Congress Will Battle Over Internet Privacy in 2013

Saturday, February 2, 2013 by Deeplinks Blog / EFF  
by Mark M. Jaycox

Last year, we saw more battles in Congress over Internet freedom than we have in many years as user protests stopped two dangerous bills, the censorship-oriented SOPA, and the privacy-invasive Cybersecurity Act of 2012. But Congress ended the year by ramming through a domestic spying bill and weakening the Video Privacy Protection Act.

In 2013, Congress will tackle several bills—both good and bad—that could shape Internet privacy for the next decade. Some were introduced last year, and some will be completely new. For now, here's what's ahead in the upcoming Congress:

Reforming Draconian Computer Crime Law

The Computer Fraud and Abust Act (CFAA), was one of the key laws the government used in its relentless and unjust prosecution of Aaron Swartz. Zoe Lofgren has proposed "Aaron's Law," which ensures that breaking a terms of service or other contractual obligation does not amount to a CFAA violation. Lofgren's reforms are a terrific start and will be introduced in Congress over the coming weeks. EFF has also proposed revisions to Lofgren's language and overall reform to the CFAA that reduces the draconian penalties and clarifies key definitions in the statute. The proposed reforms will go a long way in preventing a similar situation from happening to a freedom fighter like Aaron again. It's unclear where the language stands in the Senate, but Senators like Ron Wyden have voiced support for Lofgren's bill and should take up CFAA reform. You can take action and email your members of Congress to tell them to support reform of the Computer Fraud and Abuse Act here.

Update to the Electronic Communications Privacy Act (ECPA)

Once again, the 113th Congress will try to update the archaic Electronic Communications Privacy Act. The law, which was passed in 1986, lays out procedures for when the government can obtain your private electronic messages, like email or Facebook messages, from service providers. ECPA states that the government doesn’t need a warrant for emails when they are older than 180 days—even though the Sixth Circuit held that this “180-day rule” violates the Fourth Amendment. Despite the ruling, the Justice Department continues to argue that the DOJ does not have to obtain a warrant.

Last Congress Senator Leahy successfully moved the Senate Judiciary Committee to approve an ECPA amendment mandating warrants for all private electronic communications, but the bill didn’t get to the full Senate. This year, both Senator Leahy and House Reps. Goodlatte and Lofgren will introduce similar legislation to ensure that the same protections that apply to physical private messages also apply to virtual private messages.

Congress should take the lead from the courts and move the legislation forward.

Restricting Government and Corporate Use of your Cell Phone GPS Info

Updating ECPA is also about protecting users geolocation information, especially after the Supreme Court’s decision in the GPS case, United States v. Jones. Senator Wyden and Rep. Chaffetz's GPS Act mandates that the government obtain a warrant before it seeks a user's geolocation information. Currently, the government can obtain such information without a warrant or probable cause, which is something the government has done at a staggering rate.

But the government isn't the only entity spying on cell phone users. Over and over, users are learning the hard way that private companies surreptitiously collect information from users' mobile devices and often share that data with unknown third parties. That's why Congressmen like Rep. Markey and Senator Franken introduced legislation last Congress that requires clear notification and disclosures when a company collects and shares user information with third parties. Both Congressmen plan to reintroduce and move the legislation forward in the 113th Congress.

Cybersecurity Legislation

Congressmen are also girding for another fight on Cybersecurity. Along with more warnings of an upcoming "cyber-Pearl Harbor," Congressmen named cybersecurity a priority in 2013 and are planning to reintroduce a new version of an “information sharing” cybersecurity bill called CISPA, which as EFF described at the time, carved a giant and vague “cybersecurity” loophole into all US privacy laws, while alsogranting new powers and legal immunity to companies.

The Internet community helped defeat the Cybersecurity legislation and Congress needs to craft any new bill with the utmost concern for privacy.

