Government overreacting -- and over-reaching -- subpoenaed data a comms app doesn’t have

According to a post on the Signal blog, a federal grand jury in the Central District of California has subpoena'd Signal for a whole pile of user data, like subscriber information, financial information, transaction histories, communications, and more. HotHardware reports: The thing is, the subpoena is moot: Signal simply doesn't have the data to provide. 

The company can't provide any of the data that the grand jury is asking for because, as the company itself notes, "Signal doesn't have access to your messages, your chat list, your groups, your contacts, your stickers, [or] your profile name or avatar." The only things that Signal can offer up to the court are Unix timestamps for when the accounts in question were created and last accessed the service. 

Read more here:
https://signal.org/bigbrother/cd-california-grand-jury/

NSA Surveillance Was Unconstitutional

The National Security Agency program that swept up details on billions of Americans' phone calls was illegal and possibly unconstitutional, a federal appeals court ruled:

However, the unanimous three-judge panel of the 9th Circuit Court of Appeals said the role the so-called telephone metadata program played in a criminal terror-fundraising case against four Somali immigrants was so minor that it did not undermine their convictions. 

The long-awaited decision is a victory for prosecutors, but some language in the court's opinion could be viewed as a rebuke of sorts to officials who defended the snooping by pointing to the case involving Basaaly Moalin and three other men found guilty by a San Diego jury in 2013 on charges of fundraising for Al-Shabaab. Judge Marsha Berzon's opinion, which contains a half-dozen references to the role of former NSA contractor and whistleblower Edward Snowden in disclosing the NSA metadata program, concludes that the "bulk collection" of such data violated the Foreign Intelligence Surveillance Act. 

The call-tracking effort began without court authorization under President George W. Bush following the Sept. 11, 2001, terrorist attacks. A similar program was approved by the secretive FISA Court beginning in 2006 and renewed numerous times, but the 9th Circuit panel said those rulings were legally flawed.

Read more... 

What is Europe's Strategy for Data?

The European Commission presented its long-awaited EU data strategy in Brussels on February 29, 2020. In response to evolving economic and social concerns brought about through digital transformation, European lawmakers debuted a discussion paper addressing a vision for Europe as a leader in the global data economy. The paper was presented together with the Commission’s Communication, Shaping Europe’s Digital Future and other papers, such as on Artificial Intelligence.

Read more here...

Google Users in the UK to fall under US, not EU data protection rules

According to Reuters, Google is planning to move its British users' accounts out of the control of European Union privacy regulators, placing them under U.S. jurisdiction instead:

The shift, prompted by Britain's exit from the EU, will leave the sensitive personal information of tens of millions with less protection and within easier reach of British law enforcement. The change was described to Reuters by three people familiar with its plans. Google intends to require its British users to acknowledge new terms of service including the new jurisdiction.
Ireland, where Google and other U.S. tech companies have their European headquarters, is staying in the EU, which has one of the world's most aggressive data protection rules, the General Data Protection Regulation. Google has decided to move its British users out of Irish jurisdiction because it is unclear whether Britain will follow GDPR or adopt other rules that could affect the handling of user data, the people said. If British Google users have their data kept in Ireland, it would be more difficult for British authorities to recover it in criminal investigations.

Small Business GDPR Requirements Differ from Large Business

Are small businesses required to keep the same records of compliance as large businesses?

Although Article 30 of the GDPR states that companies must “maintain a record” of their processing activities, the provision contains an exemption for small businesses. Specifically, it states that if a company employs “fewer than 250 persons,” it is generally not required to maintain a record of its processing activities. The exception does not apply, however, if one of three conditions is present:

• The small business carries out processing that “is likely to result in a risk to the rights and freedoms of data subjects,”

• The small business carries out processing that “is not occasional,” or

• The small business carries out processing that “includes special categories of data” or that involves “data relating to criminal convictions and offense.”

