Showing posts with label Online Behavioral Tracking. Show all posts
Showing posts with label Online Behavioral Tracking. Show all posts

Friday, December 6, 2013

Facebook's Future Plans for Data Collection Beyond Imagination

Facebook's dark plans for the future are given away in its patent applications.
December 4, 2013 | Alternet (via Counterpunch)

“No one knows who will live in this cage in the future, or whether at the end of this tremendous development, entirely new prophets will arise, or there will be a great rebirth of old ideas and ideals, or, if neither, mechanized petrification, embellished with a sort of convulsive self-importance. For of the fast stage of this cultural development, it might well be truly said: ‘Specialists without spirit, sensualists without heart; this nullity imagines that it has attained a level of civilization never before achieved.’”
—Max Weber, 1905

On November 12,  Facebook, Inc. filed its 178th patent application for a consumer profiling technique the company calls “inferring household income for users of a social networking system.”

“The amount of information gathered from users,” explain Facebook programmers Justin Voskuhl and Ramesh Vyaghrapuri in their patent application, “is staggering — information describing recent moves to a new city, graduations, births, engagements, marriages, and the like.” Facebook and other so-called tech companies have been warehousing all of this information since their respective inceptions. In Facebook’s case, its data vault includes information posted as early as 2004, when the site first went live. Now in a single month the amount of information forever recorded by Facebook —dinner plans, vacation destinations, emotional states, sexual activity, political views, etc.— far surpasses what was recorded during the company’s first several years of operation. And while no one outside of the company knows for certain, it is believed that Facebook has amassed one of the widest and deepest databases in history. Facebook has over 1,189,000,000 “monthly active users” around the world as of October 2013, providing considerable width of data. And Facebook has stored away trillions and trillions of missives and images, and logged other data about the lives of this billion plus statistical sample of humanity. Adjusting for bogus or duplicate accounts it all adds up to about 1/7th of humanity from which some kind of data has been recorded.

According to Facebook’s programmers like Voskuhl and Vyaghrapuri, of all the clever uses they have already applied this pile of data toward, Facebook has so far “lacked tools to synthesize this information about users for targeting advertisements based on their perceived income.” Now they have such a tool thanks to the retention and analysis of variable the company’s positivist specialists believe are correlated with income levels.

They’ll have many more tools within the next year to run similar predictions. Indeed, Facebook, Google, Yahoo, Twitter, and the hundreds of smaller tech lesser-known tech firms that now control the main portals of social, economic, and political life on the web (which is now to say everywhere as all economic and much social activity is made cyber) are only getting started. The Big Data analytics revolution has barely begun, and these firms are just beginning to tinker with rational-instrumental methods of predicting and manipulating human behavior.

There are few, if any, government regulations restricting their imaginations at this point. Indeed, the U.S. President himself is a true believer in Big Data; the brain of Obama’s election team was a now famous “cave” filled with young Ivy League men (and a few women) sucking up electioneering information and crunching demographic and consumer data to target individual voters with appeals timed to maximize the probability of a vote for the new Big Blue, not IBM, but the Democratic Party’s candidate of “Hope” and “Change.” The halls of power are enraptured by the potential of rational-instrumental methods paired with unprecedented access to data that describes the social lives of hundreds of millions.

Facebook’s intellectual property portfolio reads like cliff notes summarizing the aspirations of all corporations in capitalist modernity; to optimize efficiency in order to maximize profits and reduce or externalize risk. Unlike most other corporations, and unlike previous phases in the development of rational bureaucracies, Facebook and its tech peers have accumulated never before seen quantities of information about individuals and groups. Recent breakthroughs in networked computing make analysis of these gigantic data sets fast and cheap. Facebook’s patent holdings are just a taste of what’s arriving here and now.

