Another "Do Not Track" Bill Proposed in Senate

For all intents and purposes, it appears "do not track" is the privacy story of the past few months. For good reason, there has been a virtual explosion in data collection, data analysis and use of behavioral marketing on the internet without the requisite privacy protections to go along with it.  The fact is, billions of dollars at stake, and your private information is the currency.

Before I discuss the latest legislation advocating for a "Do Not Track" mechanism on web browsers from Senator Jay Rockefeller, let me provide some back-story first. We know for a fact, and they have been sued for it, companies like Google, Yahoo, Microsoft and other Internet companies track and profile users and then auction off ads targeted at individual consumers in the fractions of a second before a Web page loads.

That in itself, may not be all that threatening to most. But it raises some interesting questions: What kind of control should we have over our own data? And, what kind of tools should be available for us to protect it? What about ownership of our data? Should we be compensated for the billions of dollars being made by corporations from their tracking of us? And of course, what of the government's access to this new world of data storage?

The argument from privacy advocates has largely been that this massive and stealth data collection apparatus threatens user privacy and regulators should compel (not hope that) companies to obtain express consent from consumers before serving up "behavioral" ads based on their online history.

For instance, in the Kerry-McCain legislation (that supposedly compliments Rockefeller's bill), Internet companies would be asked to acknowledge that the data they collect about a person's online movements through software "cookies" embedded in a Web browser allows advertisers to know details about them, even if those cookies don't have a person's name attached. More generally, particularly on the issue of privacy on the Internet, the fact that we have next to no privacy standards as related to these technological innovations and trends is disturbing, and more than enough of a reason for legislation like that being offered by Rockefeller (and in California in the form of SB 761) and others.

Rockefeller's bill would create a “universal obligation for all online companies” to not track people who set a browser flag or cookie saying they don’t want to be tracked. The Do Not Track flag is a rather simple concept that's already been built into Firefox and IE9. If users choose to turn on the option, every time they visit a web page the browser will send a message to the site, saying “do not track.”

In explaining the bills need, Rockefeller stated “Consumers have a right to know when and how their personal and sensitive information is being used online — and most importantly to be able to say ‘no thanks’ when companies seek to gather that information without their approval. This bill will offer a simple, straightforward way for people to stop companies from tracking their every move on the internet.”

The bill would also empower the FTC to go after companies that disobey the flag. Companies can collect info needed for their service to work from users who set the flag, but must destroy it or anonymize it once it’s no longer needed.

As detailed by Ryan Singel of Wired Magazine, "The likely winner if such a bill passes is oddly Facebook, since the company targets its ads based on the information that users explicitly provide it, which puts it beyond the bill’s reach. Google faces the most risk, since, depending on the bill’s wording, it could apply not only to its far-reaching advertising network, but also to its collection of user’s search terms."

As you might guess, web firms generally oppose “do not track” rules - arguing that companies can create their own tools to help users manage tracking. Of course, this whole "voluntary" compliance argument made by corporate interests seeking to maximize profits at all costs simply doesn't hold water.

E-Week has more on this legislation and the reaction from some privacy advocates:


The Consumers Union, the Electronic Frontier Foundation, Consumer Action, the Center for Digital Democracy and the American Civil Liberties Union all spoke in favor of the bill during a May 9 conference call. The bill offered "crucial civil liberties protection for the 21st century," Chris Calabrese, legislative counsel at the ACLU, said on the call.

"This legislation would give Americans the right and the right tools to browse the Internet without their every click being tracked," Consumer Protection Director Susan Grant said.

...


While it was heartening to see the industry coming out with its own solutions, there was no requirement or enforcing companies from complying with user preferences, said Ioana Rusu, regulatory counsel for Consumers Union. Rusu claimed that giving the agency and states’ attorneys general the authority to impose civil penalties against the companies that violate the rules was very important.

“This bill will put regulatory support behind these industry initiatives and make sure that online providers listen to the many consumers who want to clearly say ‘no’ to online tracking,” said Rusu.

The Rockefeller bill “complements” the online privacy bill introduced by U.S. Sens. John Kerry (D.-Mass.) and John McCain (R.-Ariz.) in April, Rusu said. The Kerry-McCain bill would require companies to inform users up-front what data was being collected and to provide a clear way to opt out of the collection. Consumer groups and privacy advocates criticized the fact that the Kerry-McCain bill did not explicitly address “do not track” and gave the Commerce Department too much power over regulating consumer online privacy.

The Rockefeller bill is expected to be discussed as an amendment

Rockefeller included mobile phones in the bill and the provisions would apply to mobile phone network operators as well as Websites and online advertising networks. The mobile phone provisions are important in light of recent reports that Apple and Google are tracking user locations using the user’s smartphone, according to Jamie Court, president of Consumer Watchdog.


Click here to read more.

It should be noted, that the most far reaching "Do Not Track" (DNT) and financial privacy legislation being proposed comes from Congresswoman, Jackie Speier. Her bill would essentially allow Internet users to opt-out from "cookies, sniffing, scraping, or any other new and creative methods developed by those looking to profit through these activities." The "DNT" legislation would allow the Federal Trade Commission to force online advertisers to respect the wishes of users who do not want to be tracked for marketing purposes.

Likewise, in California, SB 761 is modeled after the Speier bill, thus also offering consumers a "Do Not Track Me" mechanism, something the bill's sponsor describe as "one of the most powerful tools available to protect consumers' privacy." The mechanism will allow anyone online to send Websites the message that they do not want their online activity monitored.