The small-business exception been interpreted very narrowly by the Article 29 Working Party. A small business of course maintains personal data concerning its employees. As that data is maintained throughout the employment relationship (and typically beyond) it is subject to systematic and periodic processing (e.g., to run payroll, collect and pay taxes on behalf of employees, evaluate performance, etc.). The Article 29 Working Party assumes that such processing cannot be characterized as “not occasional.” In order for processing to be considered “occasional,” it cannot be “carried out regularly” and it cannot be carried out within “the regular course of business or activity” of the company.  In such jurisdictions that so permit, employers often collect “data relating to criminal convictions” prior to offering an individual employment and periodically throughout the employment relationship. It is also common for an employer to hold some information about employees’ health. As a result, even if a company has fewer than 250 employees, it may still be subject to the same record keeping requirements as larger companies with respect to its human resource related data. 

Read more here...

Abuse of Online Privacy Rules Means Personal Info Can Be Compromised - So Require Credentials

With the introduction of Europe's General Data Protection Regulation, firms in Europe and around the globe should be aware that social engineering tactics can be used to acquire an individual’s sensitive data.

“…For social engineering purposes, GDPR has a number of real benefits, Pavur said. Firstly, companies only have a month to reply to requests and face fines of up to 4 percent of revenues if they don't comply, so [the] fear of failure and time are strong motivating factors.

In addition, the type of people who handle GDPR requests [is] usually admin or legal staff, not security people used to social engineering tactics. This makes information gathering much easier….” See this article.

Direct email marketing, for example, is already regulated under the EU's e-Privacy Directive. Such rules require consent before someone can be sent direct marketing. A so-called "soft opt-in" makes this slightly easier. If a firm has an existing relationship, for instance, if a customer has bought a product from them before, they may still contact that recipient.

The European Union is updating the rules on electronic communications just as the UK is hustling to engage its own Data Protection Act in place, considering how Brexit will affect tech firms. The continued flow of data between the UK and the rest of Europe (and the world) depends on governments’ ability to interact.

GDPR will impact more than privacy

Similar to how GDPR hugely impacted how millions of organizations handle personal data when it was enforced last year, Strong Customer Authentication (or SCA) will have profound implications for how businesses handle online transactions and how we pay for things in our everyday lives when it is enforced on September 14.

SCA will require an extra layer of authentication for online payments. Where a card number and address once sufficed, customers will now be required to include at least two of the following three factors to do anything as simple as ordering a taxi or pay for a music streaming service. Something they know (like a password or PIN), something they own (like a token or smartphone), and something they are (like a fingerprint or biometric facial features).

Without careful preparation, failed transactions and additional friction may have a significant negative impact on conversion rates.

https://thenextweb.com/podium/2019/05/10/your-business-passed-the-gdpr-challenge-but-sca-is-next/amp/

SIFT Score - the West's Answer to China's Social Credit Rating. Thanks, Big Brother

Data on what you buy, how, and where is secretly fed into AI-powered verification services, according to the Wall Street Journal. These are supposed to help companies guard against credit-card and other forms of fraud.

More than 16,000 signals are analyzed by a service called Sift, which generates a "Sift score," used to flag devices, credit cards and accounts that a vendor may want to block based on a person or entity's overall "trustworthiness" score. From the Sift website: "Each time we get an event -- be it a page view or an API event -- we extract features related to those events and compute the Sift Score. These features are then weighed based on fraud we've seen both on your site and within our global network, and determine a user's Score. There are features that can negatively impact a Score as well as ones which have a positive impact."

The system is similar to a credit score except there's no way to find out your own Sift score. This sounds a lot like the data that China's social credit system, in part, uses. In the PRC, a person's social score can vary depending on their behavior. The exact methodology is a secret — but examples of infractions include bad driving, smoking in non-smoking zones, buying too many video games and posting fake news online. While Edward Snowden certainly demonstrated the global extent of the US surveillance state, corporate entities have not implemented anything on the level of the Chinese social scoring system. Yet.

Ireland's First Report on GDPR

Last month marks the release of the first annual GDPR report from Ireland’s data protection supervisory authority, the Data Protection Commission (DPC). This is a follow-on from the DPC’s final pre-GDPR annual report and covers May through December of 2018.

The report confirms the DPC’s role as the clearinghouse for cross-border privacy complaints: A new category, termed ‘multinational complaints – others’, makes up 22% of all GDPR complaints in the report. These complaints are second to access rights as the largest category of complaint. 

