Is Google Evil?

That's the question posed by an article I want people to read today. See my last post for the details and a variety of expert opinions on Google's new privacy policy and the outcry it induced. For today's purposes I want to go straight to an article I found by the President of the Internet Security Advisors Group, and author, named Ira Winkler. The article is entitled "Is Google Evil? The Jury is Out."

I figure if anyone can shed some light on this subject its him.

He writes, "...there is plenty to get upset about regarding Google's new policy. Google has managed to wriggle into just about every area of our lives. It all started with Google search, of course, and that seemed innocuous. But later you could sign up for a Gmail account, and suddenly any searches you did while signed onto Gmail could have an identity assigned to them -- and Google roughly knew what was on your mind. Google Docs was another chance to gather data, and the social network Google+ really ups the ante. Every post is captured, and Google has access to information such as who is in your circles -- not only that you know those people, but what your relationship is to them, because you've defined your circles so carefully (family, friends, colleagues, fellow alumni). Google Calendar reveals where you are going to be. Google Maps gleans where you are considering going. Google Latitude knows exactly where you are right now. Picasa stores pictures, and if you carefully tag them, you have provided more information about where you have been and whom you have been with. Google Chrome keeps track of your browsing habits and history. Google Checkout and Google Wallet know what you are buying and where you are. The Android operating system can track every aspect of your cellphone usage, including the apps you have loaded. YouTube searches can reveal proclivities that you might not want other people to know about.

Until now, we could think of all of these as stand-alone services. Each had information about us, but the threat of privacy invasion seemed manageable. It's a different story when it all gets consolidated. Now, for all practical purposes, a single entity has the ability to put together your past, present and future. Who calls you on your Android phone can be combined with what you are searching. The interests you repeatedly post about can be combined with your location. Your appointments can be cross-referenced with your acquaintances' appointments.

What we know is that Google tries to monetize the information it has about the users of its services by selling advertising that is carefully targeted to their interests. Facebook and other companies do similar things. Some people have been sized up pretty well just based on their searches. Others have not. Wired recently ran a short piece on how Google currently can be inaccurate in its current analysis of a user's searches. After consolidation, though, there will be little ambiguity.

...

And this is where my presumption that Google is not evil runs up against a big problem. Because I have to believe that Google always intended to combine the data from all of the businesses that it built or acquired. I have too much respect for the company to think otherwise. I saw the potential for this three years ago; isn't it likely that Google did as well? But there is currently nothing in the law stopping a company from getting people to offer up their personal data under one privacy policy, even though the company fully intends to change the policy and use the data for other purposes.

Now, you could argue that any company that did that had to induce people to use its services under false pretenses. And that sounds, well, evil.

In the wake of Google's policy change, eight members of Congress sent the company a list of questions about the new policy's effects on privacy. Google responded on Monday, basically saying that its approach to privacy has not changed . My expectation is that in the end Google will make some small concessions, and the lawmakers and various privacy advocates will play those up so we'll all think they're looking after our welfare. To my mind, that's not nearly good enough. If Google is really going to live up to its corporate mantra of "Don't be evil," then it should undo this latest move and support regulation that would stop other companies from making similar changes. Because, unlike lions on the savannah, a company's worst impulses can be constrained.

Read more here.

Again, I think we're running up against the question of just what privacy rights do we have in the digital age? What is legal for companies to do with information that we ostensibly "give up" on the net? Sure, Google promises to use all this information to make our internet experience that much more seamless, efficient and enjoyable. Of course, as I have painstakingly documented on this blog for years now, there are all kinds of examples how this is not always the case...whether its the government and law enforcement wanting increasing amounts of access to every aspect of our lives, or whether its advertisers, insurance companies, or the pharmaceutical industry looking to market to us in increasingly invasive ways.

As the author also pointed out, it wasn't long ago that Google promised IT WOULDN'T consolidate all these functions...so as Google becomes more and more ubiquitous, so to is there access to everything we do. As Winkler points out, "Should it ever cross the line, then all of that information it has could be used for truly nefarious and malicious purposes, including extortion and harassment."

Interestingly, it was Supreme Court Justice Sotomayor that brought this very topic up in the recent GPS tracking case when she said made a case for revising the “third-party” doctrine (i.e. we lose Fourth Amendment protection when we disclose certain information). She wrote, “More fundamentally, it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers.”

It becomes clearer and clearer that this core question over data control and digital privacy must be asked and answered sooner rather than later. As Winkler correctly points out, "My thought is that regulators and privacy professionals should rethink the concept of privacy protection. When companies are allowed to set their own privacy policies and retain the right to change them at will, do privacy policies mean anything at all? The Google case suggests that voluntary privacy policies, always subject to change, provide no protection."

Google's New Privacy Policy Causes Controversy

A bit of a firestorm was sparked by Google changing its privacy policies rather abruptly, while making opt-ing out of the massive amount of data sharing that will take place if their proposed folding 60 of its 70 existing product privacy policies under one blanket policy and breaking down the identity barriers between (to accommodate its new Google+ social network software) nearly impossible.

In other words, Google will combine data from all its services, so when users are signed in, Google may combine identity information users provided from one service with information from other services. The goal is to treat each user as one individual across all Google products, such as Gmail, Google Docs, YouTube and other Web services.

One one hand, this didn't strike me as something they weren't already probably doing...but that doesn't make it okay, either. By the least, Google's ability to create an incredibly detailed digital dossier of every one of us, with little to no control on our part, would be enhanced beyond what it already can do.

As John Simpson, director of the the nonprofit, nonpartisan Group's Privacy Project stated, "Google has eliminated its last pretense that it protects consumer privacy - the walls are torn down. Instead of a privacy policy Google has finally admitted they have a profiling policy - and every Internet user is a target to be spied on."

Peter Eckersley, the Electronic Frontier Foundation's Technology Projects Director points out that the search giant's disclosure that it will track what you do across all Google-owned services that you partake of -- on your PC and mobile devices -- comes across more like a confession than a bold new move.

Google of course is claiming it will simply and improve the users experience...but they also admit it will also make it impossible for users to opt out of having their identities applied to dozens of Websites they might not have agreed to use.

Common Sense Media CEO James Steyer wrote in a statement emailed to eWEEK:

"Google's new privacy announcement is frustrating and a little frightening. Even if the company believes that tracking users across all platforms improves their services, consumers should still have the option to Opt Out—especially the kids and teens who are avid users of YouTube, Gmail and Google Search."