The way you type, the rate, common mistakes, intervals between certain characters, is all unique, like your fingerprint, and there are already cyber robots that can identify you as you peck away at keys. Facebook has even patented methods of individual identification with obviously cybernetic overtones, where the machine becomes an appendage of the person. U.S. Patents 8,306,256, 8,472,662, and 8,503,718, all filed within the last year, allow Facebook’s web robots to identify a user based on the unique pixelation and other characteristics of their smartphone’s camera. Identification of the subject is the first step toward building a useful data set to file among the billion or so other user logs. Then comes analysis, then prediction, then efforts to influence a parting of money.
The way you type, the rate, common mistakes, intervals between certain characters, is all unique, like your fingerprint, and there are already cyber robots that can identify you as you peck away at keys.

Many Facebook patents pertain to advertising techniques that are designed and targeted, and continuously redesigned with ever-finer calibrations by robot programs, to be absorbed by the gazes of individuals as they scroll and swipe across their Facebook feeds, or on third party web sites.

Speaking of feeds, U.S. Patent 8,352,859, Facebook’s system for “Dynamically providing a feed of stories about a user of a social networking system” is used by the company to organize the constantly updated posts and activities inputted by a user’s “friends.” Of course embedded in this system are means of inserting advertisements. According to Facebook’s programmers, a user’s feeds are frequently injected with “a depiction of a product, a depiction of a logo, a display of a trademark, an inducement to buy a product, an inducement to buy a service, an inducement to invest, an offer for sale, a product description, trade promotion, a survey, a political message, an opinion, a public service announcement, news, a religious message, educational information, a coupon, entertainment, a file of data, an article, a book, a picture, travel information, and the like.” That’s a long list for sure, but what gets injected is more often than not whatever will boost revenues for Facebook.

The advantage here, according to Facebook, is that “rather than having to initiate calls or emails to learn news of another user, a user of a social networking website may passively receive alerts to new postings by other users.” The web robot knows best. Sit back and relax and let sociality wash over you, passively. This is merely one of Facebook’s many “systems for tailoring connections between various users” so that these connections ripple with ads uncannily resonant with desires and needs revealed in the quietly observed flow of e-mails, texts, images, and clicks captured forever in dark inaccessible servers of Facebook, Google and the like. These communications services are free in order to control the freedom of data that might otherwise crash about randomly, generating few opportunities for sales.

Where this fails Facebook ratchets up the probability of influencing the user to behave as a predictable consumer. “Targeted advertisements often fail to earn a user’s trust in the advertised product,” explain Facebook’s programmers in U.S. Patent 8,527,344, filed in September of this year. “For example, the user may be skeptical of the claims made by the advertisement. Thus, targeted advertisements may not be very effective in selling an advertised product.” Facebook’s computer programmers who now profess mastery over sociological forces add that even celebrity endorsements are viewed with skepticism by the savvy citizen of the modulated Internet. They’re probably right.

Facebook’s solution is to mobilize its users as trusted advertisers in their own right. “Unlike advertisements, most users seek and read content generated by their friends within the social networking system; thus,” concludes Facebook’s mathematicians of human inducement, “advertisements generated by a friend of the user are more likely to catch the attention of the user, increasing the effectiveness of the advertisement.” That Facebook’s current So-And-So-likes-BrandX ads are often so clumsy and ineffective does not negate the qualitative shift in this model of advertising and the possibilities of un-freedom it evokes.

Forget iPhones and applications, the tech industry’s core consumer product is now advertising. Their essential practice is mass surveillance conducted in real time through continuous and multiple sensors that pass, for most people, entirely unnoticed. The autonomy and unpredictability of the individual —in Facebook’s language the individual is the “user”— is their fundamental business problem. Reducing autonomy via surveillance and predictive algorithms that can placate existing desires, and even stimulate and mold new desires is the tech industry’s reason for being. Selling their capacious surveillance and consumer stimulus capabilities to the highest bidder is the ultimate end.

