Study: 15% Of Wireless Users Now Tracked By Stealth Headers, Or 'Zombie Cookies'

from the utterly-unaccountable dept

Earlier this year AT&T and Verizon were caught modifying wireless user traffic to inject unique identifier headers (UIDH). This allowed the carriers to ignore a user's privacy preferences on the browser level and track all online behavior. In Verizon's case, the practice wasn't discovered for two years after implementation, and the carrier only integrated a working opt out mechanism only after another six months of public criticism. Verizon and AT&T of course denied that these headers could be abused by third parties. Shortly thereafter it was illustrated that it was relatively easy for these headers to be abused by third parties.

While the fracas over these "stealth" or "zombie" cookies has quieted down since, a new study suggests use of such stealth tracking is increasing around the world as carriers push to nab their share of the advertising pie. Consumer advocacy group Access has been running a website called AmiBeingTracked.com, which analyzes user traffic to determine whether or not carriers are fiddling with their packets to track online behavior. According to a new study from the group (pdf) examining around 200,000 such tests, about 15% of site visitors were being tracked by the carriers in this fashion all over the globe:Globally, the report notes that AT&T, Bell Canada, Bharti Airtel, Cricket, Telefonica de España, Verizon, Viettel Peru S.a.c., Vodafone NL, and Vodafone Spain are all now using stealth headers. In many of these instances there's no opt-out mechanisms in place for users, or the opt-in mechanisms that exist don't actually work. Most regulators meanwhile don't even realize this technology exists, much less have any plan to protect user privacy via hard opt-out requirements. The practice itself, and the stored data, the group's authors note, makes a delicious target for hackers and the intelligence community alike:

"Using tracking headers also raises concerns related to data retention. When “honey pots” of sensitive information, such as data on browsing, location, and phone numbers, are collected and stored, they attract malicious hacking and government surveillance. This kind of collection and retention of user data is unsustainable and unwise, and creates unmanageable risks for businesses and customers alike."

The W3C Consortium recently agreed, noting that stealth carrier tracking header injection is basically a privacy nightmare in the making that undermines user trust in the entire Internet:

"The aggregate effect of unsanctioned tracking is to undermine user trust in the Web itself. Moreover, if browsers cannot isolate activity between sites and offer users control over their data, they are unable to act as trusted agents for the user. Notably, unsanctioned tracking can be harmful even if non-identifying data is shared, because it provides the linkage among disparate information streams across contextual boundaries. For example the sharing of an opaque fingerprint among a set of unrelated online purchases can provide enough information to enable advertisers to determine that user of that browser is pregnant — and hence to target her with pregnancy-specific advertisements even before she has disclosed her pregnancy.

This is what has been happening while the marketing, tech and telecom industries bickered, prattled and grandstanded over do not track protections -- that this technology makes irrelevant anyway. And while companies like Verizon have repeatedly claimed that no privacy or transparency guidelines are necessary because "public shame" will keep them honest, keep in mind that it took security researchers two years before they even realized that the telco was doing this. It took another six months of pressure for Verizon to heed calls for basic opt-out mechanisms most Verizon users don't know exist. It makes you wonder: just how long will it take the press and public to realize future iterations of stealth tracking technology are being used?

Filed Under: privacy, trackers, uidh, wireless, zombie cookies

FCC Fines Company Caught Blocking Wi-Fi To Force Visitors On To Their Own, Absurdly-Priced Services

from the packet-shenanigans dept

The FCC has fined yet another company for blocking user Wi-Fi access in order to drive customers to the company's own, ridiculously-expensive Wi-Fi options. According to an FCC announcement, regulators have fined Smart City Holdings, LLC $750,000 for blocking user access to Wi-Fi at a number of convention centers served by the company. More specifically, Smart City was caught using common technology that sends de-authorization packets to user devices, kicking them off of their own personal hotspots or tethered smartphones while in Smart City business locations.

