- A small email provider and its customers have mobilized to force the Swiss government to put its new invasive surveillance law up for a public vote in a national referendum in June. https://theintercept.
com/2016/01/25/how-a-small- company-in-switzerland-is- fighting-a-surveillance-law- and-winning/ - The FTC has settled a case against developers accused of purchasing a game called “Running Fred” and turning it into Adware: https://www.consumeraffairs.
com/news/ftc-calls-game-over- on-running-fred-020916.html - The Institute for Quantitative Social Science at Harvard University has created theDataMap, an online portal for documenting flows of personal data. http://observer.com/2016/02/
harvard-datamap-personal-info/ ,http://thedatamap.org/. - France’s data protection authority has ordered Facebook to stop transferring user data to the US, following a ruling from the European Union that invalidated a longstanding trans-Atlantic data transfer agreement: http://www.theverge.com/2016/
2/9/10950768/facebook-france- data-transfer-privacy-order - James Clapper has acknowledged for the first time that agencies might use a new generation of smart household devices to increase their surveillance capabilities. http://www.theguardian.com/
technology/2016/feb/09/ internet-of-things-smart-home- devices-government- surveillance-james-clapper - Brendan Eich, co-founder of Mozilla and for an 11-day stint, its CEO, yesterday announced a new browser called “Brave,” that blocks outside online ads and ad tracking: http://www.computerworld.com/
article/3025252/web-browsers/ brave-is-the-name-ad-blocking- the-game-of-new-browser.html - The President is setting up a Federal Privacy Council: https://www.whitehouse.gov/
the-press-office/2016/02/09/ executive-order-establishment- federal-privacy-council - Bills have been proposed in South Dakota, Virginia, and Florida to limit transgender students’ use of restrooms consistent with their gender identity: http://www.hrc.org/blog/am-
equality-tip-sheet-february- 10-2016 - The President is directing his Administration to implement a Cybersecurity National Action Plan that takes near-term actions and puts in place a long-term strategy to enhance cybersecurity awareness and protections, protect privacy, maintain public safety as well as economic and national security, and empower Americans to take better control of their digital security:https://www.whitehouse.gov/
the-press-office/2016/02/09/ fact-sheet-cybersecurity- national-action-plan - The Obama administration on Thursday implemented changes to the U.S. visa waiver program made in the wake of terrorist attacks in Paris that spurred fears extremists could enter the country undetected: http://www.usnews.com/news/
articles/2016-01-21/us- restricts-visa-free-travel-to- enhance-national-security
Blog
-
PRG News Roundup: February 10th
-
PRG News Roundup: February 3rd
The discovery that the university is monitoring UC Berkeley network traffic has sparked outrage among faculty members who see such undisclosed surveillance as a significant threat to privacy.http://www.nytimes.com/2016/
02/02/technology/at-uc- berkeley-a-new-digital- privacy-protest.html, http://www.dailycal.org/2016/ 02/02/web-cyber-controversy/. A federal judge in the Western District of Washington determined that users have no expectation of privacy when using Tor, because Tor does not give its users complete anonymity–a user has to give their IP address to their Internet Service Provider to connect to the Tor network. http://motherboard.vice.com/
read/confused-judge-says-you- have-no-expectation-of- privacy-when-using-tor- playpen-fbi-michaud. Full text of the opinion can be found here: https://assets.documentcloud. org/documents/2699886/140- Michaud-Order-Denying-Mtn-to- Suppress.pdf. Oral Roberts University now requires their students to wear tracking devices to monitor their fitness.http://www.newson6.com/story/
30920656/wearing-fitness- trackers-now-mandatory-for- oru-freshman -
PRG News Roundup: January 27th
A group from Stanford showed that the MEMS gyroscopes found on modern smart phones are sufficiently sensitive to measure acoustic signals in the vicinity of the phone, making it possible to identify speaker information and even parse speech.
https://crypto.stanford.edu/gyrophone/
NBC attempted to glean Netflix’s viewership ratings with the help of tech firm Symphony, which measures TV viewing using audio content recognition technology—software loaded on to user’s phones that tracks viewership by capturing the soundtrack of the program.
http://www.vox.com/2016/1/13/10764818/netflix-ratings
The U.S. Senate is currently considering passing the Judicial Redress Act, which would allow citizens of European nations and other designated allies the ability to request corrections of inaccuracies in data held by a number of U.S. agencies, verify their data has not been improperly disclosed, and seek civil judicial recourse in certain circumstances.
