"In a time of universal deceit telling the truth is a revolutionary act." -George Orwell

Posts Tagged ‘Privacy’

DHS Is Searching Your Facebook/Twitter For Words Like “Home”, “Cloud”, “Excercise” & “Social Media”

In Uncategorized on March 5, 2012 at 11:51 am

Oldspeak:The Department of Homeland Security monitors your updates on social networks, including Facebook and Twitter, to uncover “Items Of Interest”. That’s catchy, in a Orwellian kinna way. “Items Of Interest” really? “Cloud” is an “item of interest? Consider the irony. In an era of unprecedented safety in the U.S., under the guise of ‘national security’, the U.S. is prosecuting a perpetual and nebulous “War On Terror”, Numerous civil liberties have been shredded via the “USA Patriot Act” and secretly negotiated treaties like ACTA, while Americans are being surveiled and spied on more than ever. We’re being encouraged to “Go Digital” and transition most of our lives from the physical world to a ‘more convenient’ virtual world, that is easier to monitor and control.  We’ve created a culture of fear unmatched since the days of the “Red Scare”. While words like “freedom” and “democracy” and “liberty” and flung about like so much red white and blue confetti. It is the insidious brilliance of inverted totalitarianism. You’re taught to love your farm, while you’re kept, spiritually, mentally and nutritionally deprived. Perpetually generating revenue for the corporocratic elite. Entertained in a world of screens, constantly bombarded with messages from a formidable propaganda system, telling you what to buy, think, eat, feel and know. We can only be kept in the cages we do not see. And we’re taught to love our cages. “To See The Farm Is To Leave It.”

Related Video:

The Story Of Your Enslavement

By Joel Johnson @ Animal New York:

The Department of Homeland Security monitors your updates on social networks, including Facebook and Twitter, to uncover “Items Of Interest” (IOI), according to an internal DHS document released by the EPIC. That document happens to include a list of the baseline terms for which the DHS–or more specifically, a DHS subcontractor hired to monitor social networks–use to generate real-time IOI reports. (Although the released PDF is generally all reader-selectable text, the list of names was curiously embedded as an image of text, preventing simple indexing. We’ve fixed that below.)

To be fair, the DHS does have an internal privacy policy that attempts to strip your “PII”–Personally Identifiable Information–from the aggregated tweets and status updates, with some broad exceptions:

1) U.S. and foreign individuals in extremis situations involving potential life or death circumstances; (this is no change)
2) Senior U.S. and foreign government officials who make public statements or provide public updates;
3) U.S. and foreign government spokespersons who make public statements or provide public updates;
4) U.S. and foreign private sector officials and spokespersons who make public statements or provide public updates;
5) Names of anchors, newscasters, or on-scene reporters who are known or identified as reporters in their post or article or who use traditional and/or social media in real time to keep their audience situationally aware and informed;
6) Current and former public officials who are victims of incidents or activities related to Homeland Security; and
7) Terrorists, drug cartel leaders or other persons known to have been involved in major crimes of Homeland Security interest, (e.g., mass shooters such as those at Virginia Tech or Ft. Hood) who are killed or found dead.

In addition, the Media Monitoring Capability team can transmit personal information to the DHS National Operations Center over the phone as deemed necessary.

The MMC watch may provide the name, position, or other information considered to be PII to the NOC over the telephone when approved by the appropriate DHS OPS authority. But that information must not be stored in a database that could be searched by an individual’s PII.

In addition to the following list of terms, the DHS can also add additional search terms circumstantially as deemed necessary.

DHS Media Monitoring Terms

2.13 Key Words & Search TermsThis is a current list of terms that will be used by the NOC when monitoring social media sites to provide situational awareness and establish a common operating picture. As natural or manmade disasters occur, new search terms may be added.

The new search terms will not use PII in searching for relevant
mission-related information.