FBI Silent About Wanting To “Back Door" the Web

Lastly, there are rumors that the Obama Administration will propose a new Internet surveillance law, which will expand the Communications Assistance to Law Enforcement Act (CALEA), which forces telephone companies to build wiretap-friendly backdoors into all their technology—but not social networks and other web-based communications services.In 2005, the FBI pushed the FCC to rule that VOIP and "facilities-based internet access providers" had to abide by CALEA requirements. Now they want even more power. This expansion is in spite of the fact that the FBI has yet to respond adequately to EFF's FOIA lawsuit seeking records that would justify the need to expand federal surveillance laws, given they have a myriad of ways to get such data already (Google’s transparency report shows the government requests for user data is skyrocketing).

The White House and the FBI have not released what is in the proposed legislation, but one report states the FBI wants to require Internet companies, like Google, Facebook, and Twitter to build the same type of backdoors for real-time government surveillance. This would not only create a huge Internet security problem, making the Internet less safe just as Congress pushes for a cybersecurity bill, but threatens basic privacy on the web.

The potential for the 113th Congress to introduce backwards bills like CISPA and CALEA is great. But Congress, and especially new members, should take note of the Internet community's strong—and successful—opposition to bills like SOPA.

It's time to curry favor with everyday constituents, and not with giant corporations or overreaching law enforcement.

Important Things You Should Know About Privacy and the Supreme Court Ruling on GPS Tracking

On its face, this represents an important victory against the surveillance state. But this is a narrow ruling that leaves many crucial questions unanswered. 

By Scott Lemieux, AlterNet
Posted on January 29, 2012

Antoine Jones was sentenced to life in prison on drug distribution charges. The key evidence against him came from a month’s worth of data collected by a GPS tracker that police had attached to Jones’s car. The GPS, however, was attached without a valid warrant (police had obtained a warrant, but is was expired and for another jurisdiction.) Jones appealed his conviction, arguing that the warrantless GPS tracking violated the Fourth Amendment’s prohibitions against “unreasonable search and seizures.” The government replied that the installation of the GPS did not constitute a “search,” and hence could not have violated Jones’s constitutional rights. The Court of Appeals for the District of Columbia Circuit rejected the government’s argument, however. And earlier this week in United States v. Jones, the Supreme Court unanimously agreed that the police actions constituted a “search” and were subject to the restrictions of Fourth Amendment.

Here are some things you should know about this case and how the Bill of Rights might apply to modern technologies that increase the government’s power to invade private space:

1. While the Court ruled that Jones had been subject to a “search,” it did not address the question of whether the search was “unreasonable.” Because the search was conducted without a valid warrant, the search was presumptively unconstitutional. But – especially when it comes to cases involving the War On (Some People Who Use Some) Drugs – the Republican-dominated federal courts have been increasingly willing to carve out exceptions for warrantless searches. Until the courts decide this question, we don’t even know if the search of Jones will ultimately be ruled illegal.
2. Even in cases where a search has been held to be illegal, the Supreme Court has shown a willingness to water down the “exclusionary rule,” which holds that illegally obtained evidence cannot be used in courts. The provides strong incentives for the police to respect constitutional rights, because they cannot profit from illegal behavior; conversely, absent the exclusionary rule police have little incentive to comply with the law (civil remedies for violations of the Fourth Amendment are generally ineffective.) For example, in its infamous 2006 ruling Hudson v. Michigan, the Court ruled that while dangerous “no-knock” searches of homes were illegal, evidence obtained from them was admissible. If the courts rule that the search of Jones was illegal but the evidence can be admitted anyway, it will be a hollow victory for civil liberties indeed, as police will have strong incentives to push the envelope as new surveillance technologies emerge.
3. Justice Scalia’s majority opinion rested on grounds that actually have little application to new surveillance technologies. According to Scalia, since the GPS installation required trespassing private property, it “would have constituted a “search” within the original meaning of the Fourth Amendment.” While this isn’t necessarily wrong per se, as the concurrences by Justices Alito and Sotomayor point out ruling on this basis says nothing about more crucial questions about how the courts should assess searches that don’t require the direct invasion of physical property. As Justice Alito points out, “the Court’s reasoning largely disregards what is really important (the use of a GPS for the purpose of long-term tracking) and instead attaches great significance to something that most would view as relatively minor.” As a result, the long-term consequences of this decision are unclear.
4. Justice Alito’s concurrence proposes that rather than focusing on whether a trespass of property has occurred, the Court should focus on whether or not an individual had a “reasonable expectation of privacy” (the standard the Court has generally used since the early 1970s.) Again, there’s nothing wrong with this in and of itself, but in practice these kinds of balancing tests are only as good as the judges applying them. (In theory, the rule that abortion regulations that constitute an “undue burden” are unconstitutional could provide robust protection for reproductive freedom; in practice, it doesn’t.) Alito focuses on the relatively extreme facts of the case (tracking that lasted a month seeking evidence for a non-violent crime), which opens up the possibility that the state will be given wide latitude under this standard.
5. By far the strongest opinion, then, is Justice Sonia Sotomayor’s concurrence. As she notes, “[a]wareness that the Government may be watching chills associational and expressive freedoms.” Given the rapidly expanding tools that the executive branch has at its disposal to conduct surveillance on citizens, and the general unwillingness of legislatures to restrain intrusive searches, it is crucial that the courts not be behind the curve in applying Fourth Amendment protections. United States v. Jones could be a good first step – but only if the many questions it leaves open are answered in a way that takes the protection of privacy seriously. Justice Sotomayor’s concurrence provides a good road map. 