More than anything, this kind of "cross personalization", from video to email, would be a boon for advertisers and marketers...which is what's this really all about. Already though, lawmakers and the the Federal Trade Commission are looking into Google's search business practices - a company that has already been ordered to submit to 20 years of audits after breaching user privacy with its Google Buzz feature.

So what exactly is different with this policy? Peter Eckersley of EFF notes, ""It has always been the case that Google kept effectively linkable records of our uses of Gmail, Search, Maps and Market for Android, and other services,. Only very sophisticated users have ever been able to remove any of that linkability, and that remains the case today. In a couple of cases, Google had some internal practices of not linking your browsing history, and YouTube history, to other data -- and those internal walls at the company are now gone."

We should also consider Google's sordid privacy history, from Google Books  to the loss of "Locational Privacy" to the company's lobbying efforts in Congress, to its cloud computing, to its increasing usage and expansion of behavioral marketing techniques, to Google StreetView cars gathering private information from unaware local residents, to the company teaming with the National Security Agency (the agency responsible for such privacy violation greatest hits as warrantless wiretapping) "for technical assistance" to the infamous Google Buzz to the company's recent admittance that it gets THOUSANDS of requests from the government for information about its users to claims that the company manipulates its search results to favor its own products.

AS reported by Wired Magazine: The number of U.S. government requests for data on Google users for use in criminal investigations rose 29 percent in the last six months, according to data released by the search giant Monday. U.S. government agencies sent Google 5,950 criminal investigation requests for data on Google users and services from Jan. 1 to June 30, 2011, an average of 31 a day. That’s compared to 4,601 requests from July 1 to Dec. 31, 2010, the company reported Tuesday in an update to its unique transparency tool. Google says it complied in whole or part with 93% of such requests, which can include court orders, grand jury subpoenas and other legal instruments...According to Google, the numbers do not include National Security Letters, a sort-of self-issued subpoena used by the FBI in drug and terrorism cases. At their post–Patriot Act peak, the FBI issued more than 50,000 such letters a year, nearly all with gag orders attached to them. The use of such letters dipped for a time after the Justice Department’s internal watchdog unveiled widespread abuses and sloppy procedures, but are on the rise again. Also not included are national security wiretap and data requests, known as FISA warrants, that are approved by a secret court in D.C. to combat spies and threats to national security.

In other words, I view ANYTHING Google says or apparently does when it comes to privacy with a huge grain of salt.We are living in a brave new cyber world in which nearly everything we do can be monitored, sold and stored. And, let's remember, we have yet to establish the kinds of privacy protections demanded in this new information age. And that is not by accident, last year Google spent a record $9.7 million on lobbying 

Let's also remember the bigger picture, and why we need a set of ironclad privacy protections for internet users, including opt-in (and by the least opt-out), as well as Do Not Track...to name a few.

In a recent op-ed in the San Diego Union Tribune, Beth Givens, Executive Director of the Privacy Rights Clearinghouse lays out this larger issue of privacy on the net:

Individuals are increasingly using the Internet as their primary information source, often seeking information on sensitive matters such as finances, health, personal relationships, divorce, sexuality, workplace difficulties and legal conflicts. But few individuals realize the extent to which they are being tracked by companies that create rich profiles of their web-browsing activities. The 2010 Wall Street Journal series, “What They Know,” reported that the nation’s top 50 websites installed an average of 64 pieces of tracking technology onto each visitor’s computer. Tracking tools go beyond the cookies many of us routinely delete. Some companies deploy “Flash cookies” or other “supercookies” that are not only extremely difficult to delete but can also be used to reinstall cookies that a user has removed.

Such data-gathering and profiling activities are largely invisible, except that they can result in the real-time display of behaviorally targeted ads. You might ask, “What’s the harm in receiving ads based on my web-surfing history?” In a legislative primer presented to members of Congress by 10 organizations, including ours, several potentially harmful effects of behavioral tracking and targeting were identified: (1) targeting economically distressed individuals with payday loans and subprime mortgages; (2) sending ads for bogus cures to individuals with serious medical conditions; (3) engaging in discriminatory pricing in which some people are offered products or services at higher prices than others; and (4) targeting children who lack the judgment capacity of adults. Further, profiles compiled originally for the ad industry may be sold to non-advertising third parties such as insurance companies.

Harms aside, let’s not forget, simply, the right to privacy. The definition of privacy that guides my organization’s work is the ability of individuals to control the use of their personal information. Everyone has a different comfort level regarding the collection and use of their personal information. We believe individuals’ choices must be respected, no questions asked.

...

However, studies show that robust profiles generated from anonymous data can be matched with other data sources, offline and online, to determine individuals’ identities. These days, the anonymity argument is largely a myth. Another myth is that young people are not concerned about privacy. These “digital natives” have not known a world without the Internet, so the argument goes, and they are not worried about their personal information being revealed online. However, a 2009 academic survey found there are no significant differences between young adults and older individuals regarding online privacy concerns. While some believe that in a generation or two, concerns about online privacy will vanish, we at the Privacy Rights Clearinghouse are not so quick to accept that argument.

In closing, effective online privacy protection requires a multipronged approach involving policymakers, industry, nonprofits and consumers. It must not be lost to bogus arguments and unfounded myths.

You can read the rest here.

Legislators Taking Action

The good news is legislators are asking Google some tough questions. Rep. Jackie Speier, a longtime privacy stalwart, has co-authored a letter (PDF) asking the company to respond to a series of sternly worded questions about its plans to simplify privacy policies into one more-or-less standard one. Currently Google has more than 70 individual privacy policies. 

The letter states, "We believe that consumers should have the ability to opt-out of data collection when they are not comfortable with a company's terms of service and that ability to exercise that choice should be simple and straightforward."

Other members signed on include Cliff Stearns (R), Henry Waxman (D)--plus veteran Google antagonists Joe Barton (R) and Ed Markey (D). Google has until February 16th to respond.

Interestingly, there happens to be a major privacy conference taking place in Europe right now. Here's how the Europeans are addressing some of these same concerns (it goes without saying they're taking a much more PRO privacy stance):

The European Commission proposed these key changes in the data protection law that went into effect in 1995 when only 1 percent of Europeans were on the Internet:

---A ‘right to be forgotten’ will help people better manage data protection risks online: people will be able to delete their data if there are no legitimate grounds for retaining it.