DHS & Other Agencies

  • Department of Homeland Security (DHS)
  • Federal Emergency Management Agency (FEMA)
  • Coast Guard (USCG)
  • Customs and Border Protection (CBP)
  • Border Patrol
  • Secret Service (USSS)
  • National Operations Center (NOC)
  • Homeland Defense
  • Immigration Customs Enforcement (ICE)
  • Agent
  • Task Force
  • Central Intelligence Agency (CIA)
  • Fusion Center
  • Drug Enforcement Agency (DEA)
  • Secure Border Initiative (SBI)
  • Federal Bureau of Investigation (FBI)
  • Alcohol Tobacco and Firearms (ATF)
  • U.S. Citizenship and Immigration Services (CIS)
  • Federal Air Marshal Service (FAMS)
  • Transportation Security Administration (TSA)
  • Air Marshal
  • Federal Aviation Administration (FAA)
  • National Guard
  • Red Cross
  • United Nations (UN)

Domestic Security

  • Assassination
  • Attack
  • Domestic security
  • Drill
  • Exercise
  • Cops
  • Law enforcement
  • Authorities
  • Disaster assistance
  • Disaster management
  • DNDO (Domestic Nuclear Detection Office)
  • National preparedness
  • Mitigation
  • Prevention
  • Response
  • Recovery
  • Dirty Bomb
  • Domestic nuclear detection
  • Emergency management
  • Emergency response
  • First responder
  • Homeland security
  • Maritime domain awareness (MDA)
  • National preparedness initiative
  • Militia
  • Shooting
  • Shots fired
  • Evacuation
  • Deaths
  • Hostage
  • Explosion (explosive)
  • Police
  • Disaster medical assistance team (DMAT)
  • Organized crime
  • Gangs
  • National security
  • State of emergency
  • Security
  • Breach
  • Threat
  • Standoff
  • SWAT
  • Screening
  • Lockdown
  • Bomb (squad or threat)
  • Crash
  • Looting
  • Riot
  • Emergency Landing
  • Pipe bomb
  • Incident
  • Facility

HAZMAT & Nuclear

  • Hazmat
  • Nuclear
  • Chemical Spill
  • Suspicious package/device
  • Toxic
  • National laboratory
  • Nuclear facility
  • Nuclear threat
  • Cloud
  • Plume
  • Radiation
  • Radioactive
  • Leak
  • Biological infection (or event)
  • Chemical
  • Chemical burn
  • Biological
  • Epidemic
  • Hazardous
  • Hazardous material incident
  • Industrial spill
  • Infection
  • Powder (white)
  • Gas
  • Spillover
  • Anthrax
  • Blister agent
  • Exposure
  • Burn
  • Nerve agent
  • Ricin
  • Sarin
  • North Korea

Health Concern + H1N1

  • Outbreak
  • Contamination
  • Exposure
  • Virus
  • Evacuation
  • Bacteria
  • Recall
  • Ebola
  • Food Poisoning
  • Foot and Mouth (FMD)
  • H5N1
  • Avian
  • Flu
  • Salmonella
  • Small Pox
  • Plague
  • Human to human
  • Human to ANIMAL
  • Influenza
  • Center for Disease Control (CDC)
  • Drug Administration (FDA)
  • Public Health
  • Toxic
  • Agro Terror
  • Tuberculosis (TB)
  • Agriculture
  • Listeria
  • Symptoms
  • Mutation
  • Resistant
  • Antiviral
  • Wave
  • Pandemic
  • Infection
  • Water/air borne
  • Sick
  • Swine
  • Pork
  • Strain
  • Quarantine
  • H1N1
  • Vaccine
  • Tamiflu
  • Norvo Virus
  • Epidemic
  • World Health Organization (WHO and components)
  • Viral Hemorrhagic Fever
  • E. Coli