This document also sets out the DPC’s views on the new complaint-handling mechanism under the Data Protection Act of 2018. When a negotiated resolution is not possible, the DPC is no longer legally obliged to make a formal, statutory decision. Instead, the DPC has a range of options: providing advice to the complainant; issuing statutory notices to controllers or processors; and, opening statutory enquires.

If a non-EU company is offering services over the internet to consumers in the EU, these companies are required to have a  data protection representative due to increased territorial scope. Article 3 of the GDPR applies to any ‘data subject’ in the EU, i.e. a person living in the EU. Notably, Article 3(2) applies to the processing of personal data of any individual “in the EU.” The individual’s nationality or residence is irrelevant. The GDPR protects the personal data of citizens, residents, tourists, and other persons visiting the EU. So as long as an individual is in the EU, any personal information of that person collected by any controller or processor who meets the requirements of Article 3(2) is subject to the GDPR. Learn more about having a data representative here.

Download the full report here…

From SlashDot: “It's as dystopian as it sounds," opines The Verge:

Chinese schools are now tracking the exact location of their students using chip-equipped "smart uniforms" in order to encourage better attendance rates, according to a report from state-run newspaper The Global Times. Each uniform has two chips in the shoulders which are used to track when and where the students enter or exit the school, with an added dose of facial recognition software at the entrances to make sure that the right student is wearing the right outfit (so you can't just have your friend, say, wear an extra shirt while you go off and play hooky). Try to leave during school hours? An alarm will go off.... 

There are additional features, too, according to a report from The Epoch Times: the chips can apparently detect when a student has fallen asleep in class, and allow students to make payments (using additional facial or fingerprint recognition to confirm the purchase). The uniforms are being used in 10 schools in China's Guizhou Province region, and apparently have been in use for some time -- according to Lin Zongwu, principal of No. 11 School of Renhuai, over 800 students in his school have been wearing the smart uniforms since 2016.

Keep Resisting the Government, Apple is Urged

Many technology and privacy advocates are urging Apple to keep fighting the FBI's demand for access to iPhones... but there is hope:

A magistrate judge recently ordered Apple to comply with this request. Apple in turn filed a Motion to Vacate, arguing that in complying with the FBI’s request, the company would be forced to weaken a valuable encryption platform at a time when the United States desperately needs stronger, more effective encryption. And... this week Apple is appearing before Congress to address the issues raised. The legal grounds for the FBI’s demand come from the Communications Assistance for Law Enforcement Act (CALEA) and the All Writs Act (AWA). Under CALEA, there is a strong argument that Apple cannot be legally required to create new software of any kind for any department of the federal government. Enacted in 1789 as a stop-gap that allows the government to efficiently administer its given legislative privileges, the AWA is being given an impermissibly broad interpretation by the FBI. Apple should do what is necessary to preserve our enduring constitutional values, including life, liberty and the pursuit of happiness. Those values also include the privacy and speech rights protected by the Constitution.

Read more... at TechCrunch

New Data Rules between the U.S. and E.U.

Details are forthcoming about a new trans-Atlantic data transfer agreement so that companies such as Google and Facebook can keep digital information flowing between the two regions while paying greater heed to privacy concerns. Under the so-called E.U.-U.S. Privacy Shield, companies will face stricter rules over how they move people’s digital data from the European Union to the United States. American officials have also agreed to new limits on the powers of the country’s intelligence agencies to gain access to Europeans’ online information when it is transferred to the United States. As usual, the conflict between the EU and US is over balancing individuals’ privacy concerns with national security, supposedly. Most controversial were requirements from the European Commission to limit how U.S. intelligence agencies collect data on Europeans when companies send their personal information to the United States.

Read more at the Harvard Business Review...

Private Messaging -- a Trend in Response to Government Spying?

After racing for years watching to make everything public, are we seeing companies, large and small, responding to the public's desire for more privacy? Twitter has added photo-sharing to its direct messaging functionality, and Instagram is enabling users to share messages plus photos and videos with a single person or small group of people.

All these companies seek to be “the email of chat,” the "killer app" of the second decade of the new millennium. This has happened before -- ICQ, AIM, etc., of the early days of the public uptake of the internet.

