Phishing normally gives access only to the account phished. In this case it seems the cables are general ‘status reports’ distributed to all EU diplomatic offices as background.

https://www.securityweek.com/thousands-eu-diplomatic-cables-hacked-report

'Thousands' of EU Diplomatic Cables Hacked: Report

The cables from the EU's diplomatic missions around the world reveal anxiety about how to handle US President Donald Trump as well as concerns about China, Russia and Iran.

… There are extensive reports on the situation in Ukraine, where a conflict rumbles on between government forces and pro-Russian separatists, including a warning dating from February that Moscow may already have deployed nuclear warheads in Crimea, which it annexed in 2014.

The NYT said that according to Area 1, the techniques used by the hackers over the course of three years were similar to those used by an elite Chinese military unit.

The hackers apparently gained access to the diplomatic communications network after a simple "phishing" campaign targeting EU officials in Cyprus.

There must be money here.

https://venturebeat.com/2018/12/18/truecaller-spam-calls-jumped-over-300-in-2018/

Truecaller: Spam calls jumped over 300% in 2018

I suspect this is a re-hash of the September GAO report.

https://www.schneier.com/blog/archives/2018/12/congressional_r.html

Congressional Report on the 2017 Equifax Data Breach

The US House of Representatives Committee on Oversight and Government Reform has just released a comprehensive report on the 2017 Equifax hack. It's a great piece of writing, with a detailed timeline, root cause analysis, and lessons learned. Lance Spitzner also commented on this.

Here is my testimony before before the House Subcommittee on Digital Commerce and Consumer Protection last November.

[The earlier report is available at: https://www.gao.gov/assets/700/694158.pdf

What can you do when even your toaster turns on you?

https://www.theatlantic.com/family/archive/2018/12/smart-home-devices-data-privacy/578425/?utm_source=feed

The Coming Commodification of Life at Home

As internet-connected devices and appliances accumulate, one academic foresees “the monetization of every move you make.”

“Imagine this,” says an advertising consultant named Barry Lowenthal. “I’m a smart toaster, and I’m collecting data on how many times the toaster is used.”

I’ve just asked Lowenthal what he, as an advertiser, would be able to do with data transmitted from an internet-connected appliance, and I happened to mention a toaster. He thought through the possibility of an appliance that can detect what it’s being asked to brown: “If I’m toasting rye bread, a bagel company might be interested in knowing that, because they can re-target that household with bagel advertising because they already know it’s a household that eats bread, toasts bread, is open to carbs. Maybe they would also be open to bagels. And then they can probably cross that with credit-card data and know that this is a household that hasn’t bought bagels in the last year. I mean, it’s going to be amazing, from a targeting perspective.”

Is it easier to sell cameras that make you look better? Is it wise to sell cameras that modify every image? Is there any way to see the unfiltered image? Will the change be enough to fool facial recognition tools?

https://www.theatlantic.com/technology/archive/2018/12/your-iphone-selfies-dont-look-like-your-face/578353/?utm_source=feed

No, You Don’t Really Look Like That

… Over weeks of taking photos with the device, I realized that the camera had crossed a threshold between photograph and fauxtograph. I wasn’t so much “taking pictures” as the phone was synthesizing them.

This isn’t a totally new phenomenon: Every digital camera uses algorithms to transform the different wavelengths of light that hit its sensor into an actual image. People have always sought out good light. In the smartphone era, apps from Snapchat to FaceApp to Beauty Plus have offered to upgrade your face. Other phones have a flaw-eliminating “beauty mode” you can turn on or off, too. What makes the iPhone XS’s skin-smoothing remarkable is that it is simply the default for the camera. Snap a selfie, and that’s what you get.

These images are not fake, exactly. But they are also not pictures as they were understood in the days before you took photographs with a computer.

Something to think about.

Case Study: Should a Direct-to-Consumer Company Start Selling on Amazon?

According to the yearly report published by Stockholm-based phone number-identification service Truecaller, spam calls grew by 300 percent year-over-year in 2018.

… Between January and October of this year, Truecaller said, users worldwide received about 17.7 billion spam calls. That’s up from some 5.5 billion spam calls they received last year.

… One in every 10 American adults lost money from a phone scam, according to a yearly report the firm published in April this year (Truecaller worked with the Harris Poll to survey over 2,000 Americans aged 18 or higher). Scam calls cost 24.9 million people in the U.S. an estimated $8.9 billion in total losses.

I don’t understand “mindfulness” in this context. Rage is certainly not compatible with mindfulness.

https://www.bespacific.com/mass-shootings-and-mindfulness/

Mass Shootings and Mindfulness

WhoWhatWhy: “As of December 16, 2018, there had been 333 mass shootings so far this year, or almost one a day, according to the Gun Violence Archive (which defines a mass shooting as having four or more victims, killed or injured). You have to wonder why so many young men (almost always) see this as the best option for their lives. What are their actions telling us? Why do they want out?

…Murder rates are generally down in America, but mass shootings are up. The latter crimes, unlike most others, are not about personal gain or revenge against an individual. They’re not done by serial killers, who often take lives for sport. They’re not crimes of passion, where the attacker knows the victim. They’re social crimes, intended to harm the entire culture, carried out by those who feel powerless and an extreme sense of victimization, yet many of the shooters come from reasonably good economic circumstances. They’re about indiscriminate rage and the desire to inflict extreme pain on as many people as possible, while sacrificing their own life in the process. The best analogy is combat…”

Lists make my life easier. For books, if I find one that seems interesting I just ask my library to find it for me. Free and simple.

https://teachprivacy.com/notable-privacy-and-security-books-2018/

Notable Privacy and Security Books 2018

Here are some notable books on privacy and security from 2018. To see a more comprehensive list of nonfiction works about privacy and security, Professor Paul Schwartz and I maintain a resource page on Nonfiction Privacy + Security Books.

Interesting enough to share with my Computer Security students.

https://www.schneier.com/blog/archives/2018/12/teaching_cybers.html

Teaching Cybersecurity Policy

Peter Swire proposes a a pedagogic framework for teaching cybersecurity policy. Specifically, he makes real the old joke about adding levels to the OSI networking stack: an organizational layer, a government layer, and an international layer.

A lesson for my Software Architecture students: This is not changing one function, this is changing the entire design strategy.

https://www.recode.net/2018/12/17/18140062/facebook-clear-history-update-privacy-targeting-data-collection

Facebook still hasn’t launched a big privacy feature that Mark Zuckerberg promised more than seven months ago

Back in May, at the height of Facebook’s Cambridge Analytica privacy scandal, the company made a timely announcement: Facebook users would soon be able to clear the browsing history connected to their Facebook profile, meaning that the company would no longer link users to the apps and websites they visited off of the social network.