---Companies and organisations must notify the national supervisory authority of serious data breaches as soon as possible (if feasible within 24 hours).

---Wherever consent is required for data to be processed, it is clarified that it has to be given explicitly, rather than assumed.

--- People will have easier access to their own data and be able to transfer personal data from one service provider to another more easily (right to data portability). This will improve competition among services.

--- EU rules must apply if personal data is handled abroad by companies that are active in the EU market and offer their services to EU citizens.

Conclusions

The ramifications of Google's new policy aside - and I'm not saying I know exactly what they are yet - the fact is, there's been a virtual explosion in data collection, data analysis and use of behavioral marketing on the internet without the requisite privacy protections to go along with it. Billions of dollars at stake, and your private information is the currency.

As I have written on this blog in the past: We know for instance, and they have been sued for it, companies like Google, Yahoo, Microsoft and other Internet companies track and profile users and then auction off ads targeted at individual consumers in the fractions of a second before a Web page loads.

That in itself, may not be all that threatening to most. But it raises some interesting questions: What kind of control should we have over our own data? And, what kind of tools should be available for us to protect it? What about ownership of our data? Should we be compensated for the billions of dollars being made by corporations from their tracking of us? And of course, what of the government's access to this new world of data storage?

The argument from privacy advocates has largely been that this massive and stealth data collection apparatus threatens user privacy and regulators should compel (not hope that) companies to obtain express consent from consumers before serving up "behavioral" ads based on their online history.

As I have also written before, its not by accident that we are told by the same interests that profit off our information that privacy is dead, and people don't care about it anymore, or that it will "kill business". Well, that's easy to say when you are the ones developing the complicated and difficult to find privacy settings consumers have to deal with - and profiting off our personal information without our consent.

More to the point is the simple, unavoidable fact that consumers should have MORE control, not less, over what information of ours is used, shared, and profited off. This basic principle is at the heart of the ACLU's DotRights campaign.

There remains an interesting dichotomy in all this: While people seem to "care" about privacy on one level, they tend to do very little to actually protect it. Which in my mind, makes easy to use, clear options to protect privacy so paramount. Once people are given such a choice, not only will more people choose to "not be tracked", I think more people will become more AWARE of just how all pervasive such monitoring of nearly everything we do has become."

Supreme Court Rules Search Warrant Needed to Track People Using GPS

The fourth amendment isn’t completely dead after all! While this fundamental right to privacy is admittedly in tatters, the Supreme Court ruled yesterday that police must have a warrant in order to track someone using a GPS device.

The case in question involved police covertly tracking a suspected cocaine dealer's car using a GPS device for an extended period of time without getting a warrant. The question before the court largely centered on whether the constant, and extended, use of a secret GPS tracking device violated the Fourth Amendment’s protection against unreasonable searches and seizures?

Or, is such use of these devices without a warrant acceptable on the grounds that there is no expectation of privacy when in public places and that such tracking technology merely makes public surveillance easier and more effective?

Clearly, a whole lot was riding on this decision for privacy advocates. Citizens shouldn’t be concerned that trips to a friend's house, a place of worship, or a therapist's office can be tracked in real time by the government.

Thankfully, in this case, the court agreed: attaching a GPS device to a car and tracking its movements is a violation of the Fourth Amendment. Unfortunately, the government will likely continue to insist that tracking the location of cell phones is unaffected by this ruling.

As previously laid out in an article in Wired Magazine, there is an important distinction between traditional surveillance and GPS tracking: "Repeated visits to a church, a gym, a bar, or a bookie tell a story not told by any single visit, as does one’s not visiting any of these places over the course of a month. The sequence of a person’s movements can reveal still more; a single trip to a gynecologist’s office tells little about a woman, but that trip followed a few weeks later by a visit to a baby supply store tells a different story."

Interestingly, though not surprising, the Court, while in unanimous agreement that a warrant is necessary, came to that conclusion from very different perspectives.

Certainly, the stand out Justice was Sonia Sotomayor, who went much further than her colleagues on the issue of privacy in the digital age - even making a case for revision of the “third-party” doctrine (i.e. we lose Fourth Amendment protection when we disclose certain information). She wrote, “More fundamentally, it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers.”

On the question of surveillance, she also distanced herself from Antonin Scalia’s narrow property rights argument (i.e. by installing the device police were violating the suspect’s private property), writing “…the same technological advances that have made possible nontrespassory surveillance techniques will also affect the Katz test by shaping the evolution of societal privacy expectations. Under that rubric, I agree with Justice Alito that, at the very least, 'longer term GPS monitoring in investigations of most offenses impinges on expectations of privacy.'" 

As Julian Sanchez of the CATO institute noted, the ruling was a big victory for privacy advocates and the Fourth Amendment, writing, “This is a pretty big deal. Fourth Amendment scholars have been warning for decades—and with increasing alarm—that modern communications technology could turn constitutional privacy protections into an empty formality if we’re regarded as waiving those protections whenever we “expose” information to a third party. It is inherent to the nature of the Internet and mobile telecommunications, after all, that almost everything we do online—and, increasingly, much that we do offline as well—leaves a trace in the vast databases of one corporation or another.

Sotomayor’s concurrence signals a recognition that we need to move beyond what privacy scholar Daniel Solove has called “The Secrecy Paradigm,” which assumes that whatever is not totally secret (or very nearly so) is effectively “public.” In other words, if your Internet provider has a record of every Web site you visit, there’s no invasion of privacy when the government decides to have a look at the list. At least one Justice, evidently, recognizes that this is an indefensible inference—and one hopes she’s not alone.” 

Does Sotomayor's case against the third party doctrine have any significance for privacy advocates moving  forward? Timothy B. Lee of ArsTechnica says yes, writing, “Sotomayor's discussion of the third-party doctrine has no legal significance, since she was the only one to sign onto her concurrence. But it could prove to have greater significance in the long run. The existence of at least one justice who is skeptical of the doctrine will inspire privacy advocates to raise objections to the idea in future cases. And one of those cases is likely to reach the high court at some point in the future.”