Until lately, Twitter users could view Instagram photos within Twitter itself thanks to the microblogging network's media-friendly expanding content cards. Then one day, they couldn't — having instead to perform the arduous task of clicking an outbound link to the Facebook-acquired Instagram's still relatively new website. So, while you could still technically share Instagrams to Twitter, the experience was drastically altered. Instagram killed support for Twitter, as well. Instead of a toe-to-toe nuclear conflict, Instagram photos shared by brands on Twitter decreased in engagement, brand activity on Facebook and Instagram increased.

The term "conversations" has been replaced with the term "messages" in many places throughout the enterprise. Twitter pushed out a new version of its iOS and Android apps, as well as the web-based versions of TweetDeck. Previously, all photos posted to Twitter were public by default, and all direct messages could contain only links and text. Now users can privately message photos back and forth through the app, helping the company compete with photo-sharing apps like Snapchat and messaging services such as WhatsApp and Kik. Unlike Snapchats, however, privately messaged photos on Twitter can be saved.

Clearly private messaging is an important component of public real-time conversations using distributed platforms such as Twitter. Can these private "conversations" survive government snooping? Not when the spooks are snooping in places like Second Life and WoW.

The spies have created make-believe characters to snoop and to try to recruit informers, while also collecting data and contents of communications between players, according to the documents, disclosed by the former National Security Agency contractor Edward J. Snowden. Because militants often rely on features common to video games — fake identities, voice and text chats, a way to conduct financial transactions — American and British intelligence agencies worried that they might be operating there, according to the papers.

Facebook introduced a new feature which allows business pages to receive private messages from their fans on the social network, first available to Asia-based administrators, is a significant private messaging tool that will allow organizations to interact more closely with stakeholders on the service than ever before. Consumer facing businesses will find the feature particularly useful as it enables more personal communication with individual customers, opening the possible of a greater level of customer service .

But what will this mean for privacy? Only time will tell if the NSA and other government agencies (US and UK, for example) tap these networks.

Privacy in the post-PRISM Age

Germany's Chancellor Angela Merkel has given her backing to proposed European privacy regulations and demanded that US firms should meet German privacy rules. Merkel's stance comes as US firms lobby against strict EU privacy proposals — but also follows revelations from Edward Snowden through German newspaper Der Spiegel, that the German authorities are helping the NSA spy on German citizens.

Update: NPR reports Germany canceled a Cold War-era surveillance pact with the United States and Britain on Friday in response to revelations by National Security Agency leaker Edward Snowden about those countries' alleged electronic eavesdropping operations.

Your Rights -- A Little Less Constrained

Item #1. Readers may recall all this writer's opposition o illegal search and seizure as it pertains to your digital privacy at the U.S. border. Border (ICE) agents are able to search the contents of electronic devices, such as computers and phones at the border, without any reason. The 4th Amendment only allows reasonable searches, usually with a warrant. Up until now the typical argument has been: when you are at the border, you are not in the country -- and the 4th Amendment doesn't apply. This rule has been loosly interpreted at times, including the ability to take your computer and devices into the country and search it there, while still considering it a "border search," for which the lower standards apply.

Only a month ago, it appeared that the U.S. Department of Homeland Security saw no reason to change this policy. Well, now they might have to. In a somewhat surprising 9th Circuit ruling (en banc, or in front of the entire set of judges), the court ruled that the 4th Amendment does apply at the border, that agents do need to recognize there's an expectation of privacy, and cannot do a search without reason. Furthermore, they noted that merely encrypting a file with a password is not enough to trigger suspicion.

http://www.techdirt.com/articles/20130308/13380622263/9th-circuit-appeals-court-4th-amendment-applies-border-also-password-protected-files-shouldnt-arouse-suspicion.shtml

Item #2. The Obama Administration has filed a brief in support of a Maryland photojournalist who says he was arrested and beaten after he took photographs of the police arresting two other men. The brief by the Justice Department argues that the U.S. Constitution protects the right to photograph the actions of police officers in public places and prohibits police officers from arresting journalists for exercising those rights. Context: 'Garcia says that when Officer Christopher Malouf approached him, Garcia identified himself as a member of the press and held up his hands to show he was only holding a camera. But Malouf "placed Mr. Garcia in a choke hold and dragged him across the street to his police cruiser," where he "subjected him to verbal and physical abuse."

http://arstechnica.com/tech-policy/2013/03/obama-administration-supports-journalist-arrested-after-recording-cops/

Intellectual property and file sharing co-habitation re-think needed

As this ZDNet opinion rightly points out, file sharing and copyright infringement are not synonymous. Kim Dotcom

deserves the protection of New Zealand's legal system; the case against him is muddled, and a rush to extradite him to the U.S. was ill-thought-out. Even if he broke some U.S. laws, Kim Dotcom's mega site may not even be about theft, as the New York Times points out.

