WeChat Users Fighting To Block Trump's Executive Order Banning The App In The US

from the it-would-be-an-issue dept

While the TikTok part of Trump's original August Executive Order got all the attention, we pointed out that it was fairly notable that he issued a nearly identical order to also effectively ban WeChat by blocking any transactions related to WeChat. While WeChat is not that well known or widely used in the US, it is basically central to the Chinese internet, and, as such, is a key part of how many Chinese Americans stay in touch with relatives, friends, and colleagues back in China. So it was perhaps not that surprising that a group of WeChat users in the US quickly sued to try to block the order:

Neither the Executive Order itself nor the White House provided concrete evidence to support the contention that using WeChat in the United States compromises national security. Notably, no other nation has implemented a comprehensive WeChat ban on the basis of any like-finding that WeChat is a threat to national security. The Executive Order was, however, issued in the midst of the 2020 election cycle, during a time when President Trump has made numerous anti-Chinese statements that have contributed to and incited racial animus against persons of Chinese descent—all outside of the national security context.

In a stark violation of the First Amendment, the Executive Order targets and silences WeChat users, the overwhelming majority of whom are members of the Chinese and Chinese-speaking communities. It regulates constitutionally protected speech, expression, and association and is not narrowly tailored to restrict only that speech which presents national security risks to the United States. Accordingly, it is unconstitutionally overbroad. Indeed, banning the use of WeChat in the United States has the effect of foreclosing all meaningful access to social media for members of the Chinese-speaking community, such as Plaintiffs, who rely on it to communicate and interact with others like themselves. The ban on WeChat, because it substantially burdens the free exercise of religion, also violates the Religious Freedom Restoration Act.

The Executive Order runs afoul of the Fifth Amendment’s Due Process Clause by failing to provide notice of the specific conduct that is prohibited; because of this uncertainty, WeChat users in the United States are justifiably fearful of using WeChat in any way and for any purpose—and also of losing access to WeChat. Since the Executive Order, numerous users, including Plaintiffs, have scrambled to seek alternatives without success. They are now afraid that by merely communicating with their families, they may violate the law and face sanctions.

As the complaint highlights, just the issuing of the Executive Order has created panic among people who rely on it to communicate with people in China:

The U.S. WeChat Users Alliance (“USWUA”), Chihuo, Inc., Brent Coulter, Fangyi Duan, Jinneng Bao, Elaine Peng, and Xiao Zhang (collectively, “Plaintiffs”), bring this suit to challenge the Executive Order, which eviscerates an irreplaceable cultural bridge that connects Plaintiffs to family members, friends, business partners, customers, religious community members, and other individuals with common interests within the Chinese diaspora, located both in and outside of the United States. The Executive Order has already harmed Plaintiffs, who are plagued with fear for the loss of their beloved connections, whether it be with friends, family, community, customers, aid recipients of the charities they run, or even strangers whose ideas enrich their lives. They have been forced to divert time, energy, and money to seek alternative communication platforms, download and save irreplaceable digital histories, plan for business closures, find other sources of information, and try to obtain alternative contact information for those from whom they will soon be separated. Even if they succeed to some extent in their mitigation efforts, Plaintiffs will never be able to replace the full spectrum of the social interactivity that WeChat offers, nor will they be able to find any social networking platform with anything close to the same level of participation by the global Chinese diaspora—this is because WeChat’s network effects, generated by its 1 billion-plus daily users, is irreplaceable

The plaintiffs have also filed for a preliminary injunction against the Executive Order (which is set to go into effect on Sunday). There's a hearing on Thursday. So far, the plaintiffs have failed to get expedited discovery, as the judge notes that pretty much everything so far relies clearly on public information, and there's no need for discovery at this point -- not to mention there would be a pretty big argument over what things are actually subject to discovery anyway.

The government's opposition to the injunction request is... weird? It basically starts out with a big attack on China that's just sort of priming the pump and hand-waving around the idea that if China is bad then it's self-evident that any app that comes out of China must also be bad. This part of the argument focuses on... companies that are not Tencent/WeChat, but instead does the fear mongering about Huawei and ZTE that (we've noted many times) has never presented any actual evidence of bad behavior by those companies. Also, Huawei and ZTE are not... Tencent.

So then the DOJ just points to a random Australian think tank white paper that says Tencent/WeChat is also bad. They cite a few other such reports, but the "bad" seems to be that China heavily censors WeChat and... duh? But how does that mean it's dangerous in the US and should be banned? Incredibly -- given the frequency with which the President himself has retweeted conspiracy theories pushed by Russian troll accounts -- the DOJ actually argues that because some disinformation is found on WeChat, that's reason enough to ban it:

The Report also observed that the WeChat app is a key tool for China’s disinformation campaigns, citing as one example Australia’s May 2019 election, in which “fake news on WeChat was such a problem that Australia’s Labor Party contacted WeChat owner Tencent to express frustration about posts spreading disinformation.” Id. at 406-07. The Report cautioned that “use of [WeChat] had spread beyond the Chinese Australian community, with about 3 million Australians using WeChat by 2017,” id., and that “almost the entire Mandarin-speaking community in Australia . . . used WeChat,” allowing “Beijing [to] ‘promote particular issues [as] a way of controlling public debate.’”

I find it pretty fucking ironic that at the same time our government is using claims of "fake news" on a social media platform as an excuse to ban it, it is also trying to force American social media companies to no longer be able to moderate "fake news" and foreign propaganda.