On December 15th, the Luxembourg Presidency of the Council of the European Union reached an informal agreement in trialogues with the European Parliament on the ‘Data Protection’ Package which will set out new European rules on privacy in the digital age.
http://europa.eu/rapid/press-release_IP-15-6321_en.htm
Asylum Seekers in Germany will receive an identification card that stores biometric information, medical history, and job skills, among other data.
http://www.wsj.com/articles/germany-cabinet-approves-id-card-plan-for-migrants-1449663398
Ideas for Presentations:
- Year in Review of U.S. Security Bills
- Discussion of the Net Neutrality Decision
-
PRG News Roundup: December 2nd
The Electronic Frontier Foundation (EFF) filed a complaint with the Federal Trade Commission against Google alleging the company has been collecting and data mining children’s data and Internet searches on their Google-sponsored Chromebooks, despite signing a legally enforceable Student Privacy Pledge.
Link: Google Deceptively Tracks Students’ Internet Browsing, EFF Says in FTC Complaint
Mark Zuckerberg announced the birth of his daughter with the creation of a $45 billion dollar charity initiative in an open letter he posted on the social network earlier this week. The initiative has sparked criticisms from critics wary of the charity’s LLC status, which gives Zuckerberg and Chan more flexibility in how the money can be used.
Link: Mark Zuckerberg Vows to Donate 99% of his Facebook Shares for Charity and Zuckerberg, Chan $45B Pledge is Not for Charity, but a Company
Facebook authorities have agreed to meet with the Banglesh government to increase cyber security measures. In particular, the deal will focus on measures to stop violence against women occurring over, or because of information spread through the social network.
Link: Facebook, Bangladesh to Meet for Cyber Security Deal
Yahoo briefly experimented with blocking people using ad-blocking software. Users who tried to log in to their Yahoo mail were prompted to turn off their ad blocker. The experiment was abruptly discontinued following complaints.
Link: Yahoo Mail Tried to Block Ad Blockers, and it Might Have Backfired
Austrian privacy campaigner, Max Schrems, has filed complaints with the data protection agencies of Ireland, Germany and Belgium, demanding they stop Facebook from transferring data of EU citizens over to the United States.
Link: Max Schrems Demands Facebook Stop EU to US Data Transfer Due to Snooping
The Republic of Kazakhstan will require that all Internet users within the country install national security certificates, which could be used to track traffic going in and out of the country.
Link: Kazakhstan Announces Plan to Spy on Encrypted Internet Traffic
The NSA’s bulk surveillance expired as of midnight on November 30th. Under the new system, NSA analysts and law enforcement will be required to get a court order to gain access to phone records. All metadata that has been collected through the program will be preserved through February 29th.
Link: NSA to Shut Down Bulk Phone Surveillance Program by Sunday
New lending startups are looking at potential borrowers’ phone records to assess creditworthiness, using variables such the number of texts sent and received, miles traveled, or even how frequently they charge their phone, in lieu of absent credit histories.
Link: Lending Startups Look at Borrowers’ Phone Usage to Asses Creditworthiness
There was a congressional hearing on the new email privacy bill earlier this week.
Link: Congress Wants to Protect Your Emails from Warrantless Searches
-
PRG News Roundup: November 18th
In the wake of the attacks on Paris, debate in the United States has again looked determining the appropriate balance between privacy and security, especially with regard to encryption.
Similarly, European politicians have begun discussing the issue with regard to airline passenger data.
New technology permits device cross- by including a unique sound in a TV commercial that a mobile application containing the SilverPush “audio beacon” recognizes. That app would typically be brand-specific. Once the sound is heard, the application knows what the user is watching.