Certainly one strong point of the legislation is that it is in line with public opinion, which a poll by Consumer Watchdog last summer found 80% of Americans support a Do Not Track option. In addition, a recent USA Today/Gallup poll found that most Americans are worried about their privacy and security when they use Facebook and Google.

Interestingly, though expected, the European Union is going even further by making the mechanism and opt-in, rather than opt-out. Let's face it, opt-out options are often confusing, and buried a few clicks away often in fine print (though 'Do Not Track" mechanisms will be easier to locate...which is a good thing). But for me, opt-in is superior not just due to "convenience". It goes deeper than that, its about having control over YOUR information. AS I have written here before, "If someone wants to borrow something of mine, like my car, I don't have to find a way to opt-out of doing so after they've taken it on a spin, they have to come to me first. The same should be true of what I do in my private time, on the net, or in my home (think smart meter)."

I'll continue to cover the details, and the progress, of these, and related bills.

Sen. Franken Holds Hearings on Mobil Device Tracking, Justice Dept. Wants More of It

As you probably are aware, a few weeks ago security researchers discovered that Apple's iPhone keeps track of EVERYWHERE you go – and saves every detail of it to a secret file on the device which is then copied to the owner's computer when the two are synchronized.

As I have written here before, the fact that Americans are losing their privacy as they travel through public space due to location-based technologies isn't debatable. The question, as is so often the case when it comes to issues at the intersection of privacy and technology, is what kind of say do we have in the matter and what kind of rules are in place protecting our privacy rights?

To help answer questions like these, Senator Al Franken decided to hold hearings on the topic yesterday - inviting Google, Apple, and the Justice Department to participate. The Senator also sent a letter to Apple a few weeks back questioning why it included the feature in its software in the first place. The letter reads, “The existence of this information — stored in an unencrypted format — raises serious privacy concerns,” He later emphasized the information — which could be “accurate to 50 meters or less” — also applies to iPhones and iPads owned by children, and could easily be exploited by “criminals and bad actors.”

Franken also asked Steve Jobs to explain whether the location data has been disclosed, and whether the same technology is also included as part of the operating system software that runs on the company’s popular MacBook laptops.

Yesterday's hearing is particularly significant in that it demonstrates a heightened interest in Congress in reforming federal laws on privacy, tracking and surveillance. But what stood out to me in Tuesday's hearings wasn't the ardent claims of "innocence" by Google and Apple, but rather, the asserted desire from the Justice Department that such companies should be mandated to store MORE consumer data, not less.

So, before I get to the specific arguments over the devices themselves, and Franken's comments, let me direct you to the article in CNet that details the bold, and disconcerting position of the Justice Department itself - a position completely, at least seemingly, at odds with the theme and purpose of the hearings themselves.

Declan McCullagh reports:

The U.S. Department of Justice today called for new laws requiring mobile providers to collect and store information about their customers, a proposal that pits it against privacy advocates and even other federal agencies.

Jason Weinstein, the deputy assistant attorney general for the criminal division, picked an odd place to describe the department's proposal: a U.S. Senate hearing that arose out of revelations about iPhones recording information about owners' locations, and, in some cases, transmitting those data to Apple without consent.

...

The Justice Department's suggestion conflicts with what the Federal Trade Commission--which also sent a representative to today's hearing--has recommended. A company should adopt a policy of "not collecting or retaining more data than they need to provide a requested service or transaction," said Jessica Rich, deputy director of the FTC's bureau of consumer protection.


"I believe that consumers have a fundamental right to know what data is being collected about them," Franken said. That can be, he said, "really sensitive information that I don't think we're doing enough to protect."

It should be noted that Weinstein didn't elaborate on whether the government wanted to require wireless providers to record location information as well - but it certainly seems likely they would view that as valuable too.

In related news, Sen. Ron Wyden is currently working on legislation that could become part of the chamber’s larger effort to set new rules for how and when federal law enforcement can access consumers’ location data. Something I believe - clearly after yesterday's hearing and the comments by Weinstein - is needed.

In that past, we had services such as EZ Pass (allows you to bypass stopping to pay the bridge toll), Google Latitude, the GPS tracking of cellphones, the right of police and government to track our whereabouts (both by phone and car), transit cards, social networking sites, WiFi networks, and more, all opening up a brave new world of real time, locational tracking of Americans.

We shouldn't view any of this as that big of a surprise then. A recent study by the Worcester Polytechnic Institute (WPI) in Massachusetts found that mobile social networks are giving data about users' physical locations to tracking sites and other social networking services. Researchers reported that all 20 sites that were studied leaked some kind of private information to third-party tracking sites.

As the report notes, "The combination of location information, unique identifiers of devices, and traditional leakage of other personally identifiable information all conspire against protection of users' privacy."

I addition, we also know that the FBI uses 'dragnet'-style warrantless cell phone tracking. In other words, there are more and more ways, through more and more devices, that can track and store our location, and that data is worth more and more money.

As for Apple, as a result of these recent revelations, the company is facing at least two lawsuits by consumers who allege the company violated federal computer fraud laws by capturing data information about their locations. In addition, Apple and Google face separate lawsuits by mobile users who allege that the companies transmitted their devices' unique identifiers with outside companies.

With that, let me get to some of what was discussed in the hearings. ZDNet reports:

....Davidson affirmed that Google never sells “users’ personally identifiable information

Even though users have the choice to opt-in to location sharing, there are plenty of unanswered questions left. Google execs haven’t provided information as to how long the data is stored, nor how this data might be used either by Google or third parties in the future.