This was done, says the FCC, so that users would have to use Smart City's own service, which according to this brochure for the Charlotte convention center (pdf), is provided at pricing that's downright comical. Smart City offers convention center exhibitors access to 24 hours of blisteringly-fast (1.5 Mbps) Wi-Fi for $80, three days of Wi-Fi for $160, or five days for $360. If you're just a conference center visitor your options get even slower, with the company providing 768 kbps Wi-Fi service for $13 per 24 hours.

Obviously most users would rather just use their own phone as a hotspot to avoid these charges, and the FCC reminds everyone that acting like a jackass and preventing this from happening to make additional money simply isn't ok:

"It is unacceptable for any company to charge consumers exorbitant fees to access the Internet while at the same time blocking them from using their own personal Wi-Fi hotspots to access the Internet,” said Travis LeBlanc, Chief of the FCC’s Enforcement Bureau. “All companies who seek to use technologies that block FCC-approved Wi-Fi connections are on notice that such practices are patently unlawful."

This is the second time the FCC has had to step in and slap some wrists. The company fined Marriott $600,000 last year for the same thing, though Marriott was blocking local Wi-Fi to drive users to even more expensive, $1,000 per device Wi-Fi service. Marriott originally tried to fight the agency by arguing this was all done to protect the safety and security of their customers, but sheepishly backed off of the practice once they realized the court of public opinion was very clearly not on its side.

Like Marriott, Smart City apparently couldn't help itself, and felt it necessary to issue a bullshit statement pretending the practice was about network security:

"As recommended by the Department of Commerce and Department of Defense, we have occasionally used technologies made available by major equipment manufacturers to prevent wireless devices from significantly interfering with and disrupting the operations of neighboring exhibitors on our convention floors. This activity resulted in significantly less than one percent (1%) of all devices being deauthenticated and these same technologies are widely used by major convention centers across the globe as well as many federal agencies."

So yeah, uh, we weren't being anti-competitive asses, we were simply worried about network security (the irrelevant DOD reference is a nice touch though). Fortunately, Smart City's statement also makes it clear they see the futility of fighting the FCC on this issue:

"While we have strong legal arguments, we’ve determined that mounting a vigorous defense would ultimately prove too costly and too great a distraction for our leadership team. As a result, we’ve chosen to work cooperatively with the FCC, and we are pleased to have resolved this matter. We are eager to return our energies to providing leadership to our industry and delivering world-class services to our clients."

Yeah, it's probably a good idea to get back to what you do best: charging outrageous pricing for pathetically-slow Wi-Fi service.

Filed Under: blocking, conferences, fcc, fine, wifi
Companies: smart city

Verizon Quietly Backs Off Throttling 'Unlimited' Wireless Customers, But Only After It No Longer Matters

from the limited-unlimited dept

In July of 2011, Verizon announced it would no longer offer its wireless users unlimited data plans, and instead began pushing more expensive and capped shared data plans (complete with shiny $15 per gigabyte overage fees!). While Verizon did grandfather existing unlimited customers, like AT&T, it immediately began waging a quiet war on these users, throttling these purportedly "unlimited" connections to try and drive these users toward pricier metered options.

In Verizon's case, the company started by throttling unlimited customers on its 3G network. When Verizon Wireless announced in 2014 it was going to start applying these "network optimization" practices to its LTE 4G network, the company received a surprise wrist slap by FCC boss Tom Wheeler, who warned the company that he saw through its use of congestion to drive revenue:

"Reasonable network management" concerns the technical management of your network; it is not a loophole designed to enhance your revenue streams. It is disturbing to me that Verizon Wireless would base its "network management" on distinctions among its customers' data plans, rather than on network architecture or technology."