E-Health Records, Data Breaches, and Privacy

Rather than re-inventing the wheel today, if you want some past posts I've done on electronic health records (EHR's) and the need for strict privacy safeguards that protect consumers, you can go here, here, or here. Generally speaking, I've made the following arguments: yes, this transition from paper to EHR's is inevitable and necessary; yes, such a transition does offer numerous benefits from cost effectiveness to better care; but, and this is a big but, what remains contentious - and rightly so - is the intrinsic threat a massive electronic database containing our most personal medical records poses to individual privacy and security.

Similarly, I have also documented, one medical records data breach after another, some due to hackers/identity thieves and some as a result of gross hospital incompetence and negligence (and more). In addition, I've detailed how states, like California for instance, are trying to create a set of privacy standards for these records that often means merging state rules and federal ones.

Given the lack of consistency, for instance, between California’s Confidentiality of Medical Information Act (CMIA) and the federal HIPAA (The Health Insurance Portability and Accountability Act), there is no single, comprehensive “rule” for the use and disclosure of health information in our state.

Thus the debate taking place over what kind of privacy standards and protections should apply to EHR’s centers around a few core principles: accountability among parties involved in processing electronic transactions, consumer control over how their information is shared and the availability of access to it, transparency (so anyone who accesses files is recorded and made available to the consumer if desired), and system security to ensure a patients private information is protected from identity thieves, overzealous law enforcement, or unwanted marketers.

Now that I've briefly gone over some of the general fundamentals of this very complex issue, I want to discuss two articles that have come out in the past week or so, one about the UC Regents dragging its feet in the lawsuit against it for a medical records data breach at the UCLA Health System, and the other, a MUST READ from the Los Angeles Times Michael Hiltzik entitled (apt for this blog), "Her case shows why healthcare privacy laws exist."

I want to bring these up because they demonstrate, particularly the Los Angeles Times piece, WHY the work that, in California for instance, CalOHII (State of California Office of Health Information Integrity) is doing to come up with ironclad privacy protections for the state to adopt is so important (full disclosure: I'm on the privacy steering committee).

Let's begin with Hiltzik's piece because it truly blows the mind, and brings home why this MATTERS. He writes:

Of all the personal information that you might want to keep private, your medical records are the most important. That's why federal and state laws carry stiff penalties, up to and including jail time, for healthcare providers who let such data loose into the wild.

So you should be aghast at how free and easy Prime Healthcare Services and two executives at Prime-owned Shasta Regional Medical Center have been with the medical chart of a patient named Darlene Courtois. They showed the entire chart to an editor of her hometown newspaper, and Prime's corporate office divulged some of her medical examination results to me (though I didn't ask for them). They didn't have her permission for those disclosures, her daughter says.

...

Here's what state and federal laws have to say: A hospital can't disclose a patient's medical information publicly, such as to a newspaper, without the patient's written authorization. The authorization has to be very specific, designating exactly which records may be disclosed and to whom.

The applicable laws are the federal Health Insurance Portability and Accountability Act of 1996, which is known as HIPAA, and the 2008 California Confidentiality of Medical Information Act. The covered records include any information about an individual's "past, present or future physical or mental health or condition," and "the provision of health care to the individual." (The language comes from the federal government's published privacy rule summary.)

There are a few limited circumstances in which a healthcare provider doesn't need permission. Chiefly these fall into the categories of "treatment, payment and healthcare operations" — in other words, charts can be seen by doctors treating the patient or insurers paying for care, or in connection with hospital functions such as evaluating doctors' competency — and regulatory activities or subpoenas.

...

Under the law, there's no such thing as an implied authorization by a patient for disclosure of personal records, said Linda Ackerman, a San Francisco expert in privacy law.

The office of civil rights of the U.S. Department of Health and Human Services, which enforces HIPAA, put it this way: "There is no 'waiver' that would apply to the release of a chart or medical record to the media without an individual's written authorization."

Several experts told me it doesn't matter if the hospital was trying to contradict misinformation provided by a patient (even if that's what Courtois did, which is debatable). Under the law, patients themselves can divulge anything they wish about their medical conditions and their treatment by a hospital. But a hospital's obligation is to keep its mouth shut. A desire to deflect bad PR is not an excuse. Even if they think they're in the right, the law says healthcare providers have to suffer in silence, the experts say.

Anthony Wright, executive director of the statewide patient advocacy group Health Access California, also mentioned the "chilling precedent" of a hospital company exposing a patient's personal information just because she criticized the company in public. Indeed, the lesson of the Courtois case is clear: Give an interview about your experience at a Prime-owned hospital, and don't be surprised if the hospital responds by exposing the most private details of your medical history to the world. 

Click here for more.

I would have to say, in addition to the blatant disregard for the privacy, and the RIGHTS of Darlene Courtois demonstrated by Prime, I find Anthony Wright's point on this serving as a "chilling effect" against patients who may speak out, to be of particular concern. I say this because all too often, as a consumer advocate, industry's from chemical to big pharma to big oil, and on down the line, we see intimidation, obfuscation, and in fact, a factoring in of the damage they cause people and the planet into their business model. I would HATE to think that EHR's could serve as yet one more tool to protect these kinds of corporate interests from proper justice and accountability.

My sense is, that in the case of Prime, its so egregious, there will be accountability, and this chilling effect will not take root. But, that is why I brought up the issue of factoring in the cost of the damage these corporate interests do into their business model: will the damages Prime faces outweigh the benefits, they, and other vultures like them, feel they might get from such intimidation?

This also is why, as Hiltzik rightly states in the articles title, "Her case shows why health care privacy laws exist", and why, INCREASED privacy protections, and increased accountability and enforcement, are also necessary...and must also exist.

On a similar note, let's look at the case of the UCLA Health System data breach and the lawsuit against it (remember, as I pointed out in a recent post, hospitals are NOT doing their job, and spending the required resources to protect these EHR's to date). As the Daily Bruin reports:

The UCLA Health System reported in November 2011 that a hard drive containing more than 16,000 patients’ information had been stolen from the home of a UCLA physician on Sept. 6, 2011.

Social Security numbers and financial information were not among the documents stolen, but they did include first and last names and may have contained birth dates, medical record numbers, addresses and medical record information, according to the Health System’s statement.