The USA Today has more: 

"People have the right to know who is getting their information and how (it) is shared and used. I still have serious doubts those rights are being respected in law or in practice," said Sen. Al Franken, D-Minn., who chaired the hearing. "This is an urgent issue."

Franken scheduled the hearing of the Judiciary panel's subcommittee on privacy, technology and the law after recent incidents showed risks for consumers' data. In addition to researcher reports that mobile apps on Apple and Google devices shared location-based data with third parties, network breaches at Sony and Epsilon put customers' personal and financial information at risk.

"Federal laws do far too little to protect this information. … No one wants to stop Apple or Google from producing their products," Franken said, but Congress must "find a balance between all of those wonderful benefits (from devices) and the public's right to privacy."

Guy Tribble, Apple vice president of software technology, told Franken that Apple's devices gather and store location data only about nearby cell towers and Wi-Fi hot spots. Apple, he said, "does not share personally identifiable information with third parties for their marketing purposes without our customers' explicit consent … (and) Apple does not track users' locations. Apple has never done so and has no plans to ever do so."

Tribble added that a coming software upgrade will encrypt the location data on devices.

In all, I give kudos to Senator Franken for bringing this issue out into the open. He appeared to get both companies to admit that a "clearer and more understandable" privacy policy is necessary. But then, who reads privacy policies?

As I wrote in a prior post, "A constantly monitored citizenry used to conjure up images of totalitarian states - not Google and I-Phones. And granted, now technology does the surveillance — generally in the name of being helpful and entertaining, not to stifle dissent or oppress the public.

This fact does not mean that these technologies can't still be used in ways that don't reduce freedoms, play into the hands of overly aggressive and/or oppressive governments, or invade privacy by using our personal information to maximize corporate profit. Perhaps its time for a serious conversation about how much of our privacy of movement we want to give up - and how much control do we get over that decision?"

"Do Not Track" Legislation Clears Hurdle - Facebook/Google Oppose

As I wrote about last month, State Senator Alan Lowenthal and our friend's at Consumer Watchdog are carrying a bill that would allow California consumers to stop unwanted online tracking. The bill, SB 761, would offer consumers a "Do Not Track Me" mechanism, something the bill's sponsor describe as "one of the most powerful tools available to protect consumers' privacy. The mechanism will allow anyone online to send Websites the message that they do not want their online activity monitored.

The reason I'm going back to the bill today is twofold. One, California’s State Senate Judiciary Committee voted on Tuesday to move it  forward to the Appropriations Committee. And two, two of privacy's greatest enemies - Facebook and Google - have come out guns a blazing against the legislation (surprise!). Now, before I get to the article in Marketwatch about this increased new fire coming the bills way, let me provide some backdrop for those that are unfamiliar with the legislation.

The legislation would be the first in California to explicitly provide for a Do Not Track mechanism, and its modeled after a federal Do Not Track bill introduced in Congress by Rep. Jackie Speier.

Public opinion is clearly on the side of privacy advocates, as a poll by Consumer Watchdog last summer found that 80% of Americans support a Do Not Track option. A recent USA Today/Gallup poll found that most Americans are worried about their privacy and security when they use Facebook and Google.

As I also wrote in the previous post on this legislation, "I have talked about this interesting dichotomy a lot. This being the fact that while people see to "care" about privacy on one level, they tend to do very little to actually do so. Which in my mind, makes easy to use, clear options to protect privacy all the more paramount. Once people are given such a choice, not only will more people choose to "not be tracked", I think more people will become more AWARE of just how all pervasive such monitoring of nearly everything we do has become."


The fact is, there's no longer any anonymity on the Web. The most personal information about people's online habits is collected and eventually bought and sold, often instantaneously and invisibly. Data collection practices have become a business in themselves, driven by profits at consumers' expense. The Wall Street Journal recently highlighted these practices—which included targeting children—in its groundbreaking series "What They Know."

A few other factoids to consider before I get to the article, as detailed by Senator Lowenthal: Nearly 80% of Californians use the internet and nearly 45% use Facebook. But, today millions of Californians are unaware that their online behavior is being tracked; their data collected and sold to advertisers. The type of data that is collected is far reaching. Anywhere from the type of sites a person frequents, to the time of day and the location from where the person is accessing the sites. Most disturbing, however, is that the information that is being shared may include very personal information such as a name, home address, email address, or financial information.

As Beth Givens, Privacy Rights Clearing House Director said, "A Do Not Track Me mechanism gives consumers a simple way to tell websites not to spy on them and not to collect detailed profiles of their web usage. Consumers should have the right to control how their data is used or whether it is gathered at all."

Now let's get to what appears to be a campaign by Google and Facebook to defeat the bill. Marketwatch reports: 

Large Internet firms have generally bristled at the notion of regulating their collection of user data, which helps target online advertising. Companies argue that policing their own, collective privacy policies makes more sense than passing legislation. An Internet privacy bill proposed recently at the federal level does not include a specific Do Not Track provision.

....

Facebook, Google and other Internet firms have lobbied California lawmakers this year on Sen. Lowenthal’s proposed Do Not Track legislation, according to public filings.

In a letter sent last week to Sen. Lowenthal, Facebook, Google and a number of other firms wrote that his proposed legislation would create unnecessary confusion and would add significant new costs for cash-strapped regulators.

“The measure would negatively affect consumers who have come to expect rich content and free services through the Internet, and would make them more vulnerable to security threats,” the companies wrote in the letter, reviewed by MarketWatch.