Where the government may have more success is by arguing that the claims are "not ripe" because the executive order hasn't been implemented yet. But, that's just kicking the can down the road. Because once it is implemented, the same basic claims will remain. It does argue that the 1st Amendment claim will fail because its content neutral. That is, the DOJ is saying "we're not targeting specific speech, we're just banning an app used for speech.... that happens to be used by lots of Chinese speaking people." I think that's... pretty weak. That's "we're not blocking the printing of your magazine, just ordering the destruction of your printing presses, which might be used to print any magazine." That's not allowed under the 1st Amendment, and it shouldn't be allowed under this order.

Anyway, we should get a ruling at least on the preliminary injunction relatively quickly (given that it's slated to go into effect on Sunday). I hope the court does grant the injunction, but I'd be surprised if it does. It seems much more likely to punt based on ripeness for now. However, this case (unlike the TikTok cases, which may not matter if a deal is reached) could go on for quite a while, and could be pretty damn important in determining if the White House can just up and ban a foreign software application.

Filed Under: 1st amendment, china, donald trump, executive order, free speech, users
Companies: tencent, wechat

Turns Out Most People Still Don't Hate 'Big Internet' As Much As Politicians And The Media Want Them To

from the these-things-make-our-lives-better dept

"The narrative" over the past few years concerning internet companies has clearly shifted. It went from one that generally praised the wonders and power of the internet to one that now blames the internet for everything. The hagiographc coverage of the past clearly went too far, but the current "techlash" seems to have gone way too far in the other direction as well -- much of it from people grasping at straws over why things they don't like have happened in the world. The good folks over at The Verge have done a big consumer survey of people's general opinions of various big internet companies and it shows that most people still like these internet services, and believe, on the whole, that they make their lives better, not worse. Even the services that get the "worst" grades, still get over a 60% "favorable" rating, while Amazon, Google, YouTube, Netflix, Microsoft, and Apple all come in over 80% positive (with Amazon, Google, and YouTube breaking 90%).

A separate question asked how people view these companies' impact on society, and again, they are mostly positive -- and even in the cases where there is some level of negativity (mainly: Facebook, Instagram, and Twitter), the positive feelings greatly outweigh the negative:

There are many more fascinating findings and I recommend checking out the full Verge story on this, though I will note a bit of generational shock, as someone who lived through the 90s era of everyone in tech absolutely hating Microsoft and not trusting the company one bit, to Microsoft now being listed as the company that people trust the most with their data. Times sure have changed.

Still, as the general narrative -- and a lot of political rhetoric -- is focused on how awful these companies are and how "something must be done" about them, it does seem worth noting that most of the public seems to really like these services and feel the world is a better place because of them.

Now, take that information and compare it to just how little people trust companies in the telecom sector, and you might wonder why none of the narrative seems to focus on those companies. Indeed, the only political pressure on those companies seems to be to get them to merge and consolidate faster. Also, I should note that as fond as people are of repeating the silly and misleading line that "if you're not paying for it, you're the product," compare the levels of trust between all of these free internet services (very high) and the telco services you pay for (very low), and perhaps realize that it's not the "free" or "not free" part that engenders trust.

Filed Under: big internet, big tech, consumers, narrative, techlash, users
Companies: amazon, apple, facebook, google, microsoft, twitter, youtube

Dear Silicon Valley Tech Companies: Stop Treating Your Structural Challenges As Political Challenges

from the politics-and-business-are-not-the-same dept

A couple weeks back Karl wrote up an excellent analysis of the NY Times' big piece looking at how Facebook tried to deal with ongoing criticism of the company concerning the influence operations that it appears Russians used their site for. Karl's post focused on just how many companies make use of similar political smear campaigns, and everyone (including the press) should be much more tuned into this kind of thing. Indeed, a followup story from the NY Times last week showed that a bunch of other tech companies -- namely Lyft, Lime, Juul and Qualcomm -- all had hired the very same "Definers" firm that Facebook had hired to smear its opponents.

I wanted to write a follow up post, though, to make a slightly different point. This one is more directed at the people who work at all of the big tech companies: Stop thinking about running your companies as political campaigns, and focus most on what is best for end-users. It should be noted, of course, that all of these companies are a bit different, and they all do take different approaches to the market, but over the last few years, especially, one thing that has shined through with many of these companies is that they've dealt with the challenges suddenly being directed at them as political issues, rather than structural issues.

It's not difficult to see why this is happening. To some extent, it goes back to the popular saying: "We judge others by their actions and ourselves by our intentions." When these companies are getting attacked over their actions, they often feel wronged by the coverage, which they feel is unfair, because the press are often judging the decisions absent larger context that shows how they reached those results. And sometimes it is unfair. But there are still elements of truth in all of these complaints, and companies need to recognize even more, that these challenges are both structural and potentially existential, rather than one of people just being "unfair" in their coverage.

The second reason why this is happening is that the political world has spent years beating on Silicon Valley to be "more engaged" in politics, and so much is now being driven by how things look through a political lens that it's become controlling in many ways. All of these companies have hired tons of political operatives, who know how to do political campaigns. Not all of them care what the company is actually doing -- they just care about how it's perceived.