Death of Privacy: 'Your cell phone Big Brother's best friend'

Microsoft collects locations of Windows phone users

April 25, 2011- CNET
by Declan McCullagh  

 

Like Apple and Google, Microsoft collects records of the physical locations of customers who use its mobile operating system.

Windows Phone 7, supported by manufacturers including Dell, HTC, LG, Nokia, and Samsung, transmits to Microsoft a miniature data dump including a unique device ID, details about nearby Wi-Fi networks, and the phone's GPS-derived exact latitude and longitude. 

A Microsoft representative was not immediately able to answer questions that CNET posed this afternoon, including how long the location histories are stored and how frequently the phone's coordinates are transmitted over the Internet. Windows Phone currently claims about a 6 percent market share but, according to IDC, will capture about 21 percent by 2015 thanks to Microsoft's partnership with Nokia.

Microsoft does say, however, that location histories are not saved directly on the device. That's different from Apple's practice of recording the locations of visible cell towers on iPhone and iPad devices, which can result in more than a year's worth of data being quietly logged.

Google's approach, by contrast, records only the last few dozen locations on Android phones.
The privacy practices of mobile software companies have come under extensive scrutiny after a researcher at a conference last week in Santa Clara, Calif., described in detail how the iPhone's location logging works. A CNET report, however, showed that law enforcement and forensics analysts had been aware of and relied on the undocumented feature since at least last year.

Sen. Al Franken (D-Minn.) today asked Google and Apple to appear at a Senate hearing scheduled for May 10, and Illinois Attorney General Lisa Madigan has asked for a meeting. A lawsuit seeking class action status was filed today in Tampa, Fla.

According to a Web page in the "Help and How-To" section of the Windows Phone site, Microsoft has assembled a database with the "location of certain mobile cell towers and Wi-Fi access points" so a mobile device can determine its location more quickly, and with less battery drain, than if only GPS was used. Relying exclusively on GPS would have a negative "impact on mobile phone users by increasing data charges and draining the battery," the company says.

To make applications like maps work, of course, it's necessary for a smartphone or tablet to transmit its GPS coordinates to a remote server--and, in exchange, receive nearby restaurant reviews, or driving directions, and so on.

Privacy concerns begin to arise when a unique device ID is transmitted, which allows a company to track a customer's whereabouts over an extended period of time. Randomizing the device ID frequently would alleviate some concerns. (Microsoft says that in the case of Windows Phone 7, location information is transmitted to its servers only if Wi-Fi and location services are turned on. It also points out it offers a global switch to turn off all location-based services.)

