission and more than half store this information "off-board" at their own data centers. Manufacturers seem to consider "on-board" collections as inherently secure.

In the case of on-board storage, no manufacturer described any security system to protect that data, and several of them noted that no security measure is needed since accessing data would require a hardwire connection.

But that doesn't mean they treat wireless transmissions with much more care.

Regarding security measures to protect data that is wirelessly transmitted outside the vehicle, only 6 responses were received. Of those, 5 provided vague responses naming encryption, passwords, or general IT security practices, and only 1 specifically mentioned that they designed their systems to limit the transfer of personally identifiable information.

Part of this is due to the fact that automakers' security measures are purely voluntariy at this point. But the fact that it would likely take a federal mandate to improve security is disappointing. Not only are manufacturers less than forthcoming about how much data they're collecting, but they're apparently uninterested in providing a minimal level of customer service, i.e., proactively assuring these data transmissions are secure.

As for the data harvesting itself, manufacturers can't seem to find a better justification for this than "improving the customer experience" -- a phrase pretty much synonymous with "selling customers more stuff" or "collecting for collecting's sake." Most manufacturers retain this data for one to ten years, with only one manufacturer offering the option for users to delete their data at any time. But that single nod to customer agency is far outweighed by the general indifference shown by the rest.

Markey's report finds that purchasers may be allowed to "opt out" of certain collections, but this often comes at the expense of certain functions. No manufacturer presents this information up front, preferring to hide it in owner's manuals and terms of service agreements. The default should be "opt-in," with upfront explanations of what, how and why data is collected. But that would lead to a dearth of information, and automakers, like many other private companies, prefer to gather data first and deal with the fallout later.

Although it goes unmentioned in Markey's report, there's also the question of how this data is handled when the government comes looking for it. Most of what's collected would presumably fall under the Third Party Doctrine (with drivers "knowingly" turning this information over because of page 173 in the owner's manual, etc.), which means it can be acquired by law enforcement/intelligence agencies with minimal effort/paperwork. There are also other government intrusions that need to be considered as well, like California's desire to tie state-enforced emission standards to driving information already gathered by a number of manufacturers. Not only are manufacturers not guarding against having their collections hijacked by criminals, they seem equally unconcerned about safeguarding this vast amount of data from the government itself.

Filed Under: cars, data, privacy, smart cars, transparency

Automakers Like TOTALLY Promise Not To Abuse The Ocean Of Location Data Their Cars Now Collect

from the trust-us,-we're-the-auto-industry dept

Hoping to assuage growing fears that vehicle data won't be abused, nineteen automakers recently got together and agreed to a set of voluntary principles they insist will protect consumer privacy in the new smart car age. Automakers promise that the principles, delivered in a letter to the FTC (pdf), require that they "implement reasonable measures" to protect collected consumer data, both now and as the industry works toward car-to-car communications. The principles "demonstrate the industry's commitment to its customers" and "reflect a major step in protecting consumer information" insists the industry.

Should you bother to actually read the principles, the promised revolution in privacy protection quickly become less apparent. While the principles do require that automakers clearly communicate with customers (and by clear they mean "hey, here's some fine print saying we're selling your location data now"), many don't appear to actually do much of anything. Like this particular gem:

"Data Minimization, De-Identification & Retention: Participating Members commit to collecting Covered Information only as needed for legitimate business purposes. Participating Members commit to retaining Covered Information no longer than they determine necessary for legitimate business purposes."

With "legitimate business purposes" being whatever they see fit, that doesn't mean much. Similarly, the industry's "groundbreaking" promises are also heavily peppered with the ambiguous word "reasonable," which can of course mean whatever they'd like it to mean:

"Participating Members commit to implementing reasonable measures to protect Covered Information against unauthorized access or use."

Aka, we'll make some kind of ambiguous effort to secure your data. As with most efforts of this type, the goal is to preempt government from crafting new (or enforcing existing) privacy protections as the industry moves into more aggressive ways of monetizing location data. Said promises unsurprisingly aren't easing the worries of both safety and privacy advocates as we move into the vehicle black box age, notes the Associated Press:

"Industry officials say they oppose federal legislation to require privacy protections, saying that would be too "prescriptive." But Marc Rotenberg, executive director of the Electronic Privacy Information Center, said legislation is needed to ensure automakers don't back off the principles when they become inconvenient. "You just don't want your car spying on you," he said. "That's the practical consequence of a lot of the new technologies that are being built into cars."

With many parts of this technology DRM locked, users won't have much control over or access to their own data (something the EFF is trying to fix with their latest slate of DMCA exemption requests). It's also worth noting this supposed circle of automotive trust was already quite rusted before cars became more intelligent; most car dealerships and garages are paid by Carfax to report vehicle mileage and accident repair, with Carfax in turn being paid for that data by insurance companies. Similarly most of the in-car infotainment systems rely on cellular chipsets from companies like AT&T and Verizon, who quite happily sell any and all location data that isn't nailed down, and consistently experiment with creative new privacy violations (despite very similar promises they'd be on their best behavior).

So while it's very sweet that the auto industry is promising to respect your privacy as they push into brave new data snoopvertising and location data tracking territory, like so many self-regulatory promises before it they likely aren't worth the paper they're printed on.

Filed Under: automakers, cars, privacy, self-regulations, smart cars, tracking