Years back, when I was studying "organizational behavior," in college, I remember the professor explaining office "politics" succinctly: raising your own profile while decreasing the profile of anyone else. And, indeed, there are many examples in the NY Times Facebook article of this kind of thinking in action. Rather than deal with the larger structural problems, Facebook decided to go after its critics and its competitors. After the NY Times piece came out, TechCrunch published a bunch of the pitches they received from Definers, noting how very political they were. Unlike most PR pitches, in which the sender identifies what company they're representing, and why they're emailing, Definers pitches were... different:

We checked our inboxes and none of the pitches Definers sent to TechCrunch made an explicit disclosure that the messages they contained had been paid for by Facebook to push a pro-Facebook agenda. They all required the recipient to join those dots themselves.

[....]

Here’s an example of Definers’ oppo mud-slinging we were sent targeting Apple and Google on Facebook’s behalf:

Just came across this – thought you might find it interesting: https://digitalcontentnext.org/blog/2018/08/21/google-data-collection-research/

“A major part of Google’s data collection occurs while a user is not directly engaged with any of its products. The magnitude of such collection is significant, especially on Android mobile devices, arguably the most popular personal accessory now carried 24/7 by more than 2 billion people.”

The study’s findings are rather shocking… It really highlights how other tech companies should be looked at critically – scrutiny shouldn’t just be on FB for data misuse. Apple & Google have been perpetrators of data abuse as well…

“Scrutiny shouldn’t just be on FB for data misuse” is the key line there, though it’s still hardly a plain English disclosure that Facebook paid for the message to be sent.

We received multiple Definers’ pitches on behalf of what looks to be three different tech companies — and only one of these is explicitly badged as a press release from the firm paying Definers to do PR. (In that case, e-scooter startup Lime.)

Not that they listen to me, but if there was a simple message I could get across to everyone working at these companies, it's that they need to stop treating actual structural issues and the actual impact of what they do as political fights, but as real, structural issues that need to be addressed. That's not to say admit that all of the criticism is valid -- because some of it is not. But, recognize that there is truth in many of the complaints, and to focus on actually doing right by your users, not simply attacking the messenger or denying the seriousness (and certainly not by merely pretending to take the issue seriously in public while privately admitting nothing will change). The fact that Facebook repeatedly denied "key aspects" of this story, only to post a blog post the night before Thanksgiving that more or less admitted everything they had previously denied, shows that the company is still treating this as a political campaign. Friday night news dumps are a classic political move to "bury" bad news, and the only time better than a random Friday night is the night before a major holiday.

For many years I've said that one of the reasons why I find the tech industry so important is that it has -- historically -- been a demonstration of what good happens when certain (not all) companies and their users have interests aligned. Rather than working at cross purposes, or trying to screw over users, many tech companies have shown that they can provide value in a way that everyone comes out of it better off. When they actually focus on doing the right thing -- even at the short term expense of the bottom line -- good long term strategies tend to result.

However, treating everything as a political campaign is the opposite of that strategy. It means attacking critics and competitors, rather than focusing on doing what's right. And, unfortunately, this political thinking is becoming pervasive across the tech industry. Some will argue that it has actually always been true, but that's not accurate at all. Much of Silicon Valley's success was premised on taking a very different approach -- one that really did focus on doing the right thing, rather than the most expedient or the most immediately profitable. But, that has changed for many, many companies. And even if it may be understandable as to why it is happening, that's still no excuse.

So, for everyone who works at these companies, please take a step back and think about what your actual vision is. Are you making decisions to actually do what's best for the users of your products. Or are you simply attacking your critics and competitors? If it's the latter, it seems like a clear sign that your company has lost its way.

Filed Under: consumers, doing the right thing, innovation, politics, users
Companies: apple, definers, facebook, google, lime, lyft, qualcomm

Valve Decides To Get Out Of The Curation Business When It Comes To 'Offensive' Games

from the the-good-and-the-bad dept

As we've said in the past, Valve has always had a tricky line to walk with it's Steam platform, having to straddle the needs of both the gamers that use the service and the game developers that make it worthwhile. Frankly, it's walked this line fairly well for the most part. The platform, which was always popular, has exploded as the place to release a new game title online. As we noted way back in ye olde 2016, this popularity has also presented a problem for Steam: saturation. There are now simply so many games available on the platform that blindly wading into it and expecting to find new content you didn't know you wanted is a dicey proposition at best. More content is an undeniably good thing, but it would be silly to suggest that the deluge of new games released in the past few years hasn't also had a deleterious effect on the usability of the platform.

Our solution? It won't surprise you. We advocated that Steam empower the gamers that use it to act as curators. If done properly, this would allow an ecosystem of trusted advisers among gamers that share interests to tell them which titles they should be looking at. To that end, Steam subsequently employed a curators program within the platform that attempted to build exactly this ecosystem. To date, it's been mediocre at best.

But this isn't the only publicized problem Steam has had in recent days. In addition, the platform has been in the news for its wishy-washy but ultimately heavy-handed approach to games that have either mature sexual content or are offensive to large swaths of people. Combinations of so-called sex-games and games that make such topics as school shootings central to gameplay have been banned, or not, often to much critique from every side from gamers.

The concept of empowering its community to serve as its own filters and the no-win situation when it comes to offensive games has now collided, causing Valve to announce that it's getting out of the game content moderating business entirely.

In a blog post musing on the difficulty of deciding on a case-by-case basis what should and should not be allowed on Steam, Valve’s Erik Johnson explained that the company does, in fact, have a team of humans that looks at “every controversial title submitted to us,” and employees frequently disagree like Steam users do. “The harsh reality of this space, that lies at the root of our dilemma, is that there is absolutely no way we can navigate it without making some of our players really mad,” Johnson wrote.