The lawsuit claims the September incident was a violation of the California Confidentiality of Medical Information Act, in place to protect the privacy of patients’ personal histories and information. The suit is calling for $1,000 in damages for each patient on the hard drive. The total cost of the suit for the Health System could amount to as much as $16 million, including the legal fees associated with the case.

...

While storing information online is an increasingly common practice, and can certainly coexist with patient privacy rights, the potential for data breach is significantly higher than a paper-based system, said Tena Friery, research director at the Privacy Rights Clearinghouse, a national nonprofit organization focused on consumer privacy protection.

She also cited a 2011 study revealing that 71 percent of health care organizations had suffered a data breach in the last year.

Kabateck was also involved in a case concerning similar violations against Stanford University’s Hospital and Clinics late last year, filed on behalf of 20,000 patients whose information was released onto a public website through a third party. 

Click here to read more.

Obviously, this brings me back to the same key points at the article before it...how do we prevent this MASS amounts, in some cases (as in Prime), intentional, data breaches from occurring? This, my friends, is serious business. And, as such, I would urge we seek and demand adequate penalties against those responsible for such breaches to ensure they don't keep happening going forward. This means BOTH privacy standards AND enforcement/security/accountability.

As I wrote in past posts, "If medical records fell into the wrong hands at worst they could be used for a host of purposes unrelated to improving your health: advertisers might flood our email inboxes with even more spam and patients may not feel so comfortable having an honest conversation with their doctor if it could end up for all to see. This treasure trove of personal information would also be a goldmine for insurance companies, drug companies, data mining companies, and software companies....


When it comes to the issue of e-health records certainly one question the consumers should ponder is "Where is my data and who has access to it and for what purposes?" Or perhaps even more importantly, "can my private data be traced back to me personally and sold to others?"...Clearly, what is MORE than clear now is that we need MORE attention paid to privacy, not less...and that means taking a bit more time to get this new system up and running...and more care given to the rights of patients...not hospitals, not suppliers, not the government, and not any other interest looking to profit off this transition. We can have BOTH privacy and a more efficient medical records system...there's no need to sacrifice one for the other.

Congress and FBI Seeking to Expand Use of Biometric Identifiers

A few months back I posted a pretty extensive blog on Facial Recognition technology and the threat it poses to individual privacy. As I've done in the past, because I know not everyone can read every post, I'll repeat a few of my thoughts here today before I get to an outstanding piece by Tana Ganeva of Alternet not JUST about the massive FBI database - the "largest biometric database in the world," - containing records for over a hundred million people, but also the agency's plans for Next Generation Identification (NGI), “a massive, billion-dollar upgrade that will hold iris scans, photos searchable with face recognition technology, palm prints, and measures of gait and voice recordings alongside records of fingerprints, scars, and tattoos. - particularly in the workplace (which is especially disturbing).”

For some backdrop on biometrics, you can check out a past post I did about another article by Tana, entitled 5 Unexpected Places You Can Be Tracked With Facial Recognition Technology. As I wrote then, this issue has particular interest to me due to California's recent fight that we (Consumer Federation of California) were deeply involved in - whether biometric identifiers should be used by the DMV (we were able, with a host of other groups, to stop them).

As for the larger concern over facial recognition technology, groups from the Privacy Rights Clearinghouse (PRC) to the ACLU to the Electronic Frontier Foundation to EPIC have all been very active in making the case that there is a very real threat to privacy at stake in determining just how, and when, this technology can be used.

Again, going back to a prior post, I wrote: "First, let me refresh everyone on the concept of biometric identifiers - like fingerprints, facial, and/or iris scans.  These essentially match an individual’s personal characteristics against an image or database of images. Initially, the system captures a fingerprint, picture, or some other personal characteristic, and transforms it into a small computer file (often called a template). The next time someone interacts with the system, it creates another computer file.

There are a number of reasons why such technological identifiers should concerns us. So let's be real clear, creating a database with millions of facial scans and thumbprints raises a host of surveillance, tracking and security question - never mind the cost. And as you might expect, such identifiers are being utilized by entities ranging from Facebook to the FBI. In fact, the ACLU of California is currently asking for information about law enforcements’ use of information gathered from facial recognition technology (as well as social networking sites, book providers, GPS tracking devices, automatic license plate readers, public video surveillance cameras)."

But for today’s sake, let’s hone in on the articles by Tana Ganeva in Alternet entitled 5 Things You Should Know About the FBI's Massive New Biometric Database, as well as a piece by the Cato Institute detailing all the ways Congress is currently, and aggressively, pushing biometric identifying technologies.

First, let me list the bills, as identified in the Cato piece that all seek to expand and promote these technologies:

• A Reauthorization and Reform Act of 2011, has passed the House and awaits action in the Senate. It says that “improved pilot licenses” must be capable “of accommodating a digital photograph, a biometric identifier, and any other unique identifier that the Administrator considers necessary.” 
• H.R. 1690, the MODERN Security Credentials Act, establishes that air carriers, airport operators, and governments may not employ or contract for the services of a person who has been denied a TWIC card. “TWIC” stands for “Transportation Worker Identity Card,” the vain post-9/11 effort to secure transportation facilities from bad people. TWIC cards use biometrics.
• The Army deploys biometrics. Public Law 112-10, the Department of Defense and Full-Year Continuing Appropriations Act, 2011 (cost per U.S. family: $13,500+) allowed spending on Army field operating agencies “established to improve the effectiveness and efficiencies of biometric activities and to integrate common biometric technologies throughout the Department of Defense.” 
• H.R. 1842 is an immigration bill called the Development, Relief, and Education for Alien Minors Act of 2011. (Senate version: S. 952) It would allow an otherwise qualified immigrant to get conditional permanent resident status only after submitting biometric and biographic data for use in security and law enforcement background checks. 
• S. 1258 does roughly the same thing with regard to any lawful immigration status. This bill is called the Comprehensive Immigration Reform Act of 2011, one of many attempts at comprehensive reform. In addition to requiring immigrants to submit biometrics, it also requires the government to issue “documentary evidence of lawful prospective immigrant status” that includes a digitized photograph and at least one other biometric identifier. The bill would also reinforce the use of biometrics in employer background checks and at the border. 
• H.R. 2463, the Border Security Technology Innovation Act of 2011, calls for continued study of mobile biometric technologies at the border. The Under Secretary for Science and Technology of the Department of Homeland Security would coordinate this research with other biometric identification programs within DHS. 
• H.R. 2895, the Legal Agricultural Workforce Act, would create a nonimmigrant agricultural worker program. In the program each nonimmigrant agricultural worker would get an identification card that contains biometric identifiers, including fingerprints and a digital photograph. 
• S. 1384, The HARVEST Act of 2011, is similar. In providing for the temporary employment of foreign agricultural workers, it calls for “a single machine-readable, tamper-resistant, and counterfeit-resistant document” that verifies the identity of the alien through the use of at least one biometric identifier. 
• H.R. 3735, the Medicare Fraud Enforcement and Prevention Act of 2011, would establish a biometric technology pilot program. The five-year pilot program would use biometric technology seeking to ensure that Medicare beneficiaries “are physically present” when receiving items and services reimbursable under Medicare. How many biometric scanners would have to be out there for that to work? 
• S. 744, the Passport Identity Verification Act, calls on the Secretary of State to conduct a study into whether people applying for or renewing passports should provide biometric information, including photographs that facilitate the use of facial recognition technology.
• …S. 1604, the Emergency Port of Entry Personnel and Infrastructure Funding Act of 2011, establishes a grant program in which the Department of Homeland Security would give cash out to state and local law enforcement for the purchase of various technologies including “biometric devices.”