Sounds too dystopian? Perhaps, and this is by no means the world we live in, not yet. It is, however, a tendency rooted in the tech economy. The advent of mobile, hand-held, wirelessly networked computers, called “smartphones,” is still so new that the technology, and its services feel like a parallel universe, a new layer of existence added upon our existing social relationships, business activities, and political affiliations. In many ways it feels liberating and often playful. Our devices can map geographic routes, identify places and things, provide information about almost anything in real time, respond to our voices, and replace our wallets. Who hasn’t consulted “Dr. Google” to answer a pressing question? Everyone and everything is seemingly within reach and there is a kind of freedom to this utility.

Most of Facebook’s “users” have only been registered on the web site since 2010, and so the quintessential social network feels new and fun, and although perhaps fraught with some privacy concerns, it does not altogether feel like a threat to the autonomy of the individual. To say it is, is a cliche sci-fi nightmare narrative of tech-bureaucracy, and we all tell one another that the reality is more complex.

Privacy continues, however, too be too narrowly conceptualized as a liberal right against incursions of government, and while the tech companies have certainly been involved in a good deal of old-fashioned mass surveillance for the sake of our federal Big Brother, there’s another means of dissolving privacy that is more fundamental to the goals of the tech companies and more threatening to social creativity and political freedom.

Georgetown University law professor Julie Cohen notes that pervasive surveillance is inimical to the spaces of privacy that are required for liberal democracy, but she adds importantly, that the surveillance and advertising strategies of the tech industry goes further.

“A society that permits the unchecked ascendancy of surveillance infrastructures, which dampen and modulate behavioral variability, cannot hope to maintain a vibrant tradition of cultural and technical innovation,” writes Cohen in a forthcoming Harvard Law Review article:
“Modulation” is Cohen’s term for the tech industry’s practice of using algorithms and other logical machine operations to mine an individual’s data so as to continuously personalize information streams. Facebook’s patents are largely techniques of modulation, as are Google’s and the rest of the industry leaders. Facebook conducts meticulous surveillance on users, collects their data, tracks their movements on the web, and feeds the individual specific content that is determined to best resonate with their desires, behaviors, and predicted future movements. The point is to perfect the form and function of the rational-instrumental bureaucracy as defined by Max Weber: to constantly ratchet up efficiency, calculability, predictability, and control. If they succeed in their own terms, the tech companies stand to create a feedback loop made perfectly to fit each an every one of us, an increasingly closed systems of personal development in which the great algorithms in the cloud endlessly tailor the psychological and social inputs of humans who lose the gift of randomness and irrationality.

“It is modulation, not privacy, that poses the greater threat to innovative practice. Regimes of pervasively distributed surveillance and modulation seek to mold individual preferences and behavior in ways that reduce the serendipity and the freedom to tinker on which innovation thrives.” 
Cohen has pointed out the obvious irony here, not that it’s easy to miss; the tech industry is uncritically labeled America’s hothouse of innovation, but it may in fact be killing innovation by disenchanting the world and locking inspiration in an cage.

If there were limits to the reach of the tech industry’s surveillance and stimuli strategies it would indeed be less worrisome. Only parts of our lives would be subject to this modulation, and it could therefore benefit us. But the industry aspires to totalitarian visions in which universal data sets are constantly mobilized to transform an individual’s interface with society, family, the economy, and other institutions. The tech industry’s luminaries are clear in their desire to observe and log everything, and use every “data point” to establish optimum efficiency in life as the pursuit of consumer happiness. Consumer happiness is, in turn, a step toward the rational pursuit of maximum corporate profit. We are told that the “Internet of things” is arriving, that soon every object will have embedded within it a computer that is networked to the sublime cloud, and that the physical environment will be made “smart” through the same strategy of modulation so that we might be made free not just in cyberspace, but also in the meatspace.

Whereas the Internet of the late 1990s matured as an archipelago of innumerable disjointed and disconnected web sites and databases, today’s Internet is gripped by a handful of giant companies that observe much of the traffic and communications, and which deliver much of the information from an Android phone or laptop computer, to distant servers, and back. The future Internet being built by the tech giants —putting aside the Internet of things for the moment— is already well into its beta testing phase. It’s a seamlessly integrated quilt of web sites and apps that all absorb “user” data, everything from clicks and keywords to biometric voice identification and geolocation.