Infrastructure Security

  • Infrastructure security
  • Airport
  • CIKR (Critical Infrastructure & Key Resources)
  • AMTRAK
  • Collapse
  • Computer infrastructure
  • Communications infrastructure
  • Telecommunications
  • Critical infrastructure
  • National infrastructure
  • Metro
  • WMATA
  • Airplane (and derivatives)
  • Chemical fire
  • Subway
  • BART
  • MARTA
  • Port Authority
  • NBIC (National Biosurveillance Integration Center)
  • Transportation security
  • Grid
  • Power
  • Smart
  • Body scanner
  • Electric
  • Failure or outage
  • Black out
  • Brown out
  • Port
  • Dock
  • Bridge
  • Canceled
  • Delays
  • Service disruption
  • Power lines

Southwest Border Violence

  • Drug cartel
  • Violence
  • Gang
  • Drug
  • Narcotics
  • Cocaine
  • Marijuana
  • Heroin
  • Border
  • Mexico
  • Cartel
  • Southwest
  • Juarez
  • Sinaloa
  • Tijuana
  • Torreon
  • Yuma
  • Tucson
  • Decapitated
  • U.S. Consulate
  • Consular
  • El Paso
  • Fort Hancock
  • San Diego
  • Ciudad Juarez
  • Nogales
  • Sonora
  • Colombia
  • Mara salvatrucha
  • MS13 or MS-13
  • Drug war
  • Mexican army
  • Methamphetamine
  • Cartel de Golfo
  • Gulf Cartel
  • La Familia
  • Reynose
  • Nuevo Leon
  • Narcos
  • Narco banners (Spanish equivalents)
  • Los Zetas
  • Shootout
  • Execution
  • Gunfight
  • Trafficking
  • Kidnap
  • Calderon
  • Reyosa
  • Bust
  • Tamaulipas
  • Meth Lab
  • Drug trade
  • Illegal immigrants
  • Smuggling (smugglers)
  • Matamoros
  • Michoacana
  • Guzman
  • Arellano-Felix
  • Beltran-Leyva
  • Barrio Azteca
  • Artistics Assassins
  • Mexicles
  • New Federation

Terrorism

  • Terrorism
  • Al Queda (all spellings)
  • Terror
  • Attack
  • Iraq
  • Afghanistan
  • Iran
  • Pakistan
  • Agro
  • Environmental terrorist
  • Eco terrorism
  • Conventional weapon
  • Target
  • Weapons grade
  • Dirty bomb
  • Enriched
  • Nuclear
  • Chemical weapon
  • Biological weapon
  • Ammonium nitrate
  • Improvised explosive device
  • IED (Improvised Explosive Device)
  • Abu Sayyaf
  • Hamas
  • FARC (Armed Revolutionary Forces Colombia)
  • IRA (Irish Republican Army)
  • ETA (Euskadi ta Askatasuna)
  • Basque Separatists
  • Hezbollah
  • Tamil Tiger
  • PLF (Palestine Liberation Front)
  • PLO (Palestine Libration Organization)
  • Car bomb
  • Jihad
  • Taliban
  • Weapons cache
  • Suicide bomber
  • Suicide attack
  • Suspicious substance
  • AQAP (Al Qaeda Arabian Peninsula)
  • AQIM (Al Qaeda in the Islamic Maghreb)
  • TTP (Tehrik-i-Taliban Pakistan)
  • Yemen
  • Pirates
  • Extremism
  • Somalia
  • Nigeria
  • Radicals
  • Al-Shabaab
  • Home grown
  • Plot
  • Nationalist
  • Recruitment
  • Fundamentalism
  • Islamist

Weather/Disaster/Emergency

  • Emergency
  • Hurricane
  • Tornado
  • Twister
  • Tsunami
  • Earthquake
  • Tremor
  • Flood
  • Storm
  • Crest
  • Temblor
  • Extreme weather
  • Forest fire
  • Brush fire
  • Ice
  • Stranded/Stuck
  • Help
  • Hail
  • Wildfire
  • Tsunami Warning Center
  • Magnitude
  • Avalanche
  • Typhoon
  • Shelter-in-place
  • Disaster
  • Snow
  • Blizzard
  • Sleet
  • Mud slide or Mudslide
  • Erosion
  • Power outage
  • Brown out
  • Warning
  • Watch
  • Lightening
  • Aid
  • Relief
  • Closure
  • Interstate
  • Burst
  • Emergency Broadcast System