...

During the State Senate Judiciary Committee hearing on Tuesday, Sen. Lowenthal acknowledged the new privacy tools offered by individual firms, but added that “the mechanism is often not simple, or user-friendly.”

Jeff Chester, a privacy advocate and executive director of the Center for Digital Democracy, said that strong Do Not Track legislation has made little progress in Washington, D.C. — making a focus on state bills necessary. “The online ad lobby has convinced Washington that Do Not Track will kill off the Internet economy,” Chester said. “We think there’s a real role now for states to come in, and regulate the profiling going on within their borders.”

Chester said that if California does not ultimately pass Sen. Lowenthal’s Do Not Track bill, he and others may push for a related ballot initiative in the state...Chester said it’s natural that Internet firms, which rely on serving relevant advertising to a growing number of users, would challenge Sen. Lowenthal’s Do Not Track bill, as “they have the most to lose.”

“We now have new poster children for the California Do Not Track campaign, Sergey Brin and Mark Zuckerberg,” Chester said, in reference to founders of Google and Facebook. 

Click here to read more.

As I have also written before, its not by accident that we are told by the same interests that profit off our information that privacy is dead, and people don't care about it anymore, or that it will "kill business". Well, that's easy to say when you are the ones developing the complicated and difficult to find privacy settings consumers have to deal with - and profiting off our personal information without our consent.

More to the point is the simple, unavoidable point that consumers should have MORE control, not less, over what information of ours is used, shared, and profited off. This bill is one step of many needed to establish certain core, DotRights (see ACLU's Dotrights campaign).

The good news is the 

The Fourth Amendment and GPS Tracking

As I've written in excruciating detail about on this blog, the Obama Administration has been a complete disappointment on issues related to privacy and civil liberties. To be sure, I never expected his actions as President to fully match his words as a candidate - this is rarely EVER the case, particularly when it comes to issues related to national security - but the two seem to have diverged to such a degree that they now represent diametrically opposed worldviews.

As I have also said, with the passage (and renewal) of the Patriot Act, and the technological advancement in things like RFID tags and GPS tracking capabilities, the 4th Amendment is an endangered species. Now, we find that the Obama Administration is challenging an appellate court ruling over what the proper legal standard should be when law enforcement decides to track a suspects whereabouts? The court ruled there must be probable cause, now, the Obama Administration is arguing the opposite.

Before I get to some choice clips from Truthdig's Juan Cole, let me provide a little case history first: Back in 2009, the Washington Post reported that while serving as a U.S. attorney during the Bush administration, Christopher Christie tracked the whereabouts of citizens through their cell phones without warrants. The ACLU obtained these documents from the Justice Department in an ongoing lawsuit over cell phone tracking. While the documents reveal 79 such cases on or after Sept. 12, 2001, they do not specify how many of the applications were made during Christie's tenure.

Tracking without a warrant disregards an internal U.S. Justice Department recommendation that prosecutors obtain probable cause warrants before gathering location data from cell phones. Of the cases in which probable cause wasn't established, documents showed 19 allowed the most precise tracking available. Those cases occurred after the November 2007 Justice Department recommendation that prosecutors seek warrants.

And if that wasn't enough, there was the 2009 revelation that Sprint received 8 million law enforcement requests for GPS location data in just one year.

The government has been arguing, consistently now, that federal law requires judges to approve their applications for location information from cell phone companies - even if the police don't have probable cause to obtain this sensitive information. Courts have the right under statute - and the duty under the Constitution - to demand that the government obtain a search warrant before seizing this private location data.

Mobile phone providers store data about where customers make and receive calls, based on the cell towers the customers' phones used. And that's why the government has been attempting to collect past mobile-phone tracking information. That way they can go back in the past for as long as the cell phone companies keep records.

The ACLU had recently provided documents showing that of the states randomly sampled, New Jersey and Florida used GPS tracking without obtaining probable cause or warrants. Four other states, California, Louisiana, Indiana, Nevada and the District of Columbia reported having obtained GPS data only after showing probable cause.

Those documents were part of the ongoing lawsuit by the ACLU and Electronic Frontier Foundation, in which they argued government tracking without a probable cause or warrant is a violation of the Constitution's Fourth Amendment.

The essential argument by privacy advocates, be it the tracking of a cell phone user, or placing a tracking device in a suspect's vehicle, is that, whether you're driving a car or carrying a cell phone you should not be more susceptible to government surveillance. The idea being, no one wants to feel as if a government agent is following you wherever you go - be it a friend's house, a place of worship, or a therapist's office - and certainly innocent Americans shouldn't have to feel that way.

This argument won the day, at least in this case, as a federal appeals court ruled last year the police can’t covertly track a suspect’s car using a GPS device for an extended period of time without getting a warrant. This ruling by the D.C. Court of Appeals overturned the conviction of a suspected cocaine dealer, saying that the use of a secret GPS tracking device on the man’s vehicle for two months violated the Fourth Amendment’s protection against unreasonable searches and seizures. Thus the court clearly drew the important distinction between short term monitoring that’s not much different from a police tail and ongoing, secret and ubiquitous tracking.

Electronic Frontier Foundation and the ACLU had rightly argued that it's one thing to note someone’s car location and another to keep hourly data on every single stop you make along a specific route for days or months on end. The government tried to make the case that no such distinction existed.

Now, Obama and Holder want to overturn this CRITICAL ruling protecting the fourth amendment...and worse, we are now at the mercy of a Supreme Court filled with a Federalist Society majority.