United States Patent 8,572,174, another of Facebook’s recent inventions, allows the company to personalize a web page outside of Facebook’s own system with content from Facebook’s databases. Facebook is selling what the company calls its “rich set of social information” to third party web sites in order to “provide personalized content for their users based on social information about those users that is maintained by, or otherwise accessible to, the social networking system.” Facebook’s users generated this rich social information, worth many billions of dollars as recent quarterly earnings of the company attest.

In this way the entire Internet becomes Facebook.
The totalitarian ambition here is obvious, and it can be read in the securities filings, patent applications, and other non-sanitized business documents crafted by the tech industry for the financial analysts who supply the capital for further so-called innovation. Everywhere you go on the web, with your phone or tablet, you’re a “user,” and your social network data will be mined every second by every application, site, and service to “enhance your experience,” as Facebook and others say. The tech industry’s leaders aim to expand this into the physical world, creating modulated advertising and environmental experiences as cameras and sensors track our movements.

Facebook and the rest of the tech industry fear autonomy and unpredictability.
The ultimate expression of these irrational variables that cannot be mined with algorithmic methods is absence from the networks of surveillance in which data is collected.

One of Facebook’s preventative measures is United States Patent 8,560,962, “promoting participation of low-activity users in social networking system.” This novel invention devised by programmers in Facebook’s Palo Alto and San Francisco offices involves a “process of inducing interactions,” that are meant to maximize the amount of “user-generated content” on Facebook by getting lapsed users to return, and stimulating all users to produce more and more data. User generated content is, after all, worth billions. Think twice before you hit “like” next time, or tap that conspicuously placed “share” button; a machine likely put that content and interaction before your eyes after a logical operation determined it to have the highest probability of tempting you to add to the data stream, thereby increasing corporate revenues.

Facebook’s patents on techniques of modulating “user” behavior are few compared to the real giants of the tech industry’s surveillance and influence agenda. Amazon, Microsoft, and of course Google hold some of the most fundamental patents using personal data to attempt to shape an individual’s behavior into predictable consumptive patterns. Smaller specialized firms like Choicestream and Gist Communications have filed dozens more applications for modulation techniques. The rate of this so-called innovation is rapidly telescoping.

Perhaps we do know who will live in the iron cage. It might very well be a cage made of our own user generated content, paradoxically ushering in a new era of possibilities in shopping convenience and the delivery of satisfactory experiences even while it eradicates many degrees of chance, and pain, and struggle (the motive forces of human progress) in a robot-powered quest to have us construct identities and relationships that yield to prediction and computer-generated suggestion. Defense of individual privacy and autonomy today is rightly motivated by the reach of an Orwellian security state (the NSA, FBI, CIA). This surveillance changes our behavior by chilling us, by telling us we are always being watched by authority. Authority thereby represses in us whatever might happen to be defined as “crime,” or any anti-social behavior at the moment. But what about the surveillance that does not seek to repress us, the watching computer eyes and ears that instead hope to stimulate a particular set of monetized behaviors in us with the intimate knowledge gained from our every online utterance, even our facial expressions and finger movements?

Tuesday, August 2, 2011

Researchers Expose Cunning Online Tracking Service That Can’t Be Dodged

By Ryan Singel - WIRED July 29, 2011 |
 

Researchers at U.C. Berkeley have discovered that some of the net’s most popular sites are using a tracking service that can’t be evaded — even when users block cookies, turn off storage in Flash, or use browsers’ “incognito” functions.

The service, called KISSmetrics, is used by sites to track the number of visitors, what the visitors do on the site, and where they come to the site from — and the company says it does a more comprehensive job than its competitors such as Google Analytics.

But the researchers say the site is using sneaky techniques to prevent users from opting out of being tracked on popular sites, including the TV streaming site Hulu.com.