“We’ve decided that the right approach is to allow everything onto the Steam Store, except for things that we decide are illegal, or straight up trolling,” said Johnson. “Taking this approach allows us to focus less on trying to police what should be on Steam, and more on building those tools to give people control over what kinds of content they see.”

There are two reactions that leap immediately to mind. First and foremost, this will be a good and useful experiment by Valve. Empowering customers and communities is almost always the right approach. Acting as a gatekeeper or the warden managing the walled garden is not an approach we believe in. Moreso, an approach by a company that puts its trust in the everyday customer is typically an inherently consumer-friendly one. The ideals behind this kind of move are a good one. Censorship sucks, choice is better.

On the other hand, the other immediate reaction has to be that Valve had damned well better have its user tools in order when it rolls this out en masse, because two things will happen otherwise. Most directly, gamers who are being inundated with games and content they find horrifying, offensive, or otherwise view negatively are going to be fully up in arms. It's easy to imagine families that game together, between parents and young children, losing their shit if the Steam homepage is suddenly full of games laden with overt sexual content or school shootings.

Even more so, if you thought the floodgates had been open when it came to the sheer volume of titles on Steam previously, this is going to introduce a potential tidal wave of new games onto the marketplace. If Valve isn't supremely prepared to empower users now with far better curating tools than it already has, the platform is likely going to take a severe dip in its usability as a place to discover games.

In other words: decent idea, assuming Valve has put a ton of thought into how this will impact its platform.

Filed Under: content moderation, steam, tools, users
Companies: valve

Facebook Has Many Sins To Atone For, But 'Selling Data' To Cambridge Analytica Is Not One Of Them

from the let's-at-least-be-accurate dept

Obviously, over the past few days there's been plenty of talk about the big mess concerning Cambridge Analytica using data on 50 million Facebook users. And, with that talk has come all sorts of hot takes and ideas and demands -- not all of which make sense. Indeed, it appears that there's such a rush to condemn bad behavior that many are not taking the time to figure out exactly what bad behavior is worth condemning. And that's a problem. Because if you don't understand the actual bad behavior, then your "solutions" will be misplaced. Indeed, they could make problems worse. And... because I know that some are going to read this post as a defense of Facebook, let me be clear (as the title of this post notes): Facebook has many problems, and has done a lot of bad things (some of which we'll discuss below). But if you mischaracterize those "bad" things, then your "solutions" will not actually solve them.

One theme that I've seen over and over again in discussions about what happened with Facebook and Cambridge Analytica is the idea that Facebook "sold" the data it had on users to Cambridge Analytica (alternatively that Cambridge Analytica "stole" that data). Neither is accurate, and I'm somewhat surprised to see people who are normally careful about these things -- such as Edward Snowden -- harping on the "selling data" concept. What Facebook actually does is sell access to individuals based on their data and, as part of that, open up the possibility for users to give some data to companies, but often unwittingly. There's a lot of nuance in that sentence, and many will argue that for all reasonable purposes "selling data" and my much longer version are the same thing. But they are not.

So before we dig into why they're so different, let's point out one thing that Facebook deserves to be yelled at over: it does not make this clear to users in any reasonable way. Now, perhaps that's because it's not easy to make this point, but, really, Facebook could at least do a better job of explaining how all of this works. Now, let's dig in a bit on why this is not selling data. And for that, we need to talk about three separate entities on Facebook. First are advertisers. Second are app developers. Third are users.

The users (all of us) supply a bunch of data to Facebook. Facebook, over the years, has done a piss poor job of explaining to users what data it actually keeps and what it does with that data. Despite some pretty horrendous practices on this front early on, the company has tried to improve greatly over the years. And, in some sense, it has succeeded -- in that users have a lot more granular control and ability to dig into what Facebook is doing with their data. But, it does take a fair bit of digging and it's not that easy to understand -- or to understand the consequences of blocking some aspects of it.

The advertisers don't (as is all too commonly believed) "buy" data from Facebook. Instead, the buy the ability to put ads into the feeds of users who match certain profiles. Again, some will argue this is the same thing. It is not. From merely buying ads, the advertiser gets no data in return about the users. It just knows what sort of profile info it asked for the ads to appear against, and it knows some very, very basic info about how many people saw or interacted with the ads. Now, if the ad includes some sort of call to action, the advertiser might then gain some information directly from the user, but that's still at the user's choice.

The app developer ecosystem is a bit more complicated. Back in April of 2010, Facebook introduced the Open Graph API, which allowed app developers to hook into the data that users were giving to Facebook. Here's where "things look different in retrospect" comes into play. The original Graph API allowed developers to access a ton of information. In retrospect, many will argue that this created a privacy nightmare (which, it kinda did!), but at the same time, it also allowed lots of others to build interesting apps and services, leveraging that data that users themselves were sharing (though, not always realizing they were sharing it). It was actually a move towards openness in a manner that many considered benefited the open web by allowing other services to build on top of the Facebook social graph.

There is one aspect of the original API that does still seem problematic -- and really should have been obviously problematic right from the beginning. And this is another thing that it's entirely appropriate to slam Facebook for not comprehending at the time. As part of the API, developers could not only get access to all this information about you... but also about your friends. Like... everything. From the original Facebook page, you can see all the "friend permissions" that were available. These are better summarized in the following chart from a recent paper analyzing the "collateral damage of Facebook apps."