"The user is identifiable if you have a series of events" that can be linked together, says Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, D.C.
Microsoft says its operating system transmits the MAC address of the Wi-Fi access point (but not the name), signal strength, a randomly generated unique device ID retained for an unspecified limited period of time, and, if GPS is turned on, the precise location and direction and speed of travel. That happens when the "application or user makes a request for location information," the company says.

One privacy concern is that location databases can be a gold mine for police or civil litigants: requesting cell phone location information from wireless carriers has become a staple of criminal investigations, often without search warrants being sought. It's not clear how often legal requests for these records have been sent to Microsoft, which said it could not immediately answer that question, or whether its lawyers require a search warrant signed by a judge.

Even though police are tapping into the locations of mobile phones thousands of times a year by contacting AT&T, Verizon Wireless, and other mobile carriers, the legal ground rules remain unclear, and federal privacy laws written a generation ago are ambiguous at best. The Obama Justice Department has claimed that no warrant is required for historical location information, a claim opposed by a coalition of companies including Google and Microsoft but not Apple. (CNET first reported on warrantless cell tracking in 2005.)

Apple acknowledged (PDF) to Congress last year that "cell tower and Wi-Fi access point information" is "intermittently" collected and "transmitted to Apple" every 12 hours, but has declined to elaborate. Google has confirmed that it collects location information from Android devices, but downplayed concerns about privacy by saying the information is not "traceable to a specific user." It has yet to respond to questions from last Friday.

Here are the questions, still unanswered, that CNET posed to Microsoft this afternoon:

• When did Microsoft start collecting location data from mobile devices?  

• Does Microsoft collect cell tower data?  

• How frequently do devices running Windows Phone 7 transmit the data to Microsoft? Every 15 minutes? Hourly? Daily?  

• How is that done? Is it an HTTP POST request to a Microsoft.com server, like Google?  

• Is the connection encrypted? If so, using what method?  

• What information, exactly, is transmitted?  

• You say the information collected includes a "randomly generated unique device ID." Is that device ID ever changed? If it is changed, how often does it change?  

• What does Microsoft use the database of Wi-Fi access points for? Because you collect "direction and speed" if GPS is available, is it used for traffic data?  

• You say the WiFi access points are surveyed when "the user has allowed a particular application to access location services and the application requests location information." If WiFi is turned on, location services have been activated, but no apps are ever run, will location data ever be transmitted to Microsoft?  

• You say the randomly generated ID is "retained for a limited period." How long is that? Is the ID then deleted or only partially anonymized?  

• Given a street address or pair of GPS coordinates, is Microsoft able to produce the location logs associated with that generated ID, if legally required to do so?  

• Given a generated ID, is Microsoft able to produce the complete location logs associated with it, if legally required to do so?  

• Given a MAC address of an access point, is Microsoft able to produce the generated IDs and location data associated with it, if legally required to do so?  

• How many law enforcement requests or forms of compulsory process have you received for access to any portion of this database?  

• If Microsoft knows that a Hotmail user is connecting from a home network IP address every evening, it would be trivial to link that with an Windows phone's device ID that also connects via that IP address. Does Microsoft do that?  

• Is any information about current or previously-visited locations stored on a Windows Phone 7 device?  

• Is Microsoft planning to change any of its policies regarding location data storage and transmission?

What Location Tracking Looks Like

Wednesday, March 30, 2011 by Deepinks Blog / EFF
by Seth Schoen 

Your cell phone company knows everywhere you go, twenty-four hours a day, every day. How concrete is this fact for you?

It's very concrete for Malte Spitz, a German politician and privacy advocate. He used German privacy law — which, like the law of many European countries, gives individuals a right to see what private companies know about them — to force his cell phone carrier to reveal what it knew about him. The result? 35,831 different facts about his cell phone use over the course of six months. As the German newspaper website Zeit Online reports:

This profile reveals when Spitz walked down the street, when he took a train, when he was in an airplane. It shows where he was in the cities he visited. It shows when he worked and when he slept, when he could be reached by phone and when was unavailable. It shows when he preferred to talk on his phone and when he preferred to send a text message. It shows which beer gardens he liked to visit in his free time. All in all, it reveals an entire life.