Cyber Security

  • Cyber security
  • Botnet
  • DDOS (dedicated denial of service)
  • Denial of service
  • Malware
  • Virus
  • Trojan
  • Keylogger
  • Cyber Command
  • 2600
  • Spammer
  • Phishing
  • Rootkit
  • Phreaking
  • Cain and abel
  • Brute forcing
  • Mysql injection
  • Cyber attack
  • Cyber terror
  • Hacker
  • China
  • Conficker
  • Worm
  • Scammers
  • Social media

Yes, the Department of Homeland Security is searching social media for…”social media”.

Apple’s iPhone Keeps A Secret Record Of Everywhere You Go, Your Permission Is Not Required

In Uncategorized on April 20, 2011 at 6:02 pm

20th Century Telescreen

Oldspeak: ” ‘Big Brother is watching you’ -George Orwell. As the surveillance state continues to expand under the guise of “convenience” and “personalization” your privacy is invaded and your rights are contracted. Contemplation complete, I’m officially trashing my iPhone. You should too. Your personal “Telescreen” is recording your movements 24-7, sans your permission. It’s not accidental, and it’s not being transmitted to Apple. And there’s nothing you can do about it. Except stop using it.  ’Apple declined to comment on why the file is created or whether it can be disabled’. Why? Who is this information shared with? Where could it be transmitted? Why is this information not disclosed to users?!”

By Charles Arthur @ The U.K. Guardian:

21st. Century Telescreen. Apple’s iPhone saves every detail of your movements to a file on the device.

Security researchers have discovered that Apple‘s iPhone keeps track of where you go – and saves every detail of it to a secret file on the device which is then copied to the owner’s computer when the two are synchronised.

The file contains the latitude and longitude of the phone’s recorded coordinates along with a timestamp, meaning that anyone who stole the phone or the computer could discover details about the owner’s movements using a simple program.

For some phones, there could be almost a year’s worth of data stored, as the recording of data seems to have started with Apple’s iOS 4 update to the phone’s operating system, released in June 2010.

“Apple has made it possible for almost anybody – a jealous spouse, a private detective – with access to your phone or computer to get detailed information about where you’ve been,” said Pete Warden, one of the researchers.

Only the iPhone records the user’s location in this way, say Warden and Alasdair Allan, the data scientists who discovered the file and are presenting their findings at the Where 2.0 conference in San Francisco on Wednesday. “Alasdair has looked for similar tracking code in [Google's] Android phones and couldn’t find any,” said Warden. “We haven’t come across any instances of other phone manufacturers doing this.”

Simon Davies, director of the pressure group Privacy International, said: “This is a worrying discovery. Location is one of the most sensitive elements in anyone’s life – just think where people go in the evening. The existence of that data creates a real threat to privacy. The absence of notice to users or any control option can only stem from an ignorance about privacy at the design stage.”

Warden and Allan point out that the file is moved onto new devices when an old one is replaced: “Apple might have new features in mind that require a history of your location, but that’s our specualtion. The fact that [the file] is transferred across [to a new iPhone or iPad] when you migrate is evidence that the data-gathering isn’t accidental.” But they said it does not seem to be transmitted to Apple itself.

Map shows location data collected from an iPhone that had been used in the southwest of England

Although mobile networks already record phones’ locations, it is only available to the police and other recognised organisations following a court order under the Regulation of Investigatory Power Act. Standard phones do not record location data.

MPs in 2009 criticised the search engine giant Google for its “Latitude” system, which allowed people to enable their mobile to give out details of their location to trusted contacts. At the time MPs said that Latitude “could substantially endanger user privacy”, but Google pointed out that users had to specifically choose to make their data available.

The iPhone system, by contrast, appears to record the data whether or not the user agrees. Apple declined to comment on why the file is created or whether it can be disabled.