The product, called “Clear History,” got a lot of attention. Not only is browsing data important — Facebook uses it to target people with advertising — but CEO Mark Zuckerberg announced Clear History himself during Facebook’s annual developer conference. Clear History was an olive branch meant to show everyone how serious Facebook is about privacy.

… As it turns out, clearing your browser history was harder to implement than Facebook expected. It’s been more than seven months since Zuckerberg’s announcement and Facebook hasn’t mentioned Clear History since.

Facebook’s Chief Privacy Officer Erin Egan said at that time that it would take “a few months” to build. Now Facebook tells Recode it won’t be ready for several more months.

Okay, the reports are out.

https://www.huffingtonpost.com/entry/russia-social-media-senate-reports-2016-election-interference-trump_us_5c17d42ee4b030ed3ecffe27

Russian Social Media Amassed Millions Of Followers In Support Of Trump: Reports

New reports commissioned by the Senate detail the scope of Russian interference in the 2016 elections.

… The first report ― created by Oxford University’s Computational Propaganda Project and Graphika, a network analysis firm ― shows how a Russian company called the Internet Research Agency created thousands of accounts and “launched an extended attack on the United States” election by polarizing American politics and boosting Donald Trump’s campaign, according to The Washington Post. https://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2018/12/IRA-Report-2018.pdf

… A second report by New Knowledge, a cybersecurity company based in Austin, Texas, focused on which groups were targeted and how.

For my Computer Security students? What would the parrot have said? “Polly wanna kettle?”

https://www.wfla.com/news/viral-news/sneaky-parrot-uses-amazon-alexa-to-shop-while-owner-is-away/1662596515

Sneaky parrot uses Amazon Alexa to shop while owner is away

A foul-mouthed parrot, who was kicked out of an animal sanctuary for swearing too much, is using technology to cause even more trouble.

The Times of London reports Rocco, an African grey, has been using Amazon Alexa to shop online while his owner was away.

His owner, Marion Wishnewski told the newspaper she was shocked to find that her Amazon account suddenly had pending orders for various snacks, including watermelon and ice cream and also a kettle.

Sure, blame the poor humans.

https://www.bbc.com/news/technology-46593190

Kiwibot delivery robot catches fire after 'human error'

Kiwibot autonomous delivery robots have been rolling around the University of California, Berkeley campus for two years.

On Friday, students found one of the robots in flames and shared photos on social media.

Kiwi said the cause was a "defective battery" that had been accidentally installed in the robot.

Suggests a test question: How do you fix this?

https://www.slashgear.com/android-phones-face-recognition-fooled-by-3d-printed-head-report-says-17558123/

Android phones’ face recognition fooled by 3D printed head, report says

… We’ll cut down to the chase. The iPhone X was the only one that was not unlocked by a fake head that was carefully scanned from its owner, manually tweaked, and then printed in the UK. The ghastly appearance and lifeless eyes may have clued Face ID in on the hoax.

Awards lists (“Best of” lists) are a good way to find things I missed.

https://fpf.org/2018/12/17/this-years-must-read-privacy-papers-the-future-of-privacy-forum-announces-recipients-of-annual-privacy-papers-for-policymakers-award/

This Year’s Must-Read Privacy Papers: The Future of Privacy Forum Announces Recipients of Annual Privacy Papers for Policymakers Award

Today, the Future of Privacy Forum announced the winners of the 9th Annual Privacy Papers for Policymakers Award. The PPPM Award recognizes leading privacy scholarship that is relevant to policymakers in the U.S. Congress, at U.S. federal agencies, and for data protection authorities abroad. The winners of the 2018 PPPM Award are:

I await the reports…

https://www.bespacific.com/new-report-on-russian-disinformation-prepared-for-the-senate-shows-operations-scale-and-sweep/

New report on Russian disinformation, prepared for the Senate, shows operation’s scale and sweep

Washington Post: “A report prepared for the Senate that provides the most sweeping analysis yet of Russia’s disinformation campaign around the 2016 election found the operation used every major social media platform to deliver words, images and videos tailored to voters’ interests to help elect President Trump — and worked even harder to support him while in office. The report, a draft of which was obtained by The Washington Post, is the first to study the millions of posts provided by major technology firms to the Senate Intelligence Committee, led by Sen. Richard Burr (R-N.C.), its chairman, and Sen. Mark Warner (Va.), its ranking Democrat. The bipartisan panel hasn’t said whether it endorses the findings. It plans to release it publicly along with another study later this week.

The research — by Oxford University’s Computational Propaganda Project and Graphika, a network analysis firm — offers new details of how Russians working at the Internet Research Agency, which U.S. officials have charged with criminal offenses for meddling in the 2016 campaign, sliced Americans into key interest groups for targeted messaging. These efforts shifted over time, peaking at key political moments, such as presidential debates or party conventions, the report found. The data sets used by the researchers were provided by Facebook, Twitter and Google and covered several years up to mid-2017, when the social media companies cracked down on the known Russian accounts. The report, which also analyzed data separately provided to House Intelligence Committee members, contains no information on more recent political moments, such as November’s midterm elections.

“What is clear is that all of the messaging clearly sought to benefit the Republican Party — and specifically Donald Trump,” the report says. “Trump is mentioned most in campaigns targeting conservatives and right-wing voters, where the messaging encouraged these groups to support his campaign. The main groups that could challenge Trump were then provided messaging that sought to confuse, distract and ultimately discourage members from voting.”

Something to ‘amuse’ my students?

https://www.youtube.com/watch?v=3JgcbtxURA4

Why You Don't Own Your Tech

Think they heard us laughing? Perhaps they noticed voters changing party? No! It was the FCC, doing something for other (completely political) reasons.

https://fox8.com/2018/12/17/california-abandons-plans-to-tax-text-messages/

California abandons plans to tax text messages

… California regulators were hoping to tax text messages, until a recent ruling from the FCC.

The FCC says text messages are an "information service" - not a "telecommunications service."

For my Computer Security and Software Architecture students.

The Deadly Recklessness of the Self-Driving Car Industry

Autonomous vehicles were supposed to make driving safer, and they may yet—some of the more optimistic research indicates self-driving cars could save tens of thousands of lives a year in the U.S. alone. But so far, a recklessness has defined the culture of the largest companies pursuing the technology—Uber, Google, and arguably even Tesla—and has led directly to unnecessary crashes, injury, even death.