As we frequently note, phantom network congestion has long been a useful bogeyman to defend predatory or otherwise anti-competitive behavior in telecom. In Verizon's case, the company responded to the FCC by effectively claiming that everybody was doing it, something that didn't sit well with Wheeler in a follow up warning to the company just about a year ago:

"'All the kids do it' was never something that worked with me when I was growing up and it didn’t work with my kids,” Wheeler told reporters on Friday. Wheeler said that response wasn’t good enough to calm his concerns that the company was trying to milk users for more profit. "My concern in this instance is that it is moving from engineering and technological issues into business issues,” he said.

Verizon ultimately decided to scrap its plans to throttle unlimited LTE users, and the FCC proceeded to pass tougher new net neutrality rules in February of this year. AT&T, in contrast, tried to push its luck, and continued throttling unlimited users until it received a $100 million FCC fine (which AT&T is still fighting) and was socked with an FTC lawsuit for false advertising (which AT&T is also still fighting). Verizon, meanwhile, quietly continued throttling its unlimited 3G users -- until only just last week. Verizon "announced" the changes in a bit of fine print on the Verizon website:

"Beginning in 2011," it reads, "to optimize our network, we managed data connection speeds for a small subset of customers — those who are in the top 5% of data users and have 3G devices on unlimited data plans — and only in places and at times when the network was experiencing high demand. We discontinued this practice in June, 2015."

And by "optimize its network," Verizon means "optimize its revenues." In speaking to the Washington Post, Verizon claims this was just a run of the mill business decision, made because it impacted so few customers:

"We make business decisions all the time," Verizon said in a statement to the Post. "Because it was such a small subset of customers who were affected [by the 3G throttling], we made the call to discontinue even a limited approach to managing data connection speeds."

Right, well, it's only now such a small subset of customers because Verizon drove them all to metered, LTE plans already. But basically, Verizon was allowed for four years to advertise a product falsely as "unlimited," and to use network congestion as bogus justification for driving its users to more expensive plans -- with little more than a wrist slap. With the net neutrality rules now in effect (you know, the ones that were supposed to have destroyed the Internet by now) there's some basic protections in place for consumers moving forward.

But with AT&T and Verizon's history of outright fraud and misleading consumers, and network gear getting ever more sophisticated, enforcement is going to require that the FCC remain uncharacteristically tough and attentive. And that's no given; as noted recently usage caps similarly use the congestion bogeyman to drive revenue and raise consumer rates, but the FCC has remained notably mute on the subject.

Filed Under: 3g, fcc, throttling, unlimited
Companies: verizon

AT&T's Version Of Wireless Price Competition: Raising Prices

from the that's-not-how-this-works dept

There's no doubt that T-Mobile and its smack-talking CEO have been good for the wireless industry, applying pressure on a lot of customer pain points like subsidized devices, international roaming, and long-term contracts and early termination fees. As a result, T-Mobile's been adding more new subscribers than any of the other three major carriers. But as I've noted a few times now, the pricing response to this competition by companies like AT&T and Verizon has been a bit cosmetic and theatrical in nature, since none of the carriers want a real wireless price war.

Sure, there are some occasionally decent promotions but, by and large, the name of the game right now for both AT&T and Verizon is driving network usage and shoving customers as hard as possible toward large, expensive, shared data allotments. Verizon has pretty loudly stated it's not going to seriously compete on price because it believes its network is just that good. The latest example of not-really-price competition comes courtesy of AT&T, who is responding to T-Mobile's competitive pressure by... raising fees and creating entirely new annoying surcharges:

The new activation/upgrade fee for one and two-year agreements is raising from $40 to $45, which gives AT&T the highest activation fee in the industry (Verizon is still at $40 for now). Going forward after August 1, should you choose to sign-up for a new contract to receive a discounted phone, you will pay $5 more than you used to.

In related news, AT&T Next will no longer be a zero-out-of-pocket installment plan. Come August 1, customers who are new to AT&T Next will have to pay a $15 activation fee when they pick up a new phone. This $15 fee also applies to those who bring their own device (BYOD) and sign-up for a new line of service.