Warden and Allan have set up a web page which answers questions about the file, and created a simple downloadable application to let Apple users check for themselves what location data the phone is retaining. The Guardian has confirmed that 3G-enabled devices including the iPad also retain the data and copy it to the owner’s computer.

If someone were to steal an iPhone and “jailbreak” it, giving them direct access to the files it contains, they could extract the location database directly. Alternatively, anyone with direct access to a user’s computer could run the application and see a visualisation of their movements. Encrypting data on the computer is one way to protect against it, though that still leaves the file on the phone.

Graham Cluley, senior technology consultant at the security company Sophos, said: “If the data isn’t required for anything, then it shouldn’t store the location. And it doesn’t need to keep an archive on your machine of where you’ve been.” He suggested that Apple might be hoping that it would yield data for future mobile advertising targeted by location, although he added: “I tend to subscribe to cockup rather than conspiracy on things like this – I don’t think Apple is really trying to monitor where users are.”

The data inside the file containing the location and time information. This is used to plot the map above

The location file came to light when Warden and Allan were looking for a source of mobile data. “We’d been discussing doing a visualisation of mobile data, and while Alasdair was researching into what was available, he discovered this file. At first we weren’t sure how much data was there, but after we dug further and visualised the extracted data, it became clear that there was a scary amount of detail on our movements,” Warden said.

They have blogged about their discovery at O’Reilly’s Radar site, noting that “why this data is stored and how Apple intends to use it — or not — are important questions that need to be explored.”

The pair of data scientists have collaborated on a number of data visualisations, including a map of radiation levels in Japan for The Guardian. They are developing a Data Science Toolkit for dealing with location data.

Davies said that the discovery of the file indicated that Apple had failed to take users’ privacy seriously.

Apple can legitimately claim that it has permission to collect the data: near the end of the 15,200-word terms and conditions for its iTunes program, used to synchronise with iPhones, iPods and iPads, is an 86-word paragraph about “location-based services”.

It says that “Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services. For example, we may share geographic location with application providers when you opt in to their location services.”

Privacy invasions via technology

April 2011: iPhone location

British researchers on Wednesday revealed that iPhones (and 3G-enabled iPads) keep track of where you go, including timestamps, on a file that is backed up on your computer and shifted onto any new iPhone or iPad you get. Apple hasn’t said why the file is created or whether the tracking can be prevented.

October 2010: US Transportation Security Agency’s X-ray scanners

The “porno scanners” (as they quickly became known) offered a clothes-free vision of people passing through the backscatter machines (whose level of X-ray exposure was also questioned). People who objected to going through those were obliged to go through remarkably intimate examinations – none of which endeared the TSA to air travellers.

April 2010: Google captures Wi-Fi data

In a series of increasingly embarrassed blogposts over the course of April, May and June, Google admitted that while its cars were driving around to capture its (already slightly controversial) Street View pictures of locations around the world, it had also captured Wi-Fi network names – and data from the open ones, potentially including passwords and usernames. The dispute over whether Google should delete the data, and whether it had broken the law in various countries, rumbled on for months.

December 2009: Eric Schmidt

In a speech, Google’s then-chief executive Eric Schmidt suggested that: “If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. If you really need that kind of privacy, the reality is that search engines – including Google – do retain this information for some time and it’s important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.”

His words provoked an outcry from privacy rights campaigners, who pointed out that privacy is a right, and that it protects every citizen from abuses by those in power.

Big Brother Comes To Main Street

In Uncategorized on December 21, 2010 at 4:08 pm

Oldspeak: Since 9/11, under the guise of “national security” the U.S. surveillance state has expanded exponentially. No one really knows how much money it costs, how many people it employs or how many programs exist within it. Good news for the  Military Industrial Complex; it’s selling surveillance  technology to state and local law enforcement to monitor thousands of average Americans, who 9 times out of 10 have not been accused of wrongdoing. Coupled with overcriminalization, arrests are up, which is good news for the profit driven Prison Industrial Complex, always in need of new slave laborers to fill jail cells and increase profit margins. Profit Is Paramount.”