In the middle of the 20th century, criminal law reformers were sufficiently annoyed by all of this specialization and ad hoc-ness that they decided to do something about it.

In 1962, the prestigious American Law Institute issued the Model Penal Code, resulting in the confused state of theft law we’re still dealing with today.

In a radical departure from prior law, the code defined “property” to refer to “anything of value.” Henceforth, it would no longer matter whether the property misappropriated was tangible or intangible, real or personal, a good or a service. All of these things were now to be treated uniformly.

Before long, the code would inform the criminal law that virtually every law student in the country was learning. And when these new lawyers went to work on Capitol Hill, at the Justice Department and elsewhere, they had that approach to theft in mind.

Then technology caught up.

The NYT presents a pretty clear thesis: "...stop trying to shoehorn the 21st-century problem of illegal downloading into a moral and legal regime that was developed with a pre-20th-century economy in mind. Second, we should recognize that the criminal law is least effective — and least legitimate — when it is at odds with widely held moral intuitions."

Facebook privacy woes are nothing compared to what the government is snooping about you

Many people clamber for the setting link when Facebook changes its privacy policies, but, as TechDirt discusses, nobody really seems to mind the eroding of their privacy rights by the US government.

There's currently nothing on the New York Times web site about the votes (either yesterday's or today's). The Associated Press wrote a story about the House's vote in September but nothing yet from yesterday or today. The Washington Post did post a story this morning. A Google news search will land hits with mostly tech or web-based media outlets.
Compare the lack of response to the way people react to privacy breaches connected to Facebook or Twitter. Media outlet after media outlet carried reports about a private picture of Randi Zuckerberg, Facebook founder Mark Zuckerberg's sister, accidentally being made public somehow through social media channels. And how many of your Facebook friends posted that silly, pointless "privacy notice" on their walls?

- TT/Bd

Have You Been a Victim of Cybercrime?

After my ex stole my identity to get credit cards, I went into full-on personal data protection mode. It seems having someone you know rip off your critical credit-related information isn't uncommon. And, on the Internet, there are many opportunities to have your good name besmirched.
This graphic from Tech News tells the story.




Cybersecurity is a rising concern globally -- for individuals, businesses and even governments. Unfortunately, many either don't take the threat seriously or aren't doing enough to protect themselves from cybercrime.
- Posted by Tom/Bluedog

Yes, adverts on the web pay off - for Google and Facebook

It should be obvious to anyone surfing the net that all those web pages we enjoy at zero cost are being ad supported (or otherwise subsidized by goodwill or some other contribution). In many cases, the data from users/readers is what is valued -- companies are able to take user data, sell it to advertisers, and make money. That data you're giving away online is worth something, but have you ever wondered how much? A privacy add-on for Firefox gives captures some metrics to help.

Read more at Ars Technica
- Posted by Tom/Bluedog

HTTPS (SSL) Vulnerability -- hijacking of sessions

Ars Technica has an article on a flaw that allows hijacking of secure sessions by decrypting certain cookies.

Researchers have identified a security weakness that allows them to hijack web browser sessions even when they're protected by the HTTPS encryption that banks and e-commerce sites use to prevent snooping on sensitive transactions.

The technique exploits web sessions protected by the Secure Sockets Layer and Transport Layer Security protocols when they use one of two data-compression schemes designed to reduce network congestion or the time it takes for webpages to load. Short for Compression Ratio Info-leak Made Easy, CRIME works only when both the browser and server support TLS compression or SPDY, an open networking protocol used by both Google and Twitter. Microsoft's Internet Explorer, Google's Chrome and Mozilla's Firefox browsers are all believed to be immune to the attack, but at time of writing smartphone browsers and a myriad of other applications that rely on TLS are believed to remain vulnerable.

- Posted by Tom/Bluedog