Clearly, biometrics is on the “to do” list of our Congress. But it gets worse, and that’s where the FBI’s massive database, and its plans to expand it, comes in.

As Tana Ganeva illustrates:

NGI will expand the type and breadth of information FBI keeps on all of us," says Sunita Patel of the Center for Constitutional Rights. "There should be a balance between gathering information for law enforcement, and gathering information for its own sake."

Here are 5 things you should probably know about NGI: 

1. Face Recognition

This month, the FBI is giving police departments in 4 states access to face recognition technology that lets them search the agency's mugshot database with only an image of a face. Police can repay the favor by feeding the FBI mugshots they collect from local arrests, bulking up the agency's database with images of more and more people.

…

2. Iris Scans

Iris-scanning technology is the centerpiece of the second-to-last stage in the roll-out of NGI (scheduled for sometime before 2014). Iris scans offer up several advantages to law enforcement, both in terms of identifying people and fattening up databases. 

The pattern of an iris is so unique it can distinguish twins, and it allegedly stays the same throughout a person's life. Like facial recognition, iris scans cut out the part where someone has to be arrested or convicted of a crime for law enforcement to grab a record of their biometric data.

…

3. Rap-Back System

A lot of the action in the FBI's fingerprint database is in background checks for job applicants applying to industries that vet for criminal history, like taking care of the elderly or children, hospital work, and strangely, being a horse jockey in Michigan. As Cari Athens, writing for the Michigan Telecommunications and Law Review points out, if a job applicant checks out, the FBI either destroys the prints or returns them to the employer. But that's no fun if the goal is to collect vast amounts of biometric data!

…

4. Data Sharing Between Agencies

The roll-out of NGI advances another goal: breaking down barriers between databases operated by different agencies. One of the directives of the billion-dollar project is to grease information swapping between the Department of Homeland Security, the State Department, the Department of Justice, and the Department of Defense. The DOJ and DHS have worked toward "interoperatibility" between their databases for years. In 2009, the Department of Defense and DOJ also signed on to an agreement to share biometric information. 

…

5. NGI and Secure Communities (S-Comm)

One recent test run in interagency data-sharing has not gone particularly well: Secure Communities, a DHS program that lets local law enforcement officials run the fingerprints of people booked in jails against the IDENT database to check their immigration status and tip off ICE to undocumented immigrants. 

Like many policies targeting America's immigrant population, Secure Communities (S-Comm) -- pitched as protection against violent criminals -- devolved into dragnets and mass deportations, with people getting dragged in for minor offenses like missing business permits and even for reporting crimes. In one incident a woman called the police about a domestic violence incident, only to be ensnared in deportation proceedings herself. As Marie Diamond points out in Think Progress, DHS's immigration databases have so many errors that the program "routinely flags citizens as undocumented immigrants." 

…

What could possibly go wrong? 

Advancements in the collection of biometric data are double-edged: there's the threat of a massive government surveillance infrastructure working too well -- e.g., surveillance state -- and there are concerns about its weaknesses, especially in keeping data secure. 

A breach of a sophisticated, multi-modal biometric database makes for a nightmarish scenario because the whole point of biometric data is that it offers unique ways to ID people, so there's no easy fix -- like a password change -- for compromised biometric data. Pointing to the dangers of identify theft of biometric data, Patel observes that, "Unlike a password, the algorithm of an iris can't be changed."

Read more here.

As I have often stated, "What concerns me is what are the side effects of living in a society without privacy. Where are we left when the power of corporate or government interests to monitor everything we do is absolute?

Whether its the knowledge that everything we do on the internet is followed and stored, that we can be wiretapped for no reason and without a warrant or probable cause, that smart grid systems monitor our daily in home habits and actions, that our emails can be intercepted, that our naked bodies must be viewed at airports and stored, that our book purchases can be accessed (particularly if Google gets its way and everything goes electronic), that street corner cameras are watching our every move, and that RFID tags and GPS technology allow for the tracking of clothes, cars, and phones (and the list goes on)...what is certain is privacy itself is on life support in this country...and without privacy there is no freedom. I also fear how such a surveillance society stifles dissent and discourages grassroots political/social activism that challenges government and corporate power...something that we desperately need more of in this country, not less."

Electronic Health Record Data Breaches Surge

Most of us have come to the obvious, inevitable realization that we are going to shift (and in fact are doing so right now) what are currently called personal health records from a paper system to an electronic one. Having your medical records computerized and stored electronically promises to reduce medical errors - including prescribing the wrong medications. The National Academy of Sciences' Institute of Medicine estimates between 44,000 and 98,000 people in the United States die each year because of errors such as being prescribed medicine to which they are allergic.

These EHR’S offer an easier way to collect, double-check and complement the information you receive from your physician. At the very least, your records can help you speed through waiting room forms and prompt important conversations with your physicians. If your doctor writes a new prescription, you can use your current medication list to ask about any interactions with the new drug. Or if your records suggest it’s time for a colonoscopy, you might make time to discuss the pros and cons of the procedure.