From Dana Priest & Willam H. Arkin @ The Washington Post:

Nine years after the terrorist attacks of 2001, the United States is assembling a vast domestic intelligence apparatus to collect information about Americans, using the FBI, local police, state homeland security offices and military criminal investigators.

The system, by far the largest and most technologically sophisticated in the nation’s history, collects, stores and analyzes information about thousands of U.S. citizens and residents, many of whom have not been accused of any wrongdoing.

The government’s goal is to have every state and local law enforcement agency in the country feed information to Washington to buttress the work of the FBI, which is in charge of terrorism investigations in the United States.

Other democracies – Britain and Israel, to name two – are well acquainted with such domestic security measures. But for the United States, the sum of these new activities represents a new level of governmental scrutiny.

This localized intelligence apparatus is part of a larger Top Secret America created since the attacks. In July, The Washington Post described an alternative geography of the United States, one that has grown so large, unwieldy and secretive that no one knows how much money it costs, how many people it employs or how many programs exist within it.

Today’s story, along with related material on The Post’s Web site, examines how Top Secret America plays out at the local level. It describes a web of 4,058 federal, state and local organizations, each with its own counterterrorism responsibilities and jurisdictions. At least 935 of these organizations have been created since the 2001 attacks or became involved in counterterrorism for the first time after 9/11.

(Search our database for your state to find a detailed profile of counterterrorism efforts in your community.)

The months-long investigation, based on nearly 100 interviews and 1,000 documents, found that:

* Technologies and techniques honed for use on the battlefields of Iraq and Afghanistan have migrated into the hands of law enforcement agencies in America.

* The FBI is building a database with the names and certain personal information, such as employment history, of thousands of U.S. citizens and residents whom a local police officer or a fellow citizen believed to be acting suspiciously. It is accessible to an increasing number of local law enforcement and military criminal investigators, increasing concerns that it could somehow end up in the public domain.

* Seeking to learn more about Islam and terrorism, some law enforcement agencies have hired as trainers self-described experts whose extremist views on Islam and terrorism are considered inaccurate and counterproductive by the FBI and U.S. intelligence agencies.

* The Department of Homeland Security sends its state and local partners intelligence reports with little meaningful guidance, and state reports have sometimes inappropriately reported on lawful meetings.

 

 

The need to identify U.S.-born or naturalized citizens who are planning violent attacks is more urgent than ever, U.S. intelligence officials say. This month’s FBI sting operation involving a Baltimore construction worker who allegedly planned to bomb a Maryland military recruiting station is the latest example. It followed a similar arrest of a Somali-born naturalized U.S. citizen allegedly seeking to detonate a bomb near a Christmas tree lighting ceremony in Portland, Ore. There have been nearly two dozen other cases just this year.

“The old view that ‘if we fight the terrorists abroad, we won’t have to fight them here’ is just that – the old view,” Homeland Security Secretary Janet Napolitano told police and firefighters recently.

The Obama administration heralds this local approach as a much-needed evolution in the way the country confronts terrorism.

 

 

However, just as at the federal level, the effectiveness of these programs, as well as their cost, is difficult to determine. The Department of Homeland Security, for example, does not know how much money it spends each year on what are known as state fusion centers, which bring together and analyze information from various agencies within a state.

The total cost of the localized system is also hard to gauge. The DHS has given $31 billion in grants since 2003 to state and local governments for homeland security and to improve their ability to find and protect against terrorists, including $3.8 billion in 2010. At least four other federal departments also contribute to local efforts. But the bulk of the spending every year comes from state and local budgets that are too disparately recorded to aggregate into an overall total.

 

The Post findings paint a picture of a country at a crossroads, where long-standing privacy principles are under challenge by these new efforts to keep the nation safe.