But while that case, in the meantime anyway, represented a victory, let's remember that the FBI was found to have illegally collected more than 2,000 U.S. telephone call records between 2002 and 2006 by invoking terrorism emergencies that did not exist or simply by persuading phone companies to provide records.

E-mails obtained by The Washington Post have detailed how counter terrorism officials inside FBI headquarters did not follow their own procedures that were put in place to protect civil liberties. The stream of urgent requests for phone records also overwhelmed the FBI communications analysis unit with work that ultimately was not connected to imminent threats.

I addition, we know that the FBI uses 'dragnet'-style warrantless cell phone tracking

Now let's get to Juan Cole:

Among the many elements of the Obama administration that have disappointed civil libertarians is its interest in spying on Americans. The Bush administration had instituted massive warrantless wiretapping and gathering of telephone records, with the complicity of most telecom corporations. Those who care about the Bill of Rights had hoped that Eric Holder’s Department of Justice would take a stand for the Fourth Amendment, which should be on the endangered species list along with the golden tree frog and the St. Helena dragonet.

...

It should be remembered that it is perfectly possible for the police to make a mistake or act maliciously and to monitor someone who is innocent. The ACLU charges that these practices are increasingly common. If police and other security personnel are allowed to engage in domestic surveillance of this sort without a court warrant, they can start following large numbers of innocent people and learn details of their private lives. Just this year, Tacoma, Wash., police engaged in unconstitutional surveillance of anti-war activists, using an employee at a military base, which is even more troubling. Blanket permission for law enforcement to conduct warrantless GPS tracking of activists could reveal their private peccadilloes, which in turn could be used to blackmail them.

...

Part of what defines public and private is a reasonable citizen’s expectations. You wouldn’t expect all your movements for a month to be public, even if they were in an automobile. It is that understandable expectation of privacy that brings the Fourth Amendment into play. Ginsburg continued, “A reasonable person does not expect anyone to monitor and retain a record of every time he drives his car, including his origin, route, destination, and each place he stops and how long he stays there; rather, he expects each of those movements to remain disconnected and anonymous.” The full court of nine judges upheld the three-judge panel’s decision to throw out the case, which was against nightclub owner Antoine Jones.

The federal rulings so far on GPS tracking have been all over the map, so to speak, and that the Fourth Amendment will meaningfully survive the almost cosmic electronic surveillance capabilities of our burgeoning national security state is not at all clear. So far many of our eminent federal judges seem perfectly content with having police officers sneak around in our driveways, with allowing them to attach tracking devices to our private property, and with permitting them then to monitor everywhere we go and everyone we visit, without a warrant, for months at a time. Judge Ginsburg and two colleagues are so far all that stand in the way of this dystopian future becoming our present reality. Unfortunately, because Obama and Holder disagree with Ginsburg, his principled arguments will prevail only if they are permitted to do so by the likes of Antonin Scalia and Clarence Thomas. Welcome to Starship Amerika.

Click here to read more.

I'd also point you to a piece in Computerworld by Darlene Storm. She writes: 

If people can be tagged with a GPS-enabled dart in about a blink, and have no idea their movements on public streets are being tracked, then it seems reasonable that the warrantless surveillance violates the Fourth Amendment. In fact, it sounds a bit like stalking; if permitted to be done without a warrant, then it could easily be done on a large scale and without true suspicion.

Despite three other courts of appeal ruling that law enforcement does not need a warrant to use GPS tracking on a vehicle, the D.C. appellate court did not agree. Inside GNSS reported that the D.C. court of appeal wrote, "Continuous human surveillance for a week would require all the time and expense of several police officers, while comparable photographic surveillance would require a net of video cameras so dense and so widespread as to catch a person's every movement, plus the manpower to piece the photographs together...A reasonable person does not expect anyone to monitor and retain a record of every time he drives his car, including his origin, route, destination, and each place he stops and how long he stays there."

...

I'm certainly not an attorney, but it seems reasonable to expect the Supreme Court to uphold our Constitution and Fourth Amendment rights, including the right not to worry about warrantless surveillance in the form of GPS tracking when there is not even probable cause. Just because the technology exists does not mean it should be used against the people to invade their privacy as if everyone is a criminal. The next thing you know, the authorities will want warrantless wiretaps to search our email. Oh wait..

Click here to read more.

What's at stake here is whether it's okay for the government to track the locations of cell phone users without having to demonstrate there's good reason to do so. If we've learned anything post Patriot Act, its that law enforcement and the government do abuse unchecked power, even if only in a small minority of the situations. But to me, that's enough of a reason to require a warrant, period.

As the ACLU points out, "This case is not about protecting criminals. It's about protecting innocent people from unjustified violations of their privacy."

Locational Privacy and Smart Phones

Before I get to the startling news that security researchers have discovered that Apple's iPhone keeps track of EVERYWHERE you go – and saves every detail of it to a secret file on the device which is then copied to the owner's computer when the two are synchronized, let me briefly provide some context. As I have written here before, the fact that Americans are losing their privacy as they travel through public space due to location-based technologies isn't debatable. The question, as is so often the case when it comes to issues at the intersection of privacy and technology, is what kind of say do we have in the matter and what kind of rules are in place protecting our privacy rights?

Now the issue of locational privacy has resurfaced in a way that was just "conspiracy theories" and "worst case scenarios" in the very recent past. In that past, we had services such as EZ Pass (allows you to bypass stopping to pay the bridge toll), Google Latitude, the GPS tracking of cellphones, the right of police and government to track our whereabouts (both by phone and car), transit cards, social networking sites, WiFi networks, and more, all opening up a brave new world of real time, locational tracking of Americans.