Perspective.

https://www.washingtonpost.com/opinions/2018/12/13/indians-are-reshaping-internet/?noredirect=on&utm_term=.068298c35428

Opinion | Indians are reshaping the Internet

… This is part of a striking trend: Indians are an increasing powerful presence online. Even with an Internet penetration rate of less than 30 percent, India is the largest market for WhatsApp and its parent company, Facebook. It ranks third by users on Instagram and fourth on Twitter, according to eMarketer, a research firm. Four of Tinder’s top 10 cities by paying users are in India. And 1 in 10 Uber rides globally occurs in India, a proportion that is set to grow.

Tech leaders look at these statistics with cartoon dollar signs on their eyes. India was the only country to get its own section in the “recent milestones” section of Amazon founder and chief executive Jeffrey P. Bezos’s letter to shareholders this year. (Bezos also owns The Post.) And Sundar Pichai, the Indian-born chief executive of Google, has mentioned India in six out of the company’s last seven earnings calls. The investment bank Morgan Stanley expects smartphone penetration to more than double between 2017 and 2020.

… But for years, data prices remained high and growth slow. That changed in September 2016, with the launch of Jio, a mobile network offering low-cost, high-speed data. Other networks scrambled to compete, offering ever-greater data allowances at lower prices. The effect is startling: Mobile Internet connections grew from 346 million in late 2016 to 491 million this year, according to India’s telecoms regulator. In the same period, monthly data consumption jumped by a factor of more than 13, to 3.2 gigabytes per user.

As Indians come online in the hundreds of millions, the first thing they do is connect with their friends on WhatsApp and Facebook. They then stream Bollywood movies and pornography. Lots of pornography. Searches for “Hindi sexy film” on PornHub grew 27,814 percent in 2018.

This is way out of my comfort zone, but it caught my eye. Interesting (or strange) my library offers this as an Audio book or an eBook, but not in print.

https://techcrunch.com/2018/12/08/the-nation-state-of-the-internet/

The nation-state of the internet

The internet is a community, but can it be a nation-state?

… That question led me to Imagined Communities, a book from 1983 and one of the most lauded (and debated) social science works ever published. Certainly it is among the most heavily cited: Google Scholar pegs it at almost 93,000 citations.

… Anderson’s answer is his title: people come to form nations when they can imagine their community and the values and people it holds, and thus can demarcate the borders (physical and cognitive) of who is a member of that hypothetical club and who is not.

I wonder if Dilbert teaches...

https://dilbert.com/strip/2018-12-16

The stalkers already know what she looks like. Is turnabout fair play?

Surveillance fears grow after Taylor Swift uses face recognition tech on fans

Gabrielle Canon reports:

Taylor Swift secretly surveilling her fans using facial recognition technology might sound like science fiction – but Rolling Stone reported on Thursdaythat the pop star has been doing exactly that in an effort to root out stalkers.

Swift has stayed silent on the report, declining to comment to the Guardian and other news organizations. But the episode has raised ethical questions for civil rights groups concerned about privacy.

“Stalkers are a generally scary phenomenon and everyone understands why someone like Taylor Swift would want to be protected against them,” says Jay Stanley, the American Civil Liberties Union’s (ACLU) senior policy analyst. “But this does have larger implications. It is not about this one deployment, it is about where this is technology is headed.”

Read more on The Guardian.

(Related) The technology is cheap and easily available. Why wouldn’t they use it?

https://taskandpurpose.com/taliban-drone-surveillance-afghanistan/

The Taliban Are Watching US Troops With Drones '24/7' In Afghanistan

… During an October showcase of counter-drone directed energy weapons at the White Sands Missile Range in New Mexico, Air Force Research Laboratory official Tom Lockhart revealed that the Taliban and various insurgent groups that are battling for control of the country are aggressively utilizing unmanned aircraft to keep an eye on Resolute Support personnel.

Porn has always been an early adopter, not surprising that Big Data and Data Analytics are also being adopted.

https://qz.com/1407235/porn-sites-collect-more-user-data-than-netflix-or-hulu-this-is-what-they-do-with-it/

Porn sites collect more user data than Netflix or Hulu. This is what they do with it.

The biggest and perhaps best source of data about what people like to watch on the internet and what they would pay for doesn’t come from streaming giants like Netflix, Amazon Prime Video, or Hulu. It comes from porn.

While consuming porn is typically a private and personal affair, porn sites still track your every move: What content you choose, which moments you pause, which parts you repeat. By mining this data to a deeper degree than other streaming services, many porn sites are able to give internet users exactly what they want—and they want a lot of it.

There are 125 million daily visits to the Pornhub Network of sites, including YouPorn and Redtube, and 100 million of those are to Pornhub alone. (It’s widely acknowledged that Pornhub is the most popular porn site in the world although exact statistics on the industry are few and far between.) To put into perspective how much content that is: In 2017, Pornhub transmitted more than the entire contents of the New York Public Library’s 50 million books combined.

... MindGeek is the world’s biggest porn company—more specifically, it’s a holding company that owns numerous adult entertainment sites and production companies, including the Pornhub Network.

… MindGeek, whose bandwidth use exceeds that of Facebook or Amazon, began as a company named Mansef, founded by Stephane Manos and Ouissam Youssef in 2004. It was bought by tech entrepreneur Fabian Thylmann in 2010, re-named Manwin, then MindGeek, and now runs a near-monopoly of streaming porn sites.

What would it take for this to happen in Brazil, Mexico, or the US?

https://www.wired.com/story/how-whatsapp-fuels-fake-news-and-violence-in-india/

How WhatsApp Fuels Fake News and Violence in India

In India, WhatsApp is a major channel for false reporting and hate speech that sometimes fuels mob violence and gruesome murders. Police say they can’t track the encrypted messages to find culprits. And the government is demanding change.

… The five male victims in Rainpada were part of a string of killings that took place over the late spring and summer linked to messages spread on WhatsApp, the Facebook-owned encrypted messaging platform. Police and government officials estimate that more than two dozen people have been killed by mobs, though no official tally is being kept. IndiaSpend, a data journalism outlet, pegs the figure at 33 killed in 69 incidents of mob violence between January 2017 and July 2018.

… The Indian government has cast much of the blame for these killings on WhatsApp. In August and again in late October, the government asked the company for the ability to stop and trace problematic messages, a demand that would short-circuit the encrypted security that is central to the app’s popularity. At the same time, critics of the government accuse it of using the platform as a convenient scapegoat while failing to sufficiently address underlying issues of intolerance, weak policing, caste divides, and nationalist rhetoric that has fueled violence again and again.