So yeah, AT&T's response to price competition is -- to raise prices. And its response to media inquiries so far as to why this is occurring has been total radio silence, since there's not much it could say to defend the practice. Perhaps that's the reason that while T-Mobile is seeing notable growth, AT&T actually lost phone customers last quarter?

There are still a few reasons why AT&T doesn't really have to care what you or the media thinks. One, the company's mammoth lobbying apparatus ensures it still gets favorable treatment, especially on the easily manhandled state level, where most legislators would happily sell their first born to win the company's affections. Two, AT&T still has a stranglehold over a huge swath of wireless spectrum thanks to auction rules that historically favored large companies (though that's changing... slowly). Three, AT&T and Verizon combined still control around 80% or more of the wireless backhaul special access market, which companies like T-Mobile need to pay to access in order to reach their customers.

Of course hammering customers with a bevy of annoying fees is pretty much standard operating procedure in most industries as a way to pretend your advertised rate is staying the same. But AT&T's latest greedy little cash grab is worth remembering the next time industry trade groups like the CTIA are breathlessly insisting that fierce competition is delivering a bonanza of broadband bargains. There is no "wireless price war." It's more of a theatrical pricing improvisational dance.

Filed Under: competition, mobile phones, prices, wireless
Companies: at&t

Sprint Tries To 'Compete' By Throttling All Video To 600 Kbps, Then Talking Some Shit On Twitter

from the when-in-doubt,-call-bullshit dept

Sprint was the only one of the big four carriers to clearly support Title II and full net neutrality rules, but since the rules' passage the company's behavior has been a little bit strange. Last week, Sprint announced a new "All In" promotion that offers new users unlimited text, voice and data for $60 a month, plus a $20 device lease fee. The plan was supposed to be the company's game changing assault on current industry darling T-Mobile, but Sprint curiously included a small caveat in the fine print of the program; absolutely all video going over the Sprint network would be throttled to 600 kbps regardless of network congestion:

"To improve data experience for the majority of users, throughput may be limited, varied or reduced on the network. Streaming video speeds will be limited to 600Kbps at all times, which may impact quality. Sprint may terminate service if off-network roaming usage in a month exceeds: (1) 800 min. or a majority of min.; or (2) 100MB or a majority of KB."

Users quickly made it clear that they weren't interested in an "unlimited" data plan with such limits, forcing Sprint CEO Marcelo Claure -- who claimed he was asleep in Tokyo during all the ruckus -- to reverse course and remove the 600 kbps limit. This flub came after the company's CEO had been making it perfectly clear Sprint is planning to kill unlimited data entirely, one of the few things people actually like about Sprint. In short, Sprint's trying very hard lately to act like the more-disruptive T-Mobile, but as the uncool "dad jeans" of the wireless sector, isn't quite sure how to go about it.

With the company's promo arriving with a thud, Sprint apparently tried to mimic T-Mobile in another way: mirror the trash-talking of T-Mobile's brash CEO John Legere. Sprint's Claure quickly decided the best course of action would be to head to Twitter and insist that T-Mobile's recent "uncarrier" efforts (specifically its handset early-upgrade program) were little more than finely crafted bullshit:

@JohnLegere I am so tired of your Uncarrier bullshit when you are worse than the other two carriers together. Your cheap misleading lease

— MarceloClaure (@marceloclaure) July 2, 2015

.@marceloclaure you mad bro?

— John Legere (@JohnLegere) July 2, 2015

The problem is that T-Mobile's amusing uncarrier efforts (which have included eliminating device subsidies, hidden fees, and other industry pain points) have been working. The magenta-hued carrier has been adding more new subscribers per quarter than any other U.S. operator, feeding a desperate consumer desire for better deals and less fine print. Sprint, meanwhile, has labored in last place in most network performance and customer satisfaction studies. As such, offering up some bullshit, then deriding other companies for engaging in bullshit, probably isn't the best way to reverse those lagging fortunes.

Filed Under: competition, john legere, marcelo claure, mobile, throttling, video, wireless
Companies: sprint, t-mobile