But these new Smart Phone revelations take this to another level.

The UK's Guardian reports: The files contained the latitude and longitude of the phone's recorded coordinates along with a timestamp, meaning that anyone who stole the phone or the computer could discover details about the owner's movements using a simple program. For some phones, there could be almost a year's worth of data stored, as the recording of data seems to have started with Apple's iOS 4 update to the phone's operating system, released in June 2010.

"Apple has made it possible for almost anybody – a jealous spouse, a private detective – with access to your phone or computer to get detailed information about where you've been," said Pete Warden, one of the researchers.

Only the iPhone records the user's location in this way, say Warden and Alasdair Allan, the data scientists who discovered the file and are presenting their findings at the Where 2.0 conference in San Francisco on Wednesday. "Alasdair has looked for similar tracking code in [Google's] Android phones and couldn't find any," said Warden. "We haven't come across any instances of other phone manufacturers doing this."

Simon Davies, director of the pressure group Privacy International, said: "This is a worrying discovery. Location is one of the most sensitive elements in anyone's life – just think where people go in the evening. The existence of that data creates a real threat to privacy. The absence of notice to users or any control option can only stem from an ignorance about privacy at the design stage."

Indeed it is an important element. I'd point everybody to check out a report from the Electronic Frontier Foundation (EFF) in 2009 on the issue of "locational privacy". The report warned that Americans are losing their privacy as they travel through public space due to location-based technologies and services.

As the report detailed, "Location-based services that transmit, record, and store where a person is—such as EZ Pass, WiFi networks, transit cards, Google Latitude—can be exploited by government, business, or prying ex-lovers to track and reconstruct where people have been as they go about their daily life."

And what of the common response to worries about locational privacy, or other privacy issues in fact, that posits "I'm not doing anything wrong, why should I care?"

EFF lays out the folly of such a knee jerk defense of our ever expanding surveillance state...one that goes beyond the usual concerns of big government or law enforcement overreach:

One answer to this concern is a reminder that there are more subtle reasons for needing privacy. It’s not just the government, or law enforcement, or political enemies you might want to be protected from.

• Your employer doesn’t need to know things about whether, when, and where you went to church.
• Your co-workers don’t need to know how late you work or where you shop.
• Your sister’s ex-boyfriend doesn’t need know how often she spends the night at her new boyfriend’s apartment.
• Your corporate competitors don’t need to know who your salespeople are talking to.

Now, let's get back to the Guardian piece:

Warden and Allan point out that the file is moved onto new devices when an old one is replaced: "Apple might have new features in mind that require a history of your location, but that's our specualtion. The fact that [the file] is transferred across [to a new iPhone or iPad] when you migrate is evidence that the data-gathering isn't accidental." But they said it does not seem to be transmitted to Apple itself.


The iPhone system, by contrast, appears to record the data whether or not the user agrees. Apple declined to comment on why the file is created or whether it can be disabled.

Warden and Allan have set up a web page which answers questions about the file, and created a simple downloadable application to let Apple users check for themselves what location data the phone is retaining. The Guardian has confirmed that 3G-enabled devices including the iPad also retain the data and copy it to the owner's computer.

If someone were to steal an iPhone and "jailbreak" it, giving them direct access to the files it contains, they could extract the location database directly. Alternatively, anyone with direct access to a user's computer could run the application and see a visualization of their movements.

Graham Cluley, senior technology consultant at the security company Sophos, said: "If the data isn't required for anything, then it shouldn't store the location. And it doesn't need to keep an archive on your machine of where you've been." He suggested that Apple might be hoping that it would yield data for future mobile advertising targeted by location, although he added: "I tend to subscribe to cockup rather than conspiracy on things like this – I don't think Apple is really trying to monitor where users are."

We shouldn't view this as that big of a surprise of course. A study released last year by the Worcester Polytechnic Institute (WPI) in Massachusetts found that mobile social networks are giving data about users' physical locations to tracking sites and other social networking services. Researchers reported that all 20 sites that were studied leaked some kind of private information to third-party tracking sites.

In the study, the researchers looked at the practices of 13 mobile online social networks, including Brightkite, Flickr, Foursquare, Gowalla and Urbanspoon. They also studied seven traditional online social networks, such as Facebook, LinkedIn, MySpace and Twitter, which allow users to access their sites using mobile devices.

In many cases, the data given out contained the user's unique social networking identifier, which could allow third-party sites to connect the records they keep of users' browsing behavior with the their profiles on the social networking sites.

As the report notes, "The combination of location information, unique identifiers of devices, and traditional leakage of other personally identifiable information all conspire against protection of users' privacy."

I addition, we also know that the FBI uses 'dragnet'-style warrantless cell phone tracking. In other words, there are more and more ways, through more and more devices, that can track and store our location, and that data is worth more and more money.

There is some good news to report on this however. Senator Al Franken, who continues to distinguish himself as an excellent Senator on issues related to privacy and the internet, has indicated he's not at all pleased by these revelations about Apple, and could seek a full fledged investigation.

The Senator sent a letter to Apple late Wednesday to question why it included the feature in its software in the first place. The letter reads, “The existence of this information — stored in an unencrypted format — raises serious privacy concerns,” He later emphasized the information — which could be “accurate to 50 meters or less” — also applies to iPhones and iPads owned by children, and could easily be exploited by “criminals and bad actors.”