For every ‘Oops!,’ a ‘Gotcha?’

https://www.independent.ie/business/technology/news/facebook-faces-billioneuro-fine-as-irish-data-protection-commissioner-opens-fresh-investigation-into-photo-leak-37627547.html

Facebook faces billion-euro fine as Irish data protection commissioner opens fresh investigation into photo leak - Independent.ie

Facebook is potentially facing huge fines from Ireland’s data protection commissioner, who has announced a fresh investigation into the social media giant.

The move comes after Facebook admitted another privacy error, possibly affecting 7m people. The bug may have allowed up to 1,500 apps get access to private photos held by users on the social site.

Facebook is already facing an official probe from the Irish data watchdog for a previous privacy leak in September, which the company said may have affected 30m people.

… The Irish data authority now has at least two serious investigations underway into Facebook, with 14 more also being undertaken against other tech multinationals. Because so many big tech companies choose Ireland as their European or global headquarters, the Irish data authority is responsible for investigating when there is a problem.

An interesting perspective.

https://sloanreview.mit.edu/article/the-machine-learning-race-is-really-a-data-race/

The Machine Learning Race Is Really a Data Race

… Machine learning — or artificial intelligence, if you prefer — is already becoming a commodity. Companies racing to simultaneously define and implement machine learning are finding, to their surprise, that implementing the algorithms used to make machines intelligent about a data set or problem is the easy part. There is a robust cohort of plug-and-play solutions to painlessly accomplish the heavy programmatic lifting, from the open-source machine learning framework of Google’s TensorFlow to Microsoft’s Azure Machine Learning and Amazon’s SageMaker.

What’s not becoming commoditized, though, is data. Instead, data is emerging as the key differentiator in the machine learning race. This is because good data is uncommon.

… today’s most valuable companies trade in software and networks, not just physical goods and capital assets. Over the past 40 years, the asset focus has completely flipped, from the market being dominated by 83% tangible assets in 1975 to 84% intangible assets in 2015. Instead of manufacturing coffeepots and selling washing machines, today’s corporate giants offer apps and connect people. This shift has created a drastic mismatch between what we measure and what actually drives value.

Worth reading.

http://knowledge.wharton.upenn.edu/article/searching-google-lessons-ceo-sundar-pichais-congressional-testimony/

Searching Google: Lessons from Sundar Pichai’s Congressional Testimony

… “The big takeaway is that trust is the currency of this generation of innovation,” notes Andrea Matwyshyn, professor of law at Northeastern University and an expert on information security and consumer privacy. She believes that while data may have been the driver of the last decade of building out new companies, “the challenge that exists now relates to maintaining the engagement of companies, products and services with the consumer base, and that is going to be driven by trust.”

This reads like a procedure problem. Sending money based on one email is not the way it should work.

https://www.bostonglobe.com/business/2018/12/12/hackers-fooled-save-children-into-sending-million-phony-account/KPnRi8xIbPGuhGZaFmlhRP/story.html

Hackers fooled Save the Children into sending $1 million to a phony account

Save the Children Federation, one of the country’s best-known charities, said it was the victim of a $1 million cyberscam last year.

The Connecticut-based nonprofit said hackers broke into a worker’s e-mail, posed as an employee, and created false invoices and other documents, to fool the charity into sending nearly $1 million to a fraudulent entity in Japan. The con artists claimed the money was needed to purchase solar panels for health centers in Pakistan, where Save the Children has worked for more than 30 years.

… Sandy Ross, an accountant and fraud examiner, said that most large nonprofits and businesses have procedures to prevent such scams, such as having a second person sign off on significant wire transfers and calling the recipient to verify the account numbers. In all but one instance Ross could recall, she said, the attacks have “been thwarted.”

… Save the Children Federation, also known as Save the Children US, has since adopted similar measures, including making sure someone confirms all new vendors and bank account instructions via phone, as well as strengthening its technology systems

There is talk that China is gathering (all kinds of) information on everyone, everywhere. If that is so, consider what they could do with it.

Personal information of 541k individuals has been stolen from an emergency contact database after the website of the French Ministry of Europe breached

Sergiu Gatlan reports:

According to the Ministry’s public statement, the hackers managed to get their hands on the names, phone numbers, and email addresses of all people who had an account on the French Ariane emergency contact database.

The platform is used by the French Ministry of Europe and Foreign Affairs to allow citizens traveling abroad to receive security updates in case of emergency.

“Personal data recorded during registration on the Ariane platform have been stolen,” says the Ministry’s statement.

Read more on Softpedia.

[From the article:

"As soon as we became aware of this attack, we put in place measures, technically to prevent any further intrusions of this type," added the Ministry.

Investigating the Twits?

https://techcrunch.com/2018/12/13/twitter-governments-data-demands-transparency/

Twitter says governments are ramping up their demands for user data

… According to the newly released data, Twitter received 6,904 government requests for information on 16,882 accounts. Twitter turned over at least some data in 56 percent of cases.

The U.S. took the lead with 2,231 requests for information on 9,226 accounts — representing about one-third of all Twitter’s demands for the first-half of the year, with Japan and the U.K. falling behind in second and third place.

What was this about? What would have happened if someone refused to leave the plane? Did DHS think San Francisco was in another country?

Federal judge denies dismissal of suit against DHS

Last October, the ACLU filed suit after an incident that still boggles my mind. As Cecilia Wang of the ACLU described the background at the time:

On February 22, 2017, Delta Airlines Flight 1583 departed San Francisco and headed for John F. Kennedy Airport in New York. As the plane was landing, passengers heard a strange announcement.

Speaking over the intercom, a flight attendant announced that everyone would have to show their documents in order to get off the plane. After passengers expressed their consternation, the flight attendant repeated her announcement, stating that officers would be meeting the plane and every passenger would have to show government-issued ID to deplane.

The case, Amadei v. Duke, was filed in Eastern District New York (Duke’s the Acting Secretary of Homeland Security). The government is not having an easy time trying to get this case dismissed. The docket for yesterday shows:

MEMORANDUM & ORDER, For the foregoing reasons, Defendants’ motion to dismiss (Dkt. 32) is DENIED. Defendants’ motion to dismiss Plaintiffs’ APA claim is DENIED. Defendants’ motion to stay discovery pending a decision on Defendants’ motion to dismiss (Dkt. 70) is DENIED as moot. So Ordered by Judge Nicholas G. Garaufis on 12/13/2018. (Lee, Tiffeny) (Entered: 12/13/2018)

I’ve uploaded the memorandum and order, below.

Perspective. A new world for my students to explore.

https://www.cpomagazine.com/2018/12/14/internet-of-bodies-the-privacy-and-security-implications/

Internet of Bodies: The Privacy and Security Implications - CPO Magazine

… Over the past few years, technological advances in healthcare and medicine have combined with advances in AI to create a brave new world that some have called the “Internet of Bodies.” Instead of simply hooking up digital devices and connected objects to the Internet, as with the Internet of Things, we are now hooking up human bodies to the Internet.