If you can't read that... it's basically a ton of info from friends, including their likes, birthdays, activities, religion, status updates, interests, etc. You can kind of understand how Facebook ended up thinking this was a good idea. If an app developer was designing an app to provide you a better Facebook experience, it might be nice for that app to have access to all that information so it could display it to you as if you were using Facebook. But (1) that's not how this ever worked (and, indeed, Facebook went legal against services that tried to provide a better Facebook experience) and (2) none of this was made clear to end-users -- especially the idea that in sharing your data with your friends, they might cough up literally all of it to some shady dude pushing a silly "personality test" game.

But, of course, as I noted in my original post, in some cases, this set up was celebrated. When the Obama campaign used the app API this way to reach more and more people and collect all the same basic data, it was celebrated as being a clever "voter outreach" strategy. Of course, the transparency levels were different there. Users of the Obama app knew what they were supporting -- though didn't perhaps realize they were revealing a lot of friend data at the same time. Users of Cambridge Analytica's app... just thought they were taking a personality quiz.

And that brings us to the final point here: Cambridge Analytica, like many others, used this setup to suck up a ton of data, much of it from friends of people who agreed to install a personality test app (and, a bunch of those users were actually paid via Mechanical Turk to basically cough up all their friends' data). There are reasonable questions about why Facebook set up its API this way (though, as noted above, there were defensible, if short-sighted, reasons). There are reasonable questions about why Facebook wasn't more careful about watching what apps were doing with the data they had access to. And, most importantly, there are reasonable questions about how transparent Facebook was to its end users through all of this (hint: it was not at all transparent).

So there are plenty of things that Facebook clearly did wrong, but it wasn't about selling data to Cambridge Analytica and it wasn't Cambridge Analytica "stealing" data. The real problem was in how all of this was hidden. It comes back to transparency. Facebook could argue that this information was all "public" -- which, uh, okay, it was, but it was not public in a way that the average Facebook user (or even most "expert" Facebook users) truly understood. So if we're going to bash Facebook here, it should be for the fact that none of this was clear to users.

Indeed, even though Facebook shut down this API in April of 2015 (after deprecating it in April of 2014), most users still had no idea just how much information Facebook apps had about them and their friends. Today, the new API still coughs up a lot more info than people realize about themselves (and, again, that's bad and Facebook should improve that), but no longer your friends' data as well.

So slam Facebook all your want for failing to make this clear. Slam Facebook for not warning users about the data they were sharing -- or that their friends could share. Slam Facebook for not recognizing how apps were sucking up this data and the privacy implications related to that. But don't slam Facebook for "selling your data" to advertisers, because that's not what happened.

I was going to use this post to also discuss why this misconception is leading to bad policy prescriptions, but this one is long enough already, so stay tuned for that one next. Update: And here's that post.

Filed Under: apps, breach, data, selling data, social media, transparency, users
Companies: cambridge analytica, facebook

Software Company Asks Users For Input On DRM; Goes Ahead And Institutes It Anyway Over Their Objections

from the by-'listening,'-we-meant-nodding-thoughtfully-while-moving-forward-with dept

Nothing does more damage more quickly to your community than deciding to place your fear of piracy over the the concerns of those who've already paid for your product. DRM is rarely, if ever, the answer. And yet, it remains an inexplicably popular "solution."

Daz 3D, which produces 3D art software as well as assets for use with third party software, has decided to do something about its perceived piracy problem. Last November, it had this to say:

[W]e feel the best way to fight piracy is make the convenience of doing something legally more so than the inconvenience of pirating. That is why we made finding, downloading, installing, and loading content in Studio as streamlined and easy as possible while making getting a pirate-able copy of the original product harder.

The solution to the problem, according to Daz 3D, was to have the software "phone home" at least once to obtain a key for content/software files, which would only arrive in encrypted form. Supposedly, this would be limited to once per computer but the new, encrypted files would pose problems for existing users.

Those on older versions of Daz's software would be unable to access any new content. Transferring old data could also result in problems -- something Daz acknowledged in a later post, noting that scripts and tools might not work with unencrypted content.

At the time of the announcement, no plan was in place to provide offline users with authentication keys, nor would it be possible to purchase new content without running through Daz's "Connect" service, which not only authenticates users but "assembles" newly purchased content for use with Daz software.

Daz did the right thing and put its proposals up for discussion. This generated dozens of pages of comments, many of which were from users opposed to the addition of DRM. Some were concerned about the Daz Connect DRM breaking content they'd already paid for. Others simply didn't like being treated like pirates when they'd actually paid for software and add-ons.

Daz's representatives were active in forum discussions and very straightforward about their reasons for looking into instituting DRM. The company is hoping a few extra installation hoops and another layer of authentication would deter casual pirates, leaving them only the diehard crackers interested in "capturing" a niche "market."

The willingness to listen and participate in the discussion separates Daz from many other companies who've added DRM to their products. Unfortunately, it appears the discussion had little effect on Daz's final decision. The post may be titled "You've been heard," but the content contained in it indicates the listening was little more than a formality. Daz will be moving ahead with its original plan, despite customers making it clear they'd rather have a product that doesn't introduce compatibility problems. Nor do they want to be limited to a single distribution system. And they're less than thrilled about the "phone home" requirement.

The new post, delivered four months after the original announcement, changes nothing about the DRM structure. While it does add some fail-safe measures (like third-party escrow that will prevent users from being locked out of their purchases if Daz goes out of business), the end result is still the same. DRM is coming to Daz and there's nothing users can do about it.