As reported by Politico, "Franken wants to know why Apple included the feature in the operating system. In a two page letter issued Wednesday, the senator asked Apple to explain why it initiated this tracking process in iOS 4, and why the company “never affirmatively informed [consumers] of the collection and retention of their location data in this manner?”

Franken also asked Jobs to explain whether the location data has been disclosed, and whether the same technology is also included as part of the operating system software that runs on the company’s popular MacBook laptops.

Franken’s letter is significant given lawmakers’ heightened interest in reforming federal laws on privacy, tracking and surveillance. The issue of mobile phone privacy, in particular, has Sen. Ron Wyden (D-Ore.) still working on legislation that could become part of the chamber’s larger effort to set new rules for how and when federal law enforcement can access consumers’ location data.

A constantly monitored citizenry used to conjure up images of totalitarian states - not Google and I-Phones. And granted, now technology does the surveillance — generally in the name of being helpful and entertaining, not to stifle dissent or oppress the public.

This fact does not mean that these technologies can't still be used in ways that do reduce freedoms, do play into the hands of overly aggressive and/or oppressive governments, and does invade privacy by using our private information to maximize corporate profit.

Perhaps its time for a serious conversation about how much of our privacy of movement we want to give up - and how much control do we get over that decision?

California Reader Privacy Act (and data breach bill) Clears Legislative Hurdle

For a more detailed post on a recently proposed bill in California that would protect digital reader privacy you can go here. I will rehash some of it now for those that haven't been here before...but most important for you to know is the legislation just passed its first major hurdle, as it won approval by the Senate Judiciary Committee by a vote of 4 to 0, with one Republican abstaining. In addition, SB 24 (Simitian), a critical data breach protection bill passed the State Senate. Click here more information about that bill. 

So why do we need to update our laws to protect the privacy of digital readers? Easy...there are NO protections as of yet, so the logic is simple...digital readers should have the same protections as someone that checks out a book from the library (a privacy right still protected, though under a withering Patriot Act assault).

As I wrote last post, as Californians increasingly turn to electronic books and online book services, it is essential to safeguard the reader’s browsing, buying, and viewing information as such details reveal private information about political and religious beliefs, health concerns, and personal lives.

Digital books are now outselling paperbacks on Amazon.com, readers are turning to online services like Google Books, and analysts expect that over 18-million e-readers will be sold in 2012. As companies collect more detailed reader information -- including books browsed, how long a page is viewed, and even the notes written in the margins -- reading records are becoming a larger target for government surveillance.

In other words, without strong privacy protections, all of our browsing and reading history could be collected, analyzed, and turned over to the government or third parties without our knowledge or consent. In light of what has transpired in this country since the Patriot Act, none of this should sound like undue paranoia - its based on a now long history of corporate and governmental abuses of citizen privacy.

We're not talking about just another library mind you - librarians utilize a different standards for dealing with user information than does the online world. Many libraries routinely delete borrower information, and organizations such as the American Library Association have fought hard to preserve the privacy of their patrons in the face of laws such as the U.S. Patriot Act.

The concerns of privacy advocates are not hypothetical. Our country has a long history of government efforts to compel libraries and booksellers to turn over customer records and information. Why would anyone believe, particularly after the warrantless wiretapping scandal, that the government won't ask a company like Google to turn over the treasure trove of private personal information it has on millions of Americans?

The SB 602 Solution

The Reader Privacy Act would ensure that government and third parties cannot access private reading records without proper justification. The bill permits disclosure of personal information related to reading records when an individual consents to the disclosure and where there are exigent circumstances.

In addition, personal information must be shared when a government entity or private party obtains a warrant or court order upon a showing of a compelling interest, and the warrant or order is the least intrusive means to obtain the information desired.

Notice and opportunity to contest the order must be given to the book seller or provider.  In civil cases, the reader would have the notice and opportunity to contest; while in criminal cases, the reader would not be given advance notice. This allows readers the reasonable ability to protect themselves.

The bill would also establish clear rules for businesses and standards for government and third party access to reader records. Under SB 602, consumers will be able to feel comfortable using new digital book services and technology without worrying that their personal information will be unprotected. California should promote the use of new technology by ensuring that upgraded technology does not mean downgraded privacy.

Let me quote the Electronic Frontier Foundation's (a leading advocate for this legislation) Rebecca Jeschke , who wrote, ...the books we choose to read reveal private information about our political and religious beliefs or interests, our health concerns, our financial situation, and our personal and professional lives. Maintaining reader privacy is fundamental to the dignity of Californians, and this principle is well ensconced in state law. However, with the market for digital books exploding, the law needs an update for the 21st Century.

Digital book services, libraries, and bookstores collect far more information than physical bookstores and libraries do. The data can include books browsed, how long a page is viewed, and even the electronic notes written in the margins. It's not hard to see the detailed portrait this could paint of your life. Without legislative protection, that information is a tempting target for the government or other litigants, like those involved in divorce cases, custody battles, or insurance disputes...Californians should let their state lawmakers know that this bill is key to updating privacy law for the digital age and ask them to support SB 602....

The bill now moves to the State Senate appropriations committee. I'll keep you updated here.

Landmark "Do Not Track" Legislation Proposed in California

Some real good news to report. Yesterday I was at the state capitol and had the opportunity to attend the press conference announcing a new bill being proposed by State Senator Alan Lowenthal - and sponsored by Consumer Watchdog - that will allow consumers in the state to stop unwanted online tracking.

First, if you want to read a more extensive description of what is called behavioral marketing, as well as the federal legislation being proposed to address it, just read my previous blog (and many others I've done). 