With the Internet of Bodies, connected devices from tech companies are now being implanted, ingested and affixed to the human body in ways never before imagined. And these connected devices are simultaneously generating tremendous amounts of data about our behaviors, our physiology, and even our DNA. Examples of Internet of Bodies innovations include smart contact lenses that are able to monitor glucose levels, artificial lenses used to correct vision, Bluetooth-equipped electronic pills, digital tattoos, and even Fitbit devices that monitor and analyze very intimate profiles of your health and physiological functions.

… Imagine being turned down for healthcare coverage because an AI system detected certain warning signs in all of your biometric or physiological data, or being required by the state to undergo behavioral modification training for committing a “health crime.”

Perspective.

https://www.bespacific.com/more-americans-are-making-no-weekly-purchases-with-cash/

More Americans are making no weekly purchases with cash

“Americans are becoming less reliant on physical currency. Roughly three-in-ten U.S. adults (29%) say they make no purchases using cash during a typical week, up slightly from 24% in 2015. And the share who say that all or almost all of their weekly purchases are made using cash has modestly decreased, from 24% in 2015 to 18% today, according to a new Pew Research Center survey that comes as some businesses experiment with becoming cashless establishments. Demographic patterns in the new survey, which was conducted in September and October, are similar to those in a 2015 survey by the Center. Most notably, adults with an annual household income of $75,000 or more are more than twice as likely as those earning less than $30,000 a year to say they do not make any purchases using cash in a typical week (41% vs. 18%). Conversely, lower-income Americans are about four times as likely as higher-income Americans to say they make all or almost all of their purchases using cash (29% vs. 7%)…

Let’s hope police departments mention this to their officers. Government officials? Fend for yourselves.
Federal judge rules Mass. law prohibiting secret audio recording of police, government officials is unconstitutional
Joe Cadillic sends along this report by Noah R. Bombard:

A federal court judge Monday ruled a Massachusetts General Law prohibiting the secret audio recording of police or government officials is unconstitutional.

Chief United States District Judge Patti B. Saris made the ruling on two similar cases — one involving two Jamaica Plain residents who frequently record police officers and a second case involving Project Veritas, the undercover organization founded by conservative political activist James O’Keefe.

Read more on MassLive while I do a little happy dance.
[From the article:
In the 44-page decision Saris declared that "secret audio recording of government officials, including law enforcement officials, performing their duties in public is protected by the First Amendment, subject only to reasonable time, place and manner restrictions."
… "both have stated that their desire to record secretly stems from a fear that doing so openly will endanger their safety and provoke hostility from officers."






More details on the arguments please.
https://www.theregister.co.uk/2018/12/12/human_rights_groups_appeal_echr_decision/
Bulk surveillance is always bad, say human rights orgs appealing against top Euro court
A band of human rights organisations have appealed against a top European court's ruling on bulk surveillance, arguing that any form of mass spying breaches rights to privacy and free expression.
… That ruling said oversight of the UK government's historic regime for bulk interception of communication was insufficient and violated privacy rights under the European convention.
However, it did not say that bulk interception was unlawful in and of itself; neither did it rule that sharing information with foreign governments breached the rules.
It is these elements of the ruling that the groups disagree with, arguing that bulk surveillance can never be lawful, and that the sharing intelligence with other governments is just another form of bulk surveillance and also unlawful.






This won’t go anywhere, it doesn’t have a cutesy acronym.
Federal data privacy bill introduced by 15 US senators
Laura Hautala reports:

The US doesn’t have a single data privacy law that applies to all fifty states. On Wednesday, a group of 15 US senators indicated it wanted to change the status quo, introducing the Data Care Act.

The bill (PDF) would require companies that collect personal data from users to take reasonable steps to safeguard the information. The act also has provisions to prevent them from using the data in ways that could harm consumers.

If the bill becomes law, the US Federal Trade Commission would be in charge of implementing it.

“People have a basic expectation that the personal information they provide to websites and apps is well-protected and won’t be used against them,” Sen. Brian Schatz, a Democrat from Hawaii who is sponsoring the bill, said in a press release.

Read more on CNET.






Is it war yet? Is there a line that China (or others) must not cross? I don’t have a clear vision of that line, if it exists.
https://www.washingtonexaminer.com/policy/defense-national-security/fbi-china-threatens-the-future-of-the-world
FBI: China threatens 'the future of the world’
Chinese spying threatens “not just the future of the United States, but the future of the world,” a senior FBI official told lawmakers Wednesday.
“We are being exploited by China, so we are right to shore up our defenses against this,” E.W. Priestap, assistant director of the FBI’s Counterintelligence Division, told the Senate Judiciary Committee.
… His warning echoed the assessment offered by a senior CIA official in July. “At the end of the day, the Chinese fundamentally seek to replace the United States as the leading power in the world,” Michael Collins, the CIA’s deputy assistant director for the East Asia Mission Center, said during the Aspen Security Forum. “What they're waging against us is fundamentally a cold war.”






“Hey! Here’s something we haven’t taxed yet!” (But if they drop the line for TEXT on the bill, no tax?)
https://www.cnn.com/2018/12/12/tech/california-text-tax/index.html
California proposes a plan to tax text messages
… A new surcharge proposed by the California Public Utilities Commission (CPUC) wouldn't be a per-text tax, but a monthly fee based on a cellular bill that includes any fees for text-message services. Most carriers offer a flat fee option for texting, and already charge a similar fee for other services included in the bill — such as phone calls. The exact structure of the charge would vary from carrier to carrier.



(Related) Wouldn’t Google just buy/create their own ISP?
https://arstechnica.com/tech-policy/2018/12/fcc-panel-wants-to-tax-internet-using-businesses-and-give-the-money-to-isps/
FCC panel wants to tax Internet-using businesses and give the money to ISPs
… If adopted by states, the recommended tax would apply to subscription-based retail services that require Internet access, such as Netflix, and to advertising-supported services that use the Internet, such as Google and Facebook. The tax would also apply to any small- or medium-sized business that charges subscription fees for online services or uses online advertising. The tax would also apply to any provider of broadband access, such as cable or wireless operators.

Is this all that Congress has learned?

https://www.securityweek.com/house-releases-cybersecurity-strategies-report

House Releases Cybersecurity Strategies Report

The U.S. House of Representatives’ Committee on Energy and Commerce has released a report identifying strategies for the prevention and mitigation of cybersecurity incidents.