Currently Daz Connect gives customers the ability to install (among other things) encrypted content. Daz Connect also lets customers retrieve a Key to decrypt their content. Customers have raised the concerns of:

What if Daz is not available to provide the keys anymore, chooses not to, or starts charging an additional fee to get a key for previously purchased content?

Solution: We have developed and fully tested a utility which will decrypt, and save in non-encrypted formats, Daz products on a customer’s computer. We are also working out details with a software escrow company who will provide this utility to the public free of charge in the event that Daz is no longer in a business position to, or is unwilling to continue offering this as a free service. This will also be added to the Daz EULA to ensure customers of our commitment to enable them to always be able to use content that they have purchased a license for.

Obviously this does not address other issues such as scripts and tools that work on un-encrypted content. But those are solved in other ways. We are working (and will continue to work) with developers who have this need, in order to show them how to do it with encrypted content.

Apparently, "hearing" actually means ignoring concerns people expressed, including portability from older versions of Daz's software. And, as is nearly always the case when DRM to added to a previously DRM-free product, the company is presenting it as a win for paying customers.

Is the encryption associated with Daz Connect essentially Digital Rights Management (DRM)?

We strive to add great benefits to being connected while limiting the impact to the user experience. Although we have included file encryption to protect our artist community, the primary target is to provide a better experience for our users. Daz Connect delivers and updates products more efficiently but relies on the fact that files are in a location and format that is maintained by the application. In this sense, Daz Connect provides some measure of digital rights management.

So, Daz is thinking of its customers while simultaneously willing to ignore those customers to institute something it thinks will decrease piracy. While I can appreciate the fact Daz wants to protect its bottom line, it needs to be aware that instituting these new restrictions will result in actual lost sales -- something that may ultimately prove more harmful than the theoretical lost sales Daz attributes to piracy.

Filed Under: drm, opinions, users
Companies: daz 3d

You Can Now Turn Off Ads On Techdirt

from the go-ahead dept

We get it. Many of you really hate online advertising. And, indeed, there's often a good reason for that. The ads can be irrelevant, intrusive and annoying. And, in some cases, they can even be dangerous, as scammers or those with malicious intent slip bad code into ad networks in order to wreak havoc on visitors' computers. So here's a deal: if you don't want to see display/banner ads on Techdirt any more you don't need to. Just go to your preferences page (whether you have an account or are just browsing without a login) and click the button saying you want to disable ads. And, that's it. No more network display ads.

This isn't one of those "pay us to remove ads" deals. It's up to you. That said, obviously if you disable ads we're likely to make less money. So if you choose to do that, we'd appreciate it if you supported us in other ways, such as via our Insider Shop, where you can buy a membership that gets you certain perks, or through our Deals Store, where you can support Techdirt while buying some cool products and services. But, again, this is not a requirement. If you don't like ads on the site, turn them off.

If you've been paying attention to the news lately, there's been all sorts of hand-wringing about "ad blockers", with the hair pulling reaching new levels of craziness a few weeks ago when Apple finally started allowing ad blockers into the iOS app store. Some have been whining about how this is going to kill off the free internet or somehow lead publishers to fall to the side as internet giants like Google, Facebook and Apple colonize the independent web. There have been all sorts of debates about whether or not ad blocking is ethical, which seems like a pointless debate to me, since users don't care. They're going to do it anyway.

I'm planning to do another post in the near future on how the online advertising/publishing ecosystem should react to all of this, but so far they've been reacting... badly. The IAB (Internet Advertising Bureau) has gone so far as to discuss suing over ad blocking, and some sites -- including the Washington Post -- have decided to block access to users who have ad blockers enabled.

We've even been approached by multiple companies who claim to offer a form of ad blocker blocker, that will either insert new ads even when users have ad blockers, or otherwise pester users with ad blockers turned on.

This seems like the exact wrong approach. It's somewhat reminiscent of the way the RIAA and MPAA reacted to the internet challenging their business models. Rather than listen, recognize what the public wanted and adapt, they whined, screamed about ethics and went to court. And how's that worked out for everyone? We've always said that those who adapt to these challenges are likely to do better, and part of that means actually listening to your fans and helping them do what they want. So that's what we're doing: if you choose to disable ads, you just need to go to your preferences and click a button and that should do it.

It's important to note that this is an experiment, though we have no plans to suddenly pull it back (that would be ridiculous). For now, it only applies to network display ads -- or what most people think of as "banner ads." In the future, we may (or may not!) experiment with further ability to customize what you see and what you don't see on the site. Again, there is no expectation here in terms of how you respond, but running this site does cost money -- so we would certainly appreciate it if you also were willing to support the site in other ways, whether you turn off the ads or leave them on. But, on the whole, we're going to allow you to decide how you best want to support this site and trust you to figure out the best way, rather than forcing the choice upon you. Thanks for being a part of this community and we look forward to continuing to deliver interesting stories and conversations going forward.

Filed Under: ad blocking, ads, business models, revenue streams, support, tracking, users
Companies: techdirt

Why Everyone's Totally Overreacting To Spotify's Privacy Policy (Which Isn't As Bad As You Think)

from the it's-not-what-you-think dept

As you may have heard, yesterday there was a bit of a kerfuffle over the fact that Spotify changed its privacy policy in a way that people are calling creepy and eerie. And there's a ton of chatter on Twitter from people insisting that they'll never use Spotify again because of this. The specific changes that have people up in arms sure do sound creepy at first glance. The key problems are that Spotify's new privacy policy says that it "may collect information stored on your mobile device, such as contacts, photos, or media files" and that it "may also collect information about your location based on, for example, your phone’s GPS location or other forms of locating mobile devices (e.g., Bluetooth). We may also collect sensor data (e.g., data about the speed of your movements, such as whether you are running, walking, or in transit)." There's some other stuff about how it may share information with third party services.