For today's purposes, let's get right back to the good news. The bill, SB 761, would offer consumers a "Do Not Track Me" mechanism, something the bill's sponsor describe as "one of the most powerful tools available to protect consumers' privacy. The mechanism will allow anyone online to send Websites the message that they do not want their online activity monitored.

The bill is the first in California to explicitly provide for a Do Not Track mechanism. It is modeled after a federal Do Not Track bill introduced in Congress by Rep. Jackie Speier, D-CA - legislation I have lauded and discussed on this blog recently. While the speakers at the press conference expressed optimism the federal legislation will ultimately pass, they said there is no reason to delay protections for citizens of California.

A poll by Consumer Watchdog last summer found that 80% of Americans support a Do Not Track option. A recent USA Today/Gallup poll found that most Americans are worried about their privacy and security when they use Facebook and Google.

I have talked about this interesting dichotomy a lot. This being the fact that while people see to "care" about privacy on one level, they tend to do very little to actually do so. Which in my mind, makes easy to use, clear options to protect privacy all the more paramount. Once people are given such a choice, not only will more people choose to "not be tracked", I think more people will become more AWARE of just how all pervasive such monitoring of nearly everything we do has become.

As noted in the press release from Consumer Watchdog, there no longer is any anonymity on the Web. The most personal information about people's online habits is collected and eventually bought and sold, often instantaneously and invisibly. Data collection practices have become a business in themselves, driven by profits at consumers' expense. The Wall Street Journal recently highlighted these practices—which included targeting children—in its groundbreaking series "What They Know."

I can vouch, personally, for Senator Lowenthal too. He's been a consumer stalwart in the legislature, even receiving our organizations "consumer hero" award. Here's a few of his comments about the bill and why he's authoring it:

Nearly 80% of Californians use the internet and nearly 45% use Facebook — including myself. But, today millions of Californians are unaware that their online behavior is being tracked; their data collected and sold to advertisers..The type of data that is collected is far reaching. Anywhere from the type of sites a person frequents, to the time of day and the location from where the person is accessing the sites. Most disturbing, however, is that the information that is being shared may include very personal information such as a name, home address, email address, or financial information.

I'd also point you to two more comments regarding this bill that add some more context. 

James P. Steyer, Founder and CEO of Common Sense Media: "In our recent Common Sense survey, 85% of parents said they are more concerned about online privacy than they were five years ago, and 75% of parents said they don’t think social networking sites do a good job of protecting children’s online privacy. It’s important to see California leaders taking a stand to protect online privacy, especially for kids and teens."

Beth Givens, Privacy Rights Clearing House Director: "A Do Not Track Me mechanism gives consumers a simple way to tell websites not to spy on them and not to collect detailed profiles of their web usage. Consumers should have the right to control how their data is used or whether it is gathered at all."

Also of note, and a smart strategy being utilized by Consumer Watchdog, was their personal letter to Google's new CEO urging the company take the lead by supporting the legislation. Consumer Watchdog President Jamie Court and John M. Simpson, director of the nonprofit, nonpartisan public interest group's Privacy Project, wrote: 

"Eric Schmidt's tenure as CEO was marked by a series of privacy gaffes. We hope yours will begin with a landmark endorsement of a new privacy right for consumers online that shows freedom of information and personal privacy are not incompatible." 

"As you are aware, online commerce relies on consumer trust.  Sadly, much of the current Internet business model is based on invasive and pervasive tracking of consumers' online activities without their knowledge or control. This should not be the business model of a company whose motto is 'Don't Be Evil.' Do Not Track legislation would give consumers meaningful protection and control.  It would build their confidence in the Internet – a win, win situation for business and consumer."

You can read the full letter here: 

To get a feel for the press coverage of the bill, check out the article in the San Francisco Chronicle today. Here's a few choice clips from the piece...in fact, notice my organization being mentioned (though they got our name slightly wrong) as one of the key supporters:

An array of Internet firms like Google Inc., Yahoo Inc. and Microsoft Corp. collect data about users' online behavior to serve up the sort of advertisements they're most likely to click on. The information generally isn't connected to actual names, but the practice has nonetheless grown increasingly controversial, as it's become clear how much data is gathered and how much it reveals.

A number of advocacy groups are backing the bill, including Consumer Watchdog, Privacy Rights Clearing House, Common Sense Media and the California Consumer Federation.
...

If the bill is approved, all connected devices would be affected, including personal computers, tablets, smart phones and Internet TVs. This would seem to require technical updates to an array of existing gadgets, including millions of Apple Inc. iPhones already in circulation.

Internet browser makers Microsoft and the Mozilla Foundation have already begun to build Do Not Track features into the latest versions of their products, suggesting companies could achieve compliance through software updates. When flipped on, these existing tools simply send a signal to websites when a user first arrives, saying they don't want their activity monitored.

Google, for its part, offers a downloadable extension that blocks the installation of many ad technologies for its Chrome browser. The shortcoming of the browser-based Do Not Track tools, besides not appearing on all devices, is that ad companies don't have any obligation to abide by these stated preferences. A number of marketing companies have begun working with the browser makers on voluntary solutions, but they remain just that.

A growing number of legislators, regulators and consumer advocates argue that individuals should, at least, have the legal right to remove themselves from this tracking if they want to.

Click here to read more.

For my more detailed thoughts on this topic, and why its so important to give people MORE control over their data and their privacy, I would again point you to my previous post, particularly the conclusion.