Designed to summarize the work of the Subcommittee on Oversight and Investigations, the report (PDF) includes conclusions drawn from tens of briefings, hearings, letters, reports, and roundtables.

For my Computer Security students.

https://www.securityweek.com/organizations-still-slow-detect-breaches-crowdstrike

Organizations Still Slow to Detect Breaches: CrowdStrike

Organizations are getting better at detecting intrusions on their own, but it still takes them a long time to do it, according to a new report published on Tuesday by endpoint security firm CrowdStrike.

… the average attack dwell time – or the time it takes to detect an attack – was 85 days, comparable to the 86 days reported by the company in its 2017 report.

“Clearly, there is considerable room for improvement. Boards of directors, executive management, and the public at large are all rightly concerned that organizations take days, weeks or even months to detect attacks,” CrowdStrike said in its latest report.

(Related)

https://www.bespacific.com/cybersecurity-of-the-person/

Cybersecurity of the Person

Kosseff, Jeff, Cybersecurity of the Person (October 31, 2018). First Amendment Law Review, 2019. Available at SSRN: https://ssrn.com/abstract=3276218

“U.S. cybersecurity law is largely an outgrowth of the early-aughts concerns over identity theft and financial fraud. Cybersecurity laws focus on protecting identifiers such as driver’s licenses and social security numbers, and financial data such as credit card numbers. Federal and state laws require companies to protect this data and notify individuals when it is breached, and impose civil and criminal liability on hackers who steal or damage this data. In this paper, I argue that our current cybersecurity laws are too narrowly focused on financial harms. While such concerns remain valid, they are only one part of the cybersecurity challenge that our nation faces. Too often overlooked by the cybersecurity profession are the harms to individuals, such as revenge pornography and online harassment. Our legal system typically addresses these harms through retrospective criminal prosecution and civil litigation, both of which face significant limits. Accounting for such harms in our conception of cybersecurity will help to better align our laws with these threats and reduce the likelihood of the harms occurring.”

If you place cookies, you need to understand this.

https://www.cpomagazine.com/2018/12/12/how-big-companies-should-behave-under-europes-new-cookie-regulations/

How Big Companies Should Behave Under Europe’s New Cookie Regulations

… Under the GDPR, implied consent is not enough and instead customers must actively affirm that they agree to the use of cookies. That means that companies can no longer claim that using its website constitutes consumer consent. Rather, websites must provide accurate information – in plain language – specifying exactly what a company’s cookie policy is. The GDPR also grants users the right to retract their consent and every 12 months corporations must obtain renewed consent from customers to keep using cookies for the same purposes.

It’s not important that they don’t know. What is important is, they don’t bother to find out!

https://mashable.com/article/google-hearing-congress-no-idea-about-internet-search/#TPNJVB0qXSq5

At the Google hearing, Congress proves they still have no idea how the internet works

Google CEO Sundar Pichai’s long-awaited Congressional hearing took place on Tuesday.

Pichai testified before Congress on Google+ data breaches, the controversial Chinese-censorship friendly search product, and perceived anti-conservative bias. But, there was one more pressing concern that took center stage to those watching the hearing: Several members of Congress, at least on the House Judiciary Committee, have no idea what they’re talking about when it comes to technology.

… Rep. Lamar Smith claimed as fact that 96 percent of Google search results come from liberal sources. Besides being proven false with a simple search of your own, Google’s search algorithm bases search rankings on attributes such as backlinks and domain authority. Partisanship of the news outlet does not come into play. Smith asserted that he believe the results are being manipulated, regardless of being told otherwise.

… When Iowa Rep. Steve King demanded to know why a nasty image of the Congressman would appear on his granddaughter’s phone while she was playing a game, Pichai had to point out that Google doesn’t make the iPhone. King’s response? It could have been an Android!

For my student researchers. (Remember, the page is not the article.)

https://www.bespacific.com/how-to-find-out-when-a-webpage-was-published/

How to Find Out When a Webpage Was Published

maketecheasier: “When you’re doing research on a topic, it’s vital to ensure your sources are up to date. If you’re writing an academic paper, dates of publication are often required in the citations. The majority of the time, getting the date is easy: simply look on the site and find the “published on” date to find out how recent it was. Things get a little more complicated when there is no date listed on the webpage. When this happens, how do you know when the page was published?…”

A very very small portion of Google’s users.

https://www.cnn.com/2018/12/10/tech/google-plus-bug/index.html

Google says Google+ bug affected 52.5 million people

Google will shut down its Google+ social network much sooner than planned after discovering a second bug that revealed millions of customers' private information to software developers.

In a blog post, the company said 52.5 million people were affected by a bug in a November software update. The latest bug allowed app developers to access profile information not marked public. App developers inadvertently had access to this data for six days.

You might want to send this article to “your leaders.” Or at least your Accounts Payable department.

https://krebsonsecurity.com/2018/12/how-internet-savvy-are-your-leaders/

How Internet Savvy are Your Leaders?

Back in April 2015, I tweeted about receiving a letter via snail mail suggesting the search engine rankings for a domain registered in my name would suffer if I didn’t pay a bill for some kind of dubious-looking service I’d never heard of. But it wasn’t until the past week that it become clear how many organizations — including towns, cities and political campaigns — actually have fallen for this brazen scam.

… According to a statement filed with the Federal Election Commission, one of the earliest public records involving a payment to Web Listings dates back to 2008 and comes from none other than the the 2008 Hillary Clinton for President fund.

… Guilmette said most of the public references he found regarding payments to Web Services Inc. are from political campaigns and small towns.

“Which naturally raises the question: Should we really be trusting these people with our money?” Guilmette said. “What kind of people or organizations are most likely to pay a bill that is utterly phony baloney, and that actually isn’t due and payable? The answer is people and organizations that are not spending their own money.”

I doubt this will be the basis for a US version of the GDPR. And why no Democrats? Cherchez la political contribution?

https://www.bespacific.com/house-cmte-investigation-issues-scathing-report-on-equifax-breach/

House Cmte Investigation Issues Scathing Report on Equifax Breach

The Hill: “The House Oversight and Government Reform Committee, following a 14-month probe, released a scathing report Monday saying the consumer credit reporting agency aggressively collected data on millions of consumers and businesses while failing to take key steps to secure such information. The breach is estimated to have harmed 148 million consumers.