Link: http://www.forbes.com/sites/thomasbrewster/2015/11/16/silverpush-ultrasonic-tracking/
-
U.S. Gets Widespread Facial Recognition Technology
This past week, Fortune reported that U.S. retailers were using facial recognition software to target shoplifters.[1] The technology works by scanning the face of customers entering a store and seeking to match the photograph with a group of previously identified individuals. According to the article, this previously identified group is created by the security personnel employed by the store.[2] This article raises several fascinating questions: (1) who owns an individual’s face; (2) what other databases can be compared to the facial scans; and (3) how accurate is the the scanning technology.
Facebook and Google, among other online tech giants, have been using facial recognition software to “tag” individuals in photographs for several years now.[3] This allows these social media platforms to identify users is in a photograph to post on their profile. In addition, it allows the platform to gather information about friend groups to provide superior marketing information to its advertisers. The U.S. Department of Commerce created a working group to determine the answer of who owns the facial scan.[4] However, privacy groups dropped out of the working group after they were unable to get companies to agree to basic privacy controls. There is a question of whether taking continual photographs requires the consent of those photographed, which would likely render facial recognition software impractical.[5]
While relatively new to the U.S., this technology has been used in Europe for years. For instance, a music festival in the U.K. adopted this technology to scan the faces of concertgoers.[6] The police claimed that the the system was to be used “to find organized criminals who prey on festivalgoers who are often victims of theft.”[7] This use of facial scanning shows the potential of the technology: software can incorporate broader databases into the facial database to catch individuals who may have a warrant out for failing to pay a parking ticket.
A final question raised is the accuracy of the technology. One study found that the FBI’s database, which contains the most pictures but is also one of the least technologically advanced, can only provide the right person 80% of the time.[8] Facebook, on the other hand, claims that it’s algorithm depicts the same person 97.25% of the time which is almost equivalent to a human.[9] However, there are no good studies that currently depict the real time offline accuracy of facial recognition software.[10]
Walmart’s experiment only lasted a couple of months after it found that it did not have a good return on investment.[11] In addition, many other companies appear reticent to use the technology. While Congress or the Department of Commerce can hopefully one day find a workable solution to these legal questions, many companies are already scared about the privacy backlash that may occur by adopting these scanners.
[1] Jeff John Roberts, Walmart’s Use of Sci-fi Tech to Spot Shoplifters Raises Privacy Questions, Fortune (Nov. 9, 2015), http://fortune.com/2015/11/09/wal-mart-facial-recognition/.
[2] Id.
[3] Help Center: Tagging Photos, Facebook, https://www.facebook.com/help/122175507864081 (last visited Nov. 16, 2015).
[4] Robinson Meyer, Who Owns Your Face, The Atlantic (Jul. 2, 2015), http://www.theatlantic.com/technology/archive/2015/07/how-good-facial-recognition-technology-government-regulation/397289/.
[5] Id.
[6] Paul Gallagher, Download Festival: Facial Recognition Technology Used at Event Could be Coming to Festivals Nationwide, Independent (London, U.K.) (Sept. 24, 2015), http://www.independent.co.uk/news/uk/crime/download-festival-facial-recognition-technology-used-at-event-could-be-coming-to-festivals-10316922.html.
[7] Id.
[8] Tim Cushing, The FBI’s Facial Recognition Database Combines Lo-Res Photos with Zero Civil Liberties Considerations, techdirt (Apr. 15, 2014), https://www.techdirt.com/articles/20140414/16045126909/fbis-facial-recognition-database-combines-lo-res-photos-with-zero-civil-liberties-considerations.shtml.
[9] Meyer, supra note 4.
[10] Id.
[11] Roberts, supra note 1.
-
PRG News Roundup: November 11th
A court in Brussels decided on Monday that Facebook would no longer be able to collect and store personal information from Belgians who do not have a Facebook account; Facebook announced that it would appeal the ruling.
Link: Facebook to Appeal a Belgian Court’s Ruling on Data Privacy
Walmart experiments with facial recognition technology to spot potential thieves.