To show just how extensive this data is, Spitz chose to make it all available to the public; Zeit Online used it to prepare a remarkable interactive map, which animates Spitz's movements, moment by moment, over the course of half a year. It's correlated with information Spitz willingly posted on the web, and, according to him and the newspaper, is remarkably, eerily accurate. Try it out.

A report in the New York Times on Saturday described the data release, which it called "astounding", and put it in a U.S. context, quoting EFF's Kevin Bankston. The Times tried to find out whether U.S. mobile phone carriers have similar data about their subscribers, but it said "[t]he major American cellphone providers declined to explain what exactly they collect and what they use it for."

EFF has been following this issue for years and has worked extensively to limit government access to location data about individuals; government agents have increasingly sought to use this information, using questionable legal arguments to get carriers to turn it over. Still, it's remarkable to see an actual location data set about a real person. (According to the Times, German carriers have, for legal reasons, now stopped routinely storing this data. However, like all mobile phone carriers, they still have the technical ability to collect it at any time.)

Malte Spitz explains why he worked to obtain this information: to help educate the public about some of what's at stake in the German and worldwide debates about telecommunications data retention. All around the world, including the United States, proposed laws would force carriers to retain enormous quantities of personal information. As Spitz and Zeit Online have shown, these troves of information can give a detailed picture of each person's private life.

Cops Don't Need Warrants to Plant GPS on Cars, Federal Court Says

by Caleb Johnson on August 28, 2010

A federal judge in California recently ruled that police can place a GPS on a person's car without his or her knowledge without seeking a warrant. CNN reports that Juan Pineda-Moreno's appeal was rejected for the third time in early August by the U.S. Ninth Circuit Court of Appeals, which covers nine West Coast states. Pineda-Moreno claimed that Oregon DEA agents had violated his privacy by sneaking onto his property and placing a GPS tracker on his Jeep, due to their suspicions that he was growing marijuana. To support their case against Pineda-Moreno, prosecutors used data culled by the device, such as the latitude and longitude of where the Jeep had been driving and how long it had stayed at those coordinates.

While Pineda-Moreno will continue serving his 51-month sentence, not everybody agrees with the court's ruling. "The vast majority of the 60 million people living in the Ninth Circuit will see their privacy materially diminished by the panel's ruling," Chief Judge Alex Kozinski wrote in his dissent of the case. Marc Rotenberg, executive director of the Electronic Privacy Information Center, told CNN that the ruling was "Orwellian."

This comes less than a month after a D.C. Circuit U.S. Court of Appeals ruled that police should attain a warrant before engaging in GPS tracking. The opposing Ninth Circuit ruling suggests the constitutionality of warrentless GPS tracking will be tested in the Supreme Court. In some ways, using a GPS to track somebody isn't much different than parking down the street and tailing them. The notion of remote monitoring doesn't make this "Orwellian," but the ease with which the system could be abused definitely crosses into dangerous Big Brother territory.

Ten Ways We Are Being Tracked, Traced, and Databased

Published on 07-10-2010

The war on terror is a worldwide endeavor that has spurred massive investment into the global surveillance industry - which now seems to becoming a war on "liberty and privacy."  Given all of the new monitoring technology being implemented, the uproar over warrantless wiretaps now seems moot.  High-tech, first-world countries  are being tracked, traced, and databased, literally around every corner.  Governments, aided by private companies, are gathering a mountain of information on average citizens who so far seem willing to trade liberty for supposed security.  Here are just some of the ways the matrix of data is being collected:

• GPS -- Global positioning chips are now appearing in everything from U.S. passports, cell phones, to cars.  More common uses include tracking employees, and for all forms of private investigation.  Apple recently announced they are collecting the precise location of iPhone users via GPS for public viewing in addition to spying on users in other ways.