EHR’S can also allow you to access your health information to prepare for medical appointments. As laid out by Patient Privacy Rights, "It can enable you to communicate better with your healthcare providers about your medical needs. People with chronic health conditions may use them to keep track of such things as how their medications are affecting them, or how they’re feeling from day to day. People with hypertension might want use it to track their blood pressure readings."

Transitioning to a health information exchange will create much more patient data in electronic formats than ever before in history. The privacy threat posed by the interoperability of a national network is a key concern because in order for the records to be readily available and accessible they would have to be linkable and searchable.

If medical records fell into the wrong hands at worst they could be used for a host of purposes unrelated to improving your health: advertisers might flood our email inboxes with even more spam and patients may not feel so comfortable having an honest conversation with their doctor if it could end up for all to see. This treasure trove of personal information would also be a goldmine for insurance companies, drug companies, data mining companies, and software companies.

I give you this backdrop because we are witnessing increasing numbers of data breaches that are exposing - on a mass level - peoples personal health records.

Before I get to the latest news on partly why these breaches are occurring (hospitals skimping on their security costs), let me layout some of the data and its costs we ALREADY knew about:

• More than 11 million consumers have had medical data stolen or inappropriately disclosed since September 2009, and the privacy breaches are expected to rise as more health information is put online, according to the report released today by the New York-based accounting firm’s health research institute.
• While the report didn’t specify how many security thefts were carried out by insiders, 40 percent of surveyed providers reported an incident of improper internal use of protected health information during the past two years. 
• Health organizations notified approximately 5.4 million individuals affected by patient health data breaches in 2010, compared to approximately 2.4 million individuals in 2009.
• HHS' latest report to Congress revealed that in 2010 theft was the most common cause of large breach incidents that affected 500 or more individuals. Among the 207 breaches that covered entities such as healthcare providers, health plans, and healthcare clearinghouses reported last year, 99 incidents involved theft of paper records or electronic media, combined affecting approximately 3 million individuals. 
• In 2010, the second highest number of data breaches involved the loss of electronic media or paper records, with 33 reported cases that affected more than 1 million individuals. There were 31 breaches that involved unauthorized access to, or uses or disclosures of, protected health information that affected approximately 1 million individuals. Other breaches included 19 incidents resulting from human or technological errors that affected approximately 78,663 individuals. Eleven covered entities reported breaches caused by the improper disposal of protected health information that affected approximately 70,000 individuals.

Now that we've gone over just a few of the reasons why this is all so important, and why concerns articulated by privacy advocates that STRICT privacy safeguards, at every step of the transition process must be implemented have been proven true, lets get to some of the reasons WHY such breaches are occurring.

As Business Week reported: 

Data breaches at U.S. health-care providers are increasing as hospitals adopt electronic medical records and mobile technology without spending enough on security to ensure patient privacy, a research group said.

The frequency of data breaches at health organizations jumped 32 percent in 2011 from a year earlier, costing the industry an estimated $6.5 billion, according to a study released today by the Ponemon Institute LLC, a Traverse City, Michigan-based information-security research group.

Forty-nine percent of health organizations said that lost or stolen devices were to blame for breaches, according to the institute, which surveyed 72 hospitals and health providers. The study didn’t name the organizations surveyed.

...

Fifty-three percent of the organizations surveyed said that inadequate funding was the biggest barrier to preventing data breaches, according to the study.

U.S. data-breach notification laws for health organizations are making providers more aware of their security vulnerabilities, Ponemon said. Data breaches affecting more than 500 people must be reported to the Health and Human Services Department, which posts a list of incidents on its website.

Health providers, insurers and their business partners reported 373 breaches affecting almost 18 million individuals between September 2009 and October of this year, according to the list, which is tended by the Health and Human Services Department’s Office of Civil Rights.

In  fact, the Privacy Rights Clearinghouse listed the now notorious Sutter Health data breach as one of the largest of the year. Amber Yoo, the organization's Communications Director recently wrote in the California Progress Report, "Sutter Physicians Services (SPS) and Sutter Medical Foundation (SMF) (Nov. 16) - A company-issued desktop computer was stolen from SMF's administrative offices in Sacramento, California, during the weekend of October 15th. Although the data was password protected, it was not encrypted. Approximately 3.3 million patients whose health care provider is supported by SPS had their names, addresses, dates of birth, phone numbers, email addresses, medical record numbers and health insurance plan name exposed. An additional 934,000 SMF patients had dates of services and description of medical diagnoses and/or procedures used for business operations, bringing the total to 4.2 million patients. At least two lawsuits have been filed against Sutter Health. One class-action suit alleges that Sutter Health was negligent in safeguarding its computers and data, and then did not notify the millions of patients whose data went missing within the time required by state law....The security lapse occurred on two levels: both the data itself (being unencrypted) and the physical location (stored in an unsecure location). Although no Social Security numbers or financial information were apparently exposed, all the data elements needed for medical identity theft were included in the stolen records.

In addition, Amber points out another massive breach, writing, "Nine data servers containing sensitive health information went missing from Health Net's data center in Rancho Cordova, California. The servers contained the personal information of 1.9 million current and former policyholders, compromising their names, addresses, health information, Social Security numbers and financial information. Not only was Health Net the first massive medical breach of the year, but the company waited three months before notifying affected individuals. The servers were discovered missing in January, but policyholders were not notified until March. The breach highlights the importance of timely notification."

The good news, as if there is any in all this, is that California recently implemented one of the strongest data breach notification laws in the country - one we here at the Consumer Federation of California worked hard to pass the legislature and convince Governor Brown to sign. Now, thanks to the law, any breached entity must submit their notice letters to the California Attorney General. The AG's office will then post the letters on its website. In addition, the notifications sent to individual who's private information was breached will be clearer, more detailed, with specific recommendations for what to do no next, including who to call.

As for the larger issue of electronic health records, as these breaking news stories make clear, time is running out, because states across the country, including California, are working to implement such a system, with consumer privacy perhaps the paramount area of dispute.

We know such a system will save money and improve health care (though how significant these improvements and savings will be is still in question), but what remains contentious - and rightly so - is the intrinsic threat a massive electronic database containing our most personal medical records poses to individual privacy and security.

When it comes to the issue of e-health records certainly one question the consumers should ponder is "Where is my data and who has access to it and for what purposes?" Or perhaps even more importantly, "can my private data be traced back to me personally and sold to others?"