I understand, instinctively, why so many people freaked out about this -- but it's a pure overreaction for a variety of reasons, which we'll dig into here. There are problems with this whole scenario, but it has a lot more to do with (1) the stupid reliance on "privacy policies" rather than "user controls" for privacy and (2) Spotify's apparently asleep-at-the-wheel PR team.

Privacy is a Trade-off Not a Thing

As we've said before, if you ever want perfect privacy, you'd never leave your house. The second you leave your home, you're giving up some level of privacy. But it's a trade-off most people think is perfectly reasonable. Privacy is always like that. It's a trade-off between the benefit you get from giving up a little privacy in order to get the thing that you want. The idea that privacy is some absolute "thing" is a weird way of looking at privacy and makes it difficult to do things in a reasonable manner. The real issue, then, is making sure that people understand the trade-offs involved (and we'll get to that below).

Spotify's Privacy Policy is Not that Crazy.

Much of the reaction is because people immediately assumed that there was some nefarious reason why Spotify was going to collect all this information on people. Yet, as a few people pointed out when everyone started freaking out -- and which Spotify eventually clarified in a blog post "apologizing" for the poor roll out, there are legitimate service reasons for each of these requests. Also, the company made it clear that before it actually accesses any of this content, it would first ask your permission. In short, it's like when various services ask if you'd like to "find friends" using a service, you have to first approve it. Same would be true here. And, note, that each of the uses would be for services that some people might actually like (personalizing cover art, voice control, etc.):

Photos: We will never access your photos without explicit permission and we will never scan or import your photo library or camera roll. If you give us permission to access photos, we will only use or access images that you specifically choose to share. Those photos would only be used in ways you choose and control – to create personalized cover art for a playlist or to change your profile image, for example.

Location: We will never gather or use the location of your mobile device without your explicit permission. We would use it to help personalize recommendations or to keep you up to date about music trending in your area. And if you choose to share location information but later change your mind, you will always have the ability to stop sharing.

Voice: We will never access your microphone without your permission. Many people like to use Spotify in a hands-free way, and we may build voice controls into future versions of the product that will allow you to skip tracks, or pause, or otherwise navigate the app. You will always have the ability to disable voice controls.

Contacts: We will never scan or import your contacts without your permission. Spotify is a social platform and many people like to share playlists and music they discover with their friends. In the future, we may want to give you the ability to find your friends on Spotify by searching for Spotify users in your contacts if you choose to do that.

The Real Problem is that We Use Privacy Policies at All

For many years, we've been pointing out that this whole system of privacy policies is broken. It's one of those ideas that people came up with years ago that sounds good, but isn't. And yet, we're not only stuck with it, we have politicians who keep pushing more requirements for more privacy policies. But that's stupid.

First: the only way you can legally get in trouble over privacy issues is by violating your privacy policy. So every company is incentivized by law to create privacy policies that are very broad and expansive, making it less likely they'll violate them in the first place. The only time such a broad privacy policy backfires is if the public suddenly has a viral panic about it, like this time, but that rarely happens because no one reads privacy policies.

In fact, one of the worst things about privacy policies is that people simply believe if you have a privacy policy it means "oh they'll keep my info private" even if the privacy policy says "we're going to share your information with everyone."

Let's face it: privacy policies are a stupid way to deal with privacy. They don't work. They fuck up incentives. No one reads them. And yet, because politicians are clueless, they're often "required." You end up with grandstanding politicians who play gotcha games on privacy policies, without caring about actual privacy practices.

The Way to Deal With Privacy is MORE TRANSPARENCY and MORE USER CONTROL

Rather than using privacy policies, the real way to deal with privacy is to give the end user more transparency into what's happening and more control. I don't have an iPhone, but I believe it already offers the ability at an individualized level to allow users to block apps from accessing certain features/data on a phone. And I know that the next version of Android is moving to a similar model, including only asking you to approve privacy permissions at the moment the app is requesting it. In other words, when Spotify wants to access your photos, the app will directly ask you for permission at that moment -- and, assuming it's for something you want to do (like customizing your cover art), you're more likely to grant permission without thinking it's creepy at all.

The Real Problem Here Was The Perception Problem

And this is something Spotify should have prepared for much better. The company probably assumed, incorrectly, that no one would really read the new privacy policy, because no one reads privacy policies. But that didn't happen. What Spotify should have done is from the beginning describe the new features it was offering -- with a direct explanation of why that feature might then require a change in the privacy policy, along with the promise that the app will ask permission directly at the time of use. Spotify eventually kind of got there, but they did it after, not before. This goes back to the "more transparency" aspect above. Do it that way, and you have less of a freakout.

So, really, to everyone freaking out over Spotify's privacy policy, I understand the gut reaction reasons for doing so. Of course, at first, it seems fucked up that a music player wants to access your contacts or your location. But there are perfectly legitimate, non-nefarious reasons for doing so. And Spotify could have cut off the freakout by being more transparent and upfront about things at the beginning. But, really, the problem here is our stupid reliance on privacy policies, rather than user controls.