The discovery of KISSmetrics tracking techniques comes as federal regulators, browser makers, privacy activists and ad tracking companies are trying to define what tracking actually is. The FTC called on browser makers to add a “Do Not Track” setting that essentially lets users tell websites to leave them alone — though it doesn’t block tracking on its own. It’s more like a “privacy, please” sign on a hotel door. One of the big questions surrounding Do Not Track is about web analytics software, which sites use to determine what’s popular on their site, how many unique visitors a site has a month, where users are coming from, and what pages they leave from.

In response to inquiries from Wired.com, Hulu cut ties with KISSmetrics on Friday.

UPDATE 5:00 PM Friday: Spotify, another KISSmetrics customer named in the report, said that it was concerned by the story:

“We take the privacy of our users incredibly seriously and are concerned by this report,” a spokeswoman said by e-mail. “As a result, we have taken immediate action in suspending our use of KISSmetrics whilst the situation is investigated.” /UPDATE

“Hulu has suspended our use of KISSmetrics’ services pending further investigation,” a spokeswoman told Wired.com. “Hulu takes our users’ privacy very seriously. We have no further comment at this time.”

KISSmetrics is a 17-person start-up founded in 2008 and based in the San Francisco Bay Area. Founder Hitten Shah confirmed that the research was correct, but told Wired.com Friday morning that there was nothing illegal about the techniques it was using.

“We don’t do it for malicious reasons. We don’t do it for tracking people across the web,” Shah said. “I would be having lawyers talk to you if we were doing anything malicious.”

Shah says KISSmetrics is used by thousands of sites to track incoming users, and it does not sell or buy data about those visitors, according to Shah. After this story was published, the company tweeted a link that explains how its tracking works.

So if a user came to Hulu.com from an ad on Facebook, and then later, using a different browser on the same computer, visited Hulu.com from Google, and then at some point signed up for the premium service, KISSmetrics would be able to tell Hulu all about that user’s path to purchase (without knowing who that person was). That tracking trail would remain in place even if a user deleted her cookies, due to code that stores the unique ID in places other than in a traditional cookie.

The research was published Friday by a team UC Berkeley privacy researchers that includes veteran privacy lawyer Chris Hoofnagle and noted privacy researcher Ashkan Soltani.
“The stuff works even if you have all cookies blocked and private-browsing mode enabled,” Soltani said. “The code itself is pretty damning.”

The researchers were reprising a study from 2009 which discovered that some of the net’s biggest sites were using technology from online ad tracking firms Clearspring and Quantcast to re-create users’ cookies after users deleted them. The technique involved using a little known property of Flash to hold onto unique ID numbers. Then, if a user deleted her cookies, the companies would check in the secondary stash for the user ID, and use it to resurrect the traditional HTML cookies.

That finding led to inquiries from regulators and a class action lawsuit alleging that websites and the tracking companies were unfairly monitoring users. That suit was settled for $2.4 million in cash and a promise by Clearspring and Quantcast not to use that method again.

One of the sites named in that suit was Hulu, but its part of the settlement only required that the company tell users if it was using Flash to store cookies and provide a link in the policy that would show users how to turn off Flash data storage. However with KISSmetrics running, even knowing how to do that wouldn’t have saved a user from persistent tracking.

This go-round the researchers’ report found only two sites that were recreating cookies after users deleted them — and Hulu.com was the only one doing so for tracking users across the entire site.

The researchers dug into Hulu.com’s tracking code and discovered the KISSmetrics code. Using it, Hulu was able to track users regardless of which browser they used or whether they deleted their cookies. KISSmetrics used a number of methods to recreate cookies, and the persistent tracking can only be avoided by erasing the browser cache between visits.

They also say that Shah’s defense that the system is not used to track people around the web doesn’t hold up.

“Both the Hulu and KISSmetrics code is pretty enlightening,” Soltani told Wired.com in an e-mail. “These services are using practically every known method to circumvent user attempts to protect their privacy (Cookies, Flash Cookies, HTML5, CSS, Cache Cookies/Etags…) creating a perpetual game of privacy ‘whack-a-mole’.”