But as it stands today, there still aren't uniform standards for electronic medical records. Yes, there are some protections in the Health Insurance Portability and Accountability Act of 1996, as well as some in the stimulus bill. But key protections are still absent, and state laws often conflict with federal ones.

For instance, the federal law on the books only require that patients are notified when their information was disclosed in the course of treatment but not how it was used. As a result, the patient will not know which hospital personnel looked at the information or for what purpose.

Clearly, what is MORE than clear now is that we need MORE attention paid to privacy, not less...and that means taking a bit more time to get this new system up and running...and more care given to the rights of patients...not hospitals, not suppliers, not the government, and not any other interest looking to profit off this transition. We can have BOTH privacy and a more efficient medical records system...there's no need to sacrifice one for the other.

Federal Probe Of Carrier IQ Launched

For all the background you could ever need on the Carrier IQ controversy check out my recent posts on the subject, starting from earliest to the latest, here, here, and here.

As we know, executives from Carrier IQ — the company whose spying software was secretly installed in as many as 150 million cellphones — went to Washington to answer questions posed by the Federal Trade Commission and the Federal Communications Commission.

As I have written too many times to count on this blog, a lot of this comes down to data ownership and control - as in its OUR data and it should be in OUR control. Clearly, in the case of Carrier IQ and increasing numbers of telecom companies, third party marketers, and many more, we are seeing the invasion of individual privacy on a mass scale, including locational tracking and web search monitoring.

Now to the latest news: The FTC and FCC are looking into this matter closely...but we need and deserve more than just a questioning of Carrier IQ, but an investigation into what companies like AT&T, Sprint and T-Mobile are doing with our data as well.

With that, let's get to the Washington Posts coverage of these new inquiries:

Federal investigators are probing allegations that Carrier IQ software found on about 150 million cellphones tracked user activity and sent the information to cellphone companies without informing consumers, according to government officials...The FTC inquiry was confirmed by officials who spoke on condition of anonymity because it is private. An FTC spokeswoman said she could not confirm or deny whether the agency was investigating Carrier IQ. But a spokesman for Carrier IQ said company executives were cooperating with federal agencies.
...

Carrier IQ has said that its software is not designed to capture keystrokes or the content of messages but that in some cases that might have happened by accident. The data are intended to help improve the user experience with smartphones, the company said.

Woods said Carrier IQ chief executive Larry Lenhart and Coward met with regulators at the FTC and the FCC. The Carrier IQ executives also met with the staffs of three senators — Richard Blumenthal (D-Conn.), Christopher A. Coons (D-Del.) and Al Franken (D-Minn.) — who each had written letters of concern to Lenhart.

Three of the four major cellular providers — AT&T, T-Mobile and Sprint — have said they use the company’s software in line with their own privacy policies. A Verizon spokesman said the program is not on any of the company’s mobile devices. Apple has said it would remove Carrier IQ from i­Phones in a future software update.

Rep. Edward J. Markey (D-Mass.) asked the FTC on Dec. 2 to investigate the practices of Carrier IQ as possibly unfair or deceptive. “I have serious concerns about the Carrier IQ software and whether it is secretly collecting users’ personal information, such as the content of text messages,” said Markey, co-chairman of the Bi-Partisan Congressional Privacy Caucus. “Consumers and families need to understand who is siphoning off and storing their personal information every time they use their smartphone.”
...

While Carrier IQ executives were meeting with federal regulators, another controversy about the company erupted in the blogosphere. A response by the FBI to a reporter sparked rumors that the bureau was using the software for domestic surveillance.

The FBI denied a request for information regarding Carrier IQ filed by a reporter for MuckRock News under the Freedom of Information Act. The reporter had asked for “manuals, documents or other written guidance used to access or analyze data” gathered by any Carrier IQ program. In denying the request, the FBI said it had information but could not disclose it, because it was considered “law enforcement records.”

...

The backlash following Eckhart’s research has prompted several lawsuits against the company, mobile carriers and handset makers, including two class action lawsuits in Illinois. A class-action lawsuit has also been filed against AT&T, Sprint Nextel, Apple, T-Mobile USA, HTC, Samsung, Motorola and Carrier IQ by mobile phone customers in Delaware.

Click here to read more.

There are two particularly important developments here, one, that the FTC and FCC are looking into this controversy and two, the fact that the FBI and its potential use of this technology is being discussed and questioned. From the beginning, when I see the potential "uses" of this kind of tracking technology, in addition to the usual concerns, from stalkers to identity thieves to third party marketers, I worry about law enforcement access.

These concerns are especially resonant with me because two major battles over smart phone privacy are being fought in the courts and the California legislature as we speak: one being whether law enforcement can track individuals locations in real time without a warrant, and two, whether law enforcement can search someones smart phone, also without a warrant. Its not much of a leap to also suspect they'd want access to the treasure trove of information being collected by a technology like Carrier IQ.

As I detailed last post, there is debate now over whether Carrier IQ actually collects every keystroke, and therefore the contents of text messages and emails.  However, The Electronic Frontier Foundation has just released a technical report on Carrier IQ that concluded that "keystrokes, text message content and other very sensitive information is in fact being transmitted from some phones on which Carrier IQ is installed to third parties."

As CNET reported, "This is most likely inadvertent and "happens when crash reporting tools collect copies of the system logs for debugging purposes," Peter Eckersley, technology projects director for the EFF, wrote in the report.

"Our software does not communicate with Android and does not transmit any files up to Google or anybody else," Coward said today. "Our implementation, the only thing we are sending out is metrics ... if other information is going out of the device to Google or anyone else it has nothing to do with Carrier IQ."

"There should not be personal information written into the Android log files. Applications can get ahold of them, on the one hand, which is not good," he continued. "We've implemented a new procedure as we qualify our software on devices (and) we check that...We saw the Android log file may be receiving messages from our software but ... also from other applications too. So it's a generic issue here with regard to Android log files that the industry needs to address and we point that out in the report." 

Clearly there are a lot more questions in need of answers. 

As the Free Press noted in a recent action alert, "Mobile phones are the new frontlines in the battle over our right to communicate." As for next steps, I'm also in agreement with Free Press in that its time Congress takes a closer look at the role of companies like AT&T, T-Mobile, and Sprint - particularly as it relates to what's being done with our data.