“In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked on an aggressive growth strategy, leading to the acquisition of multiple companies, information technology (IT) systems, and data,” according to the 96-page report authored by Republicans. “Equifax, however, failed to implement an adequate security program to protect this sensitive data. As a result, Equifax allowed one of the largest data breaches in U.S. history. Such a breach was entirely preventable.”…

How do we know this article was not written by an AI?

https://www.bespacific.com/artificial-intelligence-and-the-future-of-humans/

Artificial Intelligence and the Future of Humans

Pew: “Experts say the rise of artificial intelligence will make most people better off over the next decade, but many have concerns about how advances in AI will affect what it means to be human, to be productive and to exercise free will. Digital life is augmenting human capacities and disrupting eons-old human activities. Code-driven systems have spread to more than half of the world’s inhabitants in ambient information and connectivity, offering previously unimagined opportunities and unprecedented threats. As emerging algorithm-driven artificial intelligence (AI) continues to spread, will people be better off than they are today? Some 979 technology pioneers, innovators, developers, business and policy leaders, researchers and activists answered this question in a canvassing of experts conducted in the summer of 2018. The experts predicted networked artificial intelligence will amplify human effectiveness but also threaten human autonomy, agency and capabilities. They spoke of the wide-ranging possibilities; that computers might match or even exceed human intelligence and capabilities on tasks such as complex decision-making, reasoning and learning, sophisticated analytics and pattern recognition, visual acuity, speech recognition and language translation. They said “smart” systems in communities, in vehicles, in buildings and utilities, on farms and in business processes will save time, money and lives and offer opportunities for individuals to enjoy a more-customized future…”

I don’t think they like Article 13.

Latest EU Copyright Proposal: Block Everything, Never Make Mistakes, But Don't Use Upload Filters

As we've been discussing the "Trilogue" negotiations between the EU Commission, EU Council and EU Parliament over the EU's Copyright Directive have continued, and a summary has been released on the latest plans for Article 13, which is the provision that will make upload filters mandatory, while (and this is the fun part) insisting that it doesn't make upload filters mandatory. Then, to make things even more fun, another document on the actual text suggests the way to deal with this is to create a better euphemism for filters.

Perspective. No breakdown of the results of these searches. What were they looking for? How often did they find anything?

Customs officers searching more travelers’ devices

Colleen Long of AP reports:

U.S. Customs and Border Protection officers are searching the electronic devices of travelers more often, and did not always follow proper protocol, a new watchdog report has found.

The report made public Monday found there were 29,000 devices searched at a port of entry out of 397 million travelers to the U.S. in budget year 2017, up from 18,400 the year before from 390 million travelers.

Customs and Border Protection officials note it is less than 1 percent of all travelers.

Read more on AP.

Perspective.

http://www.pewresearch.org/fact-tank/2018/12/10/social-media-outpaces-print-newspapers-in-the-u-s-as-a-news-source/

Social media outpaces print newspapers in the U.S. as a news source

Social media sites have surpassed print newspapers as a news source for Americans: One-in-five U.S. adults say they often get news via social media, slightly higher than the share who often do so from print newspapers (16%) for the first time since Pew Research Center began asking these questions.

… Overall, television is still the most popular platform for news consumption – even though its use has declined since 2016. News websites are the next most common source, followed by radio, and finally social media sites and print newspapers.

Perspective. This should have been done 30 or 40 years ago!

https://www.bespacific.com/uk-just-banned-the-nhs-from-buying-any-more-fax-machines/

UK just banned the NHS from buying any more fax machines

BBC News: “The National Health Service will be banned from buying fax machines from next month – and has been told by the government to phase out the machines entirely by 31 March 2020. In July, the Royal College of Surgeons revealed nearly 9,000 fax machines were in use across the NHS in England. The Department of Health said a change to more modern communication methods was needed to improve patient safety and cyber security. An RCS spokesman said they supported the government’s decision. In place of fax machines, the Department of Health said secure email should be used. Richard Kerr, who is the chair of the RCS’s commission on the future of surgery, said the continued use of the outdated technology by the NHS was “absurd”. He added it was “crucial” that the health service invested in “better ways of communicating the vast amount of patient information that is going to be generated” in the future. The group’s report from earlier this year found the use of fax machines was most common at the Newcastle upon Tyne NHS Trust, which still relied on 603 machines. Three-quarters of the trusts in England replied to the survey – 95 in total. Ten trusts said that they did not own any fax machines, but four in ten reported more than 100 in use…”

Not as much exposure as you might think. Do you know every computer a job applicant might have had access to?

https://securelist.com/darkvishnya/89169/

DarkVishnya: Banks attacked through direct connection to local network

… In 2017-2018, Kaspersky Lab specialists were invited to research a series of cybertheft incidents. Each attack had a common springboard: an unknown device directly connected to the company’s local network. In some cases, it was the central office, in others a regional office, sometimes located in another country.

… Each attack can be divided into several identical stages. At the first stage, a cybercriminal entered the organization’s building under the guise of a courier, job seeker, etc., and connected a device to the local network, for example, in one of the meeting rooms.

The devices used in the DarkVishnya attacks varied in accordance with the cybercriminals’ abilities and personal preferences. In the cases we researched, it was one of three tools:

• netbook or inexpensive laptop
• Raspberry Pi computer
• Bash Bunny, a special tool for carrying out USB attacks

… At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. At the same time, the attackers tried to brute-force or sniff login data for such machines.

… Having succeeded, the cybercriminals proceeded to stage three. Here they logged into the target system and used remote access software to retain access

This could be another example of the FBI talking to lawmakers in another country, hoping to convince them to support an FBI position. Now they can point to this law and tell US lawmakers, :We’re behind!”

https://www.securityweek.com/australia-anti-encryption-law-rushed-passage

Australia Anti-Encryption Law Rushed to Passage

A newly enacted law rushed through Australia's parliament will compel technology companies such as Apple, Facebook and Google to disable encryption protections so police can better pursue terrorists and other criminals.

… "I think it's detrimental to Australian and world security," said Bruce Schneier, a tech security expert affiliated with Harvard University and IBM.

… U.S. law enforcement officials, including Deputy Attorney General Rod Rosenstein, are again pushing for legislation that would somehow give authorities access to secure communications.

The Australian bill is seen by many as a beachhead for those efforts because the nation belongs to the "Five Eyes" security alliance with the U.S., Britain, Canada and New Zealand.

"There is a lot here that doesn't make any sense," Schneier said of the Australian bill. "This is a technological law written by non-technologists and it's not just bad policy. In many ways, I think it's unworkable."

A leading figure in cryptography, Martin Hellman of Stanford University, said it appears the bill would "facilitate crime by weakening the security of the affected devices."

… But Apple, in comments filed with parliament in October, argued that "it would be wrong to weaken security for millions of law-abiding customers in order to investigate the very few who pose a threat."

I’m beginning to think that stories like this are influencing the push for real penalties (like GDPR). The next requirement is some significant penalties for the managers who won’t take action on their own.