• Internet -- Internet browsers are recording your every move forming detailed cookies on your activities.  The NSA has been exposed as having cookies on their site that don't expire until 2035.  Major search engines know where you surfed last summer, and online purchases are databased, supposedly for advertising and customer service uses.  IP addresses are collected and even made public.  Controversial websites can be flagged internally by government sites, as well as re-routing all traffic to block sites the government wants to censor. It has now been fully admitted that social networks provide NO privacy to users while technologies advance for real-time social network monitoring.  The Cybersecurity Act attempts to legalize the collection and exploitation of your personal information.  Apple's iPhone also has browsing data recorded and stored.  All of this despite the overwhelming opposition to cybersurveillance by citizens.

• RFID  -- Forget your credit cards which are meticulously tracked, or the membership cards for things so insignificant as movie rentals which require your SSN.  Everyone has Costco, CVS, grocery-chain cards, and a wallet or purse full of many more.  RFID  "proximity cards"  (www.alphacard.com/id-cards/multifunctional-plastic-cards.shtml)  take tracking to a new level in uses ranging from loyalty cards, student ID, physical access, and computer network access.  Latest developments include an RFID powder developed by Hitachi, for which the multitude of uses are endless -- perhaps including tracking hard currency so we can't even keep cash undetected. (Also see microchips below).

• Traffic cameras -- License plate recognition has been used to remotely automate duties of the traffic police in the United States, but have been proven to have dual use in England such as to mark activists under the Terrorism Act.  Perhaps the most common use will be to raise money and shore up budget deficits via traffic violations, but uses may descend to such "Big Brother" tactics as monitors telling pedestrians not to litter.

• Computer cameras and microphones -- The fact that laptops -- contributed by taxpayers -- spied on public school children (at home) is outrageous.  Years ago Google began officially to use computer "audio fingerprinting" for advertising uses.  They have admitted to working with the NSA, the premier surveillance network in the world.  Private communications companies already have been exposed routing communications to the NSA.  Now, keyword tools -- typed and spoken -- link to the global security matrix.

• Public sound surveillance -- This technology has come a long way from only being able to detect gunshots in public areas, to now listening in to whispers for dangerous "keywords." This technology has been launched in Europe to "monitor conversations" to detect "verbal aggression" in public places.  Sound Intelligence is the manufacturer of technology to analyze speech, and their website touts how it can easily be integrated into other systems. 

• Biometrics -- The most popular biometric authentication scheme employed for the last few years has been Iris Recognition. The main applications are entry control, ATMs and Government programs. Recently, network companies and governments have utilized biometric authentication including fingerprint analysis, iris recognition, voice recognition, or combinations of these for use in National identification cards.

• DNA -- Blood from babies has been taken for all people under the age of 38.  In England, DNA was sent to secret databases from routine heel prick tests.  Several reports have revealed covert Pentagon databases of DNA for "terrorists" and now DNA from all American citizens is databased. Digital DNA is now being used as well to combat hackers.

• Microchips -- Microsoft's HealthVault and VeriMed partnership is to create RFID implantable microchips.  Microchips for tracking our precious pets is becoming commonplace and serves to condition us to accept putting them in our children in the future.  The FDA has already approved this technology for humans and is marketing it as a medical miracle, again for our safety.

• Facial recognition -- Anonymity in public is over.  Admittedly used at Obama's campaign events,sporting events, and most recently at the G8/G20 protests in Canada. This technology is also harvesting data from Facebook images and surely will be tied into the street "traffic" cameras.

All of this is leading to Predictive Behavior Technology -- It is not enough to have logged and charted where we have been; the surveillance state wants to know where we are going through psychological profiling.  It's been marketed for such uses as blocking hackers.  Things seem to have advanced to a point where a truly scientific Orwellian world is at hand.  It is estimated that computers know to a 93% accuracy where you will be, before you make your first move.   Nanotech is slated to play a big role in going even further as scientists are using nanoparticles to directly influence behavior and decision making.   

Many of us are asking:  What would someone do with all of this information to keep us tracked, traced, and databased?  It seems the designers have no regard for the right to privacy and desire to become the Controllers of us all.