The public face of this pivotal effort is Napolitano, the former governor of Arizona, which years ago built one of the strongest state intelligence organizations outside of New York to try to stop illegal immigration and drug importation.

Napolitano has taken her “See Something, Say Something” campaign far beyond the traffic signs that ask drivers coming into the nation’s capital for “Terror Tips” and to “Report Suspicious Activity.”

She recently enlisted the help of Wal-Mart, Amtrak, major sports leagues, hotel chains and metro riders. In her speeches, she compares the undertaking to the Cold War fight against communists.

“This represents a shift for our country,” she told New York City police officers and firefighters on the eve of the 9/11 anniversary this fall. “In a sense, this harkens back to when we drew on the tradition of civil defense and preparedness that predated today’s concerns.”

—-

From Afghanistan to Tennessee

On a recent night in Memphis, a patrol car rolled slowly through a parking lot in a run-down section of town. The military-grade infrared camera on its hood moved robotically from left to right, snapping digital images of one license plate after another and analyzing each almost instantly.

Suddenly, a red light flashed on the car’s screen along with the word “warrant.”

“Got a live one! Let’s do it,” an officer called out.

The streets of Memphis are a world away from the streets of Kabul, yet these days, the same types of technologies and techniques are being used in both places to identify and collect information about suspected criminals and terrorists.

The examples go far beyond Memphis.

* Hand-held, wireless fingerprint scanners were carried by U.S. troops during the insurgency in Iraq to register residents of entire neighborhoods. L-1 Identity Solutions is selling the same type of equipment to police departments to check motorists’ identities.

* In Arizona, the Maricopa County Sheriff’s Facial Recognition Unit, using a type of equipment prevalent in war zones, records 9,000 biometric digital mug shots a month.

* U.S. Customs and Border Protection flies General Atomics’ Predator drones along the Mexican and Canadian borders – the same kind of aircraft, equipped with real-time, full-motion video cameras, that has been used in wars in Kosovo, Iraq and Afghanistan to track the enemy.

The special operations units deployed overseas to kill the al-Qaeda leadership drove technological advances that are now expanding in use across the United States. On the front lines, those advances allowed the rapid fusing of biometric identification, captured computer records and cellphone numbers so troops could launch the next surprise raid.

Here at home, it’s the DHS that is enamored with collecting photos, video images and other personal information about U.S. residents in the hopes of teasing out terrorists.

The DHS helped Memphis buy surveillance cameras that monitor residents near high-crime housing projects, problematic street corners, and bridges and other critical infrastructure. It helped pay for license plate readers and defrayed some of the cost of setting up Memphis’s crime-analysis center. All together it has given Memphis $11 million since 2003 in homeland security grants, most of which the city has used to fight crime.

 

“We have got things now we didn’t have before,” said Memphis Police Department Director Larry Godwin, who has produced record numbers of arrests using all this new analysis and technology. “Some of them we can talk about. Some of them we can’t.”

One of the biggest advocates of Memphis’s data revolution is John Harvey, the police department’s technology specialist, whose computer systems are the civilian equivalent of the fancier special ops equipment used by the military.

Harvey collects any information he can pry out of government and industry. When officers were wasting time knocking on the wrong doors to serve warrants, he persuaded the local utility company to give him a daily update of the names and addresses of customers.

When he wanted more information about phones captured at crime scenes, he programmed a way to store all emergency 911 calls, which often include names and addresses to associate with phone numbers. He created another program to upload new crime reports every five minutes and mine them for the phone numbers of victims, suspects, witnesses and anyone else listed on them.

Now, instead of having to decide which license plate numbers to type into a computer console in the patrol car, an officer can simply drive around, and the automatic license plate reader on his hood captures the numbers on every vehicle nearby. If the officer pulls over a driver, instead of having to wait 20 minutes for someone back at the office to manually check records, he can use a hand-held device to instantly call up a mug shot, a Social Security number, the status of the driver’s license and any outstanding warrants.