New Zealand Privacy Commissioner releases annual report

Stuff reports on a case in New Zealand that was cited in a newly-released annual report by the Privacy Commissioner. Disturbingly, the unnamed government agency not only did not set a great example for data protection, but they demonstrated less than admirable response to the incident of insider-wrongdoing that harmed a member of the public. Stuff reports:

A government employee in dispute with his neighbour snooped on him 73 times after accessing his employer’s “sensitive” records.

He also changed the man’s file to add allegations of “improper conduct”.

When the government agency found out about the privacy breach it reviewed its processes but was not willing to apologise to the neighbour or pay him compensation.

[…]

The commissioner has called for changes to the Privacy Act to introduce “meaningful consequences” for non-compliance, including for the commissioner to decide which cases should go to the tribunal and for the commissioner to take the claims.

Read more on Stuff. That the agency didn’t even apologize for the anguish or harm to the individual is concerning.

It is one thing to argue that you had policies and procedures in place that you monitored, but despite that, an employee willfully managed to violate both, but then not to give the affected individual anything — even a “We agree with you with and have terminated the employee’s position with us,” well…. there has to be more redress and/or compensation for those whose complaints are founded. And government agencies should be setting good examples instead of needing to be dragged before a tribunal or sued.

More information on the Privacy Commissioner’s 2018 Report can be found on the Commission’s web site.

To jump directly to the annual report, go here.

Is political news based on the number of people who want to read it?

https://www.bespacific.com/the-long-tortured-quest-to-make-google-unbiased/

The long, tortured quest to make Google unbiased

The Verge – Can a search engine ever be meaningfully neutral: “[December 11, 2018], Sundar Pichai will try to reassure Congress that Google’s search engine isn’t rigged. The Google CEO is testifying before the House Judiciary Committee on Tuesday [The Hearing is titled – Transparency & Accountability: Examining Google and its Data Collection, Use and Filtering Practices] answering questions about “potential bias and the need for greater transparency” in Google’s business practices. It’s Republican lawmakers’ latest move in a series of hearings over Silicon Valley political bias. “Google has created some of the most powerful and impressive technology applications,” wrote House Majority Leader Kevin McCarthy in the announcement. “Unfortunately, recent reports suggest Google might not be wielding its vast power impartially. Its business practices may have been affected by political bias.” We don’t know exactly what questions will arise during Pichai’s testimony. But this summer, President Donald Trump caused a brief uproar by claiming (without evidence) that Google suppressed positive news about him. Reports indicated Trump might even direct regulators to investigate Google and other platforms for bias. But that proposal hadn’t come from one of Silicon Valley’s many ideological enemies — it was supposedly promoted by recommendations site Yelp, which has spent years protesting what it calls unfair demotion of its search results.

That investigation never came to pass. But it highlighted a major underpinning of the current anti-Google backlash: a decade-long fight over how search engines, which have become many people’s primary gateway to the internet, should treat the websites they list.”

A Privacy issue, more than a Terminator issue.

The Five Most Worrying Trends in Artificial Intelligence Right Now

… On Thursday, the AI Now Institute, which is affiliated with New York University and is home to top AI researchers with Google and Microsoft, released a report detailing, essentially, the state of AI in 2018, and the raft of disconcerting trends unfolding in the field. What we broadly define as AI—machine learning, automated systems, etc.—is currently being developed faster than our regulatory system is prepared to handle, the report says. And it threatens to consolidate power in the tech companies and oppressive governments that deploy AI while rendering just about everyone else more vulnerable to its biases, capacities for surveillance, and myriad dysfunctions.

… But it also conveys a the succinct assessment of the key problem areas in AI as they stand in 2018. As detailed by AI Now, they are:

1. The accountability gap between those who build the AI systems (and profit off of them) and those who stand to be impacted by the systems (you and me) is growing.
2. AI is being used to amplify surveillance, often in horrifying ways.
3. The government is embracing autonomous decision software in the name of cost-savings, but these systems are often a disaster for the disadvantaged.
4. AI testing “in the wild” is rampant already.
5. Technological fixes to biased or problematic AI systems are proving inadequate.

The world must look different from the Ninth Circuit.

In Facebook Case, Ninth Circuit Ignores Privacy Risks of Visits to Healthcare Websites- EPIC

The good folks at EPIC.org write:

In a surprisingly brief opinion, the Ninth Circuit has upheld a decision to dismiss a privacy suit against Facebook concerning the collection of sensitive medical data. In Smith v. Facebook, users alleged that the company tracked their visits to healthcare websites, in violation of the websites’ explicit privacy policies. In a little less than five pages, the Ninth Circuit decided that Facebook was not bound by the promises made not to disclose users’ data to Facebook because Facebook has a provision, buried deep in its own policy, that allows Facebook to secretly collect such data. The court actually wrote that searches for medical information are not sensitive because the “data show only that Plaintiffs searched and viewed publicly available health information…” EPIC filed an amicus brief in the case, arguing that “consent is not an acid rinse that dissolves common sense.” In 2011 Facebook settled charges with the FTC that it routinely changed the privacy settings of users to obtain sensitive personal data. The consent order resulted from detailed complaints brought by EPIC and several other consumer organizations

I hate to say it, but I do understand the court’s reasoning, at least in part. Just visiting a site about a health issue is not the same thing as going to a doctor’s office for a consultation on a disorder or diagnosis. But we also know that sometimes, these situations create significant problems when advertising relating to a sensitive issue then shows up on a shared browser. For example, if a teen browses for information on transgender issues, and then their parents later have ads pop up while they’re using the browser, the collection and use of data from public sites can cause privacy issues and concerns.

So yes, the court’s siding with Facebook is very troubling because it’s ignoring what we have learned — that buried provisions in Facebook’s terms of service are generally not read by consumers who click through “I consent.” For the court to say that hey, it’s in there and consumers consented to have their data collected by Facebook, even though they are on a web site that promises NOT to share their data with Facebook, well…. the Ninth Circuit has set consumer privacy back. As EPIC noted in their amicus brief (p. 6):

Users could point to explicit statements on the medical websites they visited which said their personal data would not be disclosed to others. Yet, Facebook pointed to language, buried deep in its privacy policy, which said that it nonetheless could collect the data, and the lower court sided with Facebook. In such a world, how can users possibly make sense of privacy statements

Although the plaintiffs didn’t prevail, do read EPIC’s amicus brief in this case as it provides a helpful discussion of the concerns.

Helpful for us non-lawyers.

https://www.insideprivacy.com/data-security/data-breaches/standing-issues-in-data-breach-litigation-an-overview/

Standing Issues in Data Breach Litigation: An Overview