Link: Walmart’s Use of Sci-fi Tech to Spot Shoplifters Raises Privacy Concerns
Goethe-Institut New York to host symposium on “Images of Surveillance: The Politics, Economics, and Aesthetics of Surveillance Societies” December 4-6, 2015
Charges announced in “one of the biggest cyber crimes in history”.
Link: Charges Announced in J.P. Morgan Hacking Case
Data Transparency Lab to take place at MIT November 16-17, 2015
Judge Leon deems NSA bulk telephony metadata collection program unconstitutional.
Link: Judge Deals a Blow to N.S.A. Data Collection Program
Microsoft announces that it will offer its European customers to store their personal data in Germany, responding to privacy concerns.
Link: Microsoft Offers EU Customers Option to Store Data in Germany
-
PRG News Roundup: November 4th
Research by longtime PRG participant Luke Stark and Data & Society’s Alex Rosenblat about the on-demand economy in the context of Uber’s rideshare service is quoted in the Wall Street Journal:
Link to WSJ: At Uber, the Algorithm is More Controlling than the Real Boss
Link to SSRN article: Uber’s Drivers: Information Asymmetries and Control in Dynamic Work
Supreme Court hears Spokeo case: Is Digital Injury “Real” Injury? Thoughts on Spokeo v. Robins
UK passes controversial draft Investigatory Powers Bill: Surveillance Bill Triggers Alarm over Sweeping Powers for Spies
PRG’s own Scott Skinner-Thompson publishes article in Slate on a recent DOED decision on trans-inclusion in locker rooms: The Department of Education’s Common-Sense Approach to Transgender Inclusion
-
Industry Leaders Oppose CISA, Choosing User Privacy Over Liability Protection
The Cyber Security Information Act (CISA), which passed the Senate on Tuesday, allows businesses to hand over users’ information to the U.S. government when the business deems it a cyber “threat indicator.” Businesses have been reluctant to volunteer this information, fearing exposure to liability from affected users. CISA assuages that fear by granting immunity. Privacy advocates, like the EFF and Fight for the Future, are against CISA in part because it eases flow of consumer data to the Intelligence Community. More interesting is how private industry came down.
Tech giants, including Microsoft, Apple, and Twitter, publicly opposed its passage, (reversing their previous support, as discussed below). They claimed to oppose the bill out of respect for their users’ privacy. Yet under CISA, sharing is voluntary. A company can respect privacy by never sharing info that implicates a cyber threat. Opposition to the bill is more a message to consumers that they care about privacy interests in general. Some argue that sharing information about threat indicators is not, in fact, voluntary. The government has a history of attaching info-sharing requirements in roundabout ways. The competitive advantage that might come with participating in the program may also make sharing effectively necessary. That remains to be seen.
The fact that companies felt it was in their interest to voice opposition, instead of supporting a bill that would grant them greater immunity from liability, suggests that letting customers know they care about privacy is becoming better and better business. In fact, Microsoft, Apple and Salesforce previously supported CISA, and only changed positions after advocacy and consumer rights groups petitioned them to reconsider. According to Fight for the Future’s scorecard, many tech companies, including AT&T and Verizon, still support CISA. They likely weighed liability protection more heavily.
If a company wants to protect its users’ information after the passage of CISA, it can simply refrain from sharing info with the state, (according to how the bill is advertised in its current form). Yet many companies felt it necessary to show their support for privacy rights in general by opposing the bill. What’s more, they took this stance when it meant losing better liability protections. The market value of being Tough on Behalf of Privacy is increasing.
-
PRG News Roundup: October 28th
Judge Says Man Had Right to Shoot Down Drone Invading His Privacy
CISA Passes Senate
Link: http://www.dailydot.com/politics/cisa-senate-passage-cybersecurity-information-sharing-act-congress/
Librarian of Congress Renews and Expands DMCA Exemptions
ACLU Appeals Decision Upholding School Bathroom Ban on TransGender Student.
“Privacy.com” Startup Aims to Facilitate Consumer Experience Online in More Protected Way
Facebook Messenger Wants to Act As Your Phone Number
Link: http://techcrunch.com/2015/10/27/facebook-message-requests/