“This is yet another example of the continued arms-race that consumers are engaged in when trying to protect their privacy online since advertisers are incentivized to come up with more pervasive tracking mechanisms unless there’s policy restrictions to prevent it.”

They point to their research that found that when a user visited Hulu.com, they would get a “third-party” cookie set by KISSmetrics with a tracking ID number. KISSmetrics would pass that number to Hulu, allowing Hulu to use it for its own cookie. Then if a user visited another site that was using KISSmetrics, that site’s cookie would get the exact same number as well.




In this screenshot provided by U.C. Berkeley's Chris Hoofnagle, the IDs numbers for all three cookies are exactly the same.

So that makes it possible, the researchers say, for any two sites using KISSmetrics to compare their databases, and ask things like “Hey, what do you know about user 345627?” and the other site could say “his name is John Smith and his email address is this@somefakedomainname.com and he likes these kinds of things.”

Shah did not respond to a follow-up e-mail seeking clarification on his first answers.

KISSmetrics is used by a number of prominent websites, which Wired.com is not naming until we have time to contact them.

Berkeley researcher Soltani, who consulted for the Wall Street Journal’s reporting on privacy, notes that the code includes function names like “cram cookie.”

One of the techniques used involves using something called ETags in the browser cache, a once-theoretical technique that’s never before been seen in the wild on a major site, according to the researchers.

The research also found that many top websites have adopted new ways to track users using HTML5 and that Google tracking cookies are present on 97 of the top sites, including government sites such as IRS.gov.

A screenshot of a browser cache cookie, which researchers say has never been seen in the wild before.

Further resources:

Thursday, August 5, 2010

What Do Online Advertisers Know About You?

by Tim Jones AUGUST 4TH, 2010

In a groundbreaking new series titled "What They Know," the Wall Street Journal is taking a close look at the information that online advertisers collect about you as you browse the Web:

"The tracking files represent the leading edge of a lightly regulated, emerging industry of data-gatherers who are in effect establishing a new business model for the Internet: one based on intensive surveillance of people to sell data about, and predictions of, their interests and activities, in real time."
What the industry knows about you may surprise you. The articles examine the world of tracking cookies, and other less well-known tracking technologies like flash cookies and beacons. Theyfound that "the nation's 50 top websites on average installed 64 pieces of tracking technology onto the computers of visitors, usually with no warning."

Using information gathered this way, the advertising industry is able to accurately guess substantial information about you — often including your gender, age, income, marital status, credit-rating, and whether you have children or own a home. The findings are used not only to determine what advertisements you see, but sometimes to decide what kind of discounts or credit card offers you're allowed access to.

The series also reveals the stunning story of how a 2008 power struggle at Microsoft Corp.undermined Web privacy standards. When the product design team behind Microsoft Internet Explorer 8.0 proposed adding stronger privacy safeguards, Microsoft's advertising department objected. The software features would have granted Web users substantially better privacy and protection from tracking than exists today. But Microsoft, seeking to maintain alliances with the online advertising industry, ultimately rejected the features. The story shows that the advertising industry has considerably more influence over web-browser design than one might expect.

The advertising executives interviewed in the series emphasize that the information collected is anonymous — in theory. But the series' fourth article — titled "On the Web's Cutting Edge, Anonymity in Name Only" — describes how de-anonymization techniques can be used to extrapolate actual identities from the information gathered.

The "What They Know" project is already the largest and highest-profile investigation by the mainstream media into consumer Web privacy to date. No doubt more articles are on the way, and the project's Twitter account is providing many smaller updates. It's already affecting the conversation in Washington DC, where important efforts by both Congress and the FTC are underway to rein in this dangerous and unregulated industry.

So, kudos to the team at the Wall Street Journal. Hopefully their efforts will encourage more serious approaches to privacy from regulators, law-makers, software companies, advertising companies and ordinary consumers.