Filed Under: apps, control, music, privacy, privacy policy, tradeoffs, users
Companies: spotify

Would You Compromise Your Computer For One Cent An Hour? New Study Says Many Are Happy To Do Exactly That

from the nothing-to-hide,-or-too-stupid-to-computer? dept

There are many tales in literature over millennia about people selling their soul to a malevolent deity for the right price. But at least it’s usually a good price. Recent research has discovered that we are willing to compromise our computer for no more than one cent in income.

The researchers from the Carnegie Mellon University CyLab who carried out this work, tempted users into downloading and, in many cases, actually running a Windows application on their computer. After they had agreed to take part, they were told that it was for an academic study but were given very little other information about the application. The application pretended to run a series of computational tasks and paid those who installed it one cent for every hour it was left running.

Even though a participant's machine would give them a pop up warning when they started the download to tell them that this application wanted higher level access to essential security services, 22% of them went ahead and downloaded. And when participants were offered $1 per hour, that figure rose to 43%.

With more than 1,700 downloads, the application was run about 960 times, meaning that just over half of participants fell for the ruse. Alarm bells should have rung, but they were apparently not heeded.

The fact is, this application could easily have contained malware. Participants knew little about what they were installing other than it would pay them for their processing power but they didn't seem to mind.

The ethics of this research are certainly potentially dubious. Individuals were lured into downloading this application for a seemingly good cause and we know nothing of their financial circumstances. It's a scenario that many of us can recognise in one way or another, though. We may not get a financial reward for downloading applications but how often to we click away warnings so we can get an app that offers us some other incentive, such as access to free music or movies?

Crooks will be pleased to learn from this study that it is apparently very easy to trick ordinary computer users into hosting your malware.

It is an old adage, but it is still very important to remember – if it looks too good to be true, it probably is. Do not install any application without checking if the source is reputable. Free is often good, but with free on the internet comes with many risks. This is particularly true for sites offering access to illegal movies or adult content.

Whenever you download an application from any source, trusted or otherwise, you should complete a simple mental checklist.

Did I scan for malware just before I clicked to install the application? Is my operating system warning me about the security risks with this application? Did I scan my system for malware after I installed the application? And finally, do I have up to date anti-malware software?

This all may seem tedious, but it pays to be cautious. Recent incidents have taught us that there are plenty of people out there who will take advantage of anyone who hasn't protected themselves properly. Whether this research shows that we just can't be bothered to read the pop up warnings our computers send us when we click and install or whether it shows that we are even more willing to compromise our security in the name of a quick buck, it should make us think twice about how blindly we click. Just as any character in literary history will tell you, selling your soul rarely turns out to be a good deal.

Andrew Smith does not work for, consult to, own shares in or receive funding from any company or organization that would benefit from this article, and has no relevant affiliations.

This article was originally published on The Conversation. Read the original article.

Filed Under: malware, money, users

Stop Saying 'If You're Not Paying, You're The Product'

from the there-are-more-options dept

We just wrote about how silly it is to argue that companies you pay for their services or software somehow treat you better or are more "aligned" with user interests than those who give you products and services for free. When you dig in on the subject, such claims don't make any sense. In both cases, companies have some alignment with users -- because without users, they're nothing -- and some alignment with trying to make themselves money. And sometimes those two alignments conflict, whether or not the user is paying directly.

Derek Powazek (random trivia: whose work inspired me to learn how to create a web page back around 1995 or 1996 or so) has an excellent take on the pithy and dismissive phrase that many often use to argue that free services treat users worse:

"If you're not paying for the product, you are the product."

It's pithy and clever... and wrong. Powazek dismantles the claim eloquently. He attacks the underlying assumptions in that statement. He highlights that "free with advertising" has been a pretty big business for a long long time, in which there's no indication that users were treated as "the product" or somehow treated poorly. And then there's the key one: this is not an either/or situation:

I’ve worked for, and even run, many companies in the last 20 years with various business models. Some provided something free in an attempt to build an audience large enough to sell advertising, some charged customers directly, and some did a combination of both. All treated their users with varying levels of respect. There was no correlation between how much money users paid and how well they were treated.

For example, at JPG Magazine we sold something to our audience (magazines, subscriptions, and ultimately other digital services) and we also sold ads and sponsorships (online and in print). We made it 100% clear to our members that their photos always belonged to them, and we had strict rules for what advertisers could do in the magazine. We also paid our members for the privilege of including their photos in the printed magazine (as opposed to Instagram’s new policy that they can use your photos however they want, even in ads, without paying you a dime).

This example is much more complicated than the black and white “you’re the product” logic allows. In some cases, users got the service for free. In others, they paid us to get the magazine. In still others, we paid them! So who/what is the product?

And just because you pay doesn’t mean you’re not the product. Cable TV companies take our money and sell us to the channels, magazines take our money and still sell ads, banks and credit cards charge us money for the service of having our money. Any store that has a “loyalty card” takes our money for products but gives us a discount in exchange for the ability to monitor what we buy. In the real world, we routinely become “the product” even when we’re already paying.

He also points out, as I have many times, that there are plenty of companies whose services you pay for who treat their users atrociously. And then points out what many of us have been arguing all along: there are all sorts of business models online. Some work in some cases, others work in other cases. But to argue that "free" services mean you're "the product" and thus not treated as well, simply isn't an accurate or realistic statement. So can we please agree to kill it?

Filed Under: customer service, free, internet business models, paid, product, users