The computer in the cruiser can tell an officer even more about who owns the vehicle, the owner’s name and address and criminal history, and who else with a criminal history might live at the same address.

Take a recent case of two officers with the hood-mounted camera equipment who stopped a man driving on a suspended license. One handcuffed him, and the other checked his own PDA. Based on the information that came up, the man was ordered downtown to pay a fine and released as the officers drove off to stop another car.

That wasn’t the end of it, though.

A record of that stop – and the details of every other arrest made that night, and every summons written – was automatically transferred to the Memphis Real Time Crime Center, a command center with three walls of streaming surveillance video and analysis capabilities that rival those of an Army command center.

There, the information would be geocoded on a map to produce a visual rendering of crime patterns. This information would help the crime intelligence analysts predict trends so the department could figure out what neighborhoods to swarm with officers and surveillance cameras.

But that was still not the end of it, because the fingerprints from the crime records would also go to the FBI’s data campus in Clarksburg, W.Va. There, fingerprints from across the United States are stored, along with others collected by American authorities from prisoners in Saudi Arabia and Yemen, Iraq and Afghanistan.

There are 96 million sets of fingerprints in Clarksburg, a volume that government officials view not as daunting but as an opportunity.

This year for the first time, the FBI, the DHS and the Defense Department are able to search each other’s fingerprint databases, said Myra Gray, head of the Defense Department’s Biometrics Identity Management Agency, speaking to an industry group recently. “Hopefully in the not-too-distant future,” she said, “our relationship with these federal agencies – along with state and local agencies – will be completely symbiotic.”

—-

The FBI’s ‘suspicious’ files

At the same time that the FBI is expanding its West Virginia database, it is building a vast repository controlled by people who work in a top-secret vault on the fourth floor of the J. Edgar Hoover FBI Building in Washington. This one stores the profiles of tens of thousands of Americans and legal residents who are not accused of any crime. What they have done is appear to be acting suspiciously to a town sheriff, a traffic cop or even a neighbor.

If the new Nationwide Suspicious Activity Reporting Initiative, or SAR, works as intended, the Guardian database may someday hold files forwarded by all police departments across the country in America’s continuing search for terrorists within its borders.

The effectiveness of this database depends, in fact, on collecting the identities of people who are not known criminals or terrorists – and on being able to quickly compile in-depth profiles of them.

 

“If we want to get to the point where we connect the dots, the dots have to be there,” said Richard A. McFeely, special agent in charge of the FBI’s Baltimore office.

In response to concerns that information in the database could be improperly used or released, FBI officials say anyone with access has been trained in privacy rules and the penalties for breaking them.

But not everyone is convinced. “It opens a door for all kinds of abuses,” said Michael German, a former FBI agent who now leads the American Civil Liberties Union’s campaign on national security and privacy matters. “How do we know there are enough controls?”

The government defines a suspicious activity as “observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity” related to terrorism.

State intelligence analysts and FBI investigators use the reports to determine whether a person is buying fertilizer to make a bomb or to plant tomatoes; whether she is plotting to poison a city’s drinking water or studying for a metallurgy test; whether, as happened on a Sunday morning in late September, the man snapping a picture of a ferry in the Newport Beach harbor in Southern California simply liked the way it looked or was plotting to blow it up.

Suspicious Activity Report N03821 says a local law enforcement officer observed “a suspicious subject . . . taking photographs of the Orange County Sheriff Department Fire Boat and the Balboa Ferry with a cellular phone camera.” The confidential report, marked “For Official Use Only,” noted that the subject next made a phone call, walked to his car and returned five minutes later to take more pictures. He was then met by another person, both of whom stood and “observed the boat traffic in the harbor.” Next another adult with two small children joined them, and then they all boarded the ferry and crossed the channel.

All of this information was forwarded to the Los Angeles fusion center for further investigation after the local officer ran information about the vehicle and its owner through several crime databases and found nothing.

Authorities would not say what happened to it from there, but there are several paths a suspicious activity report can take:

At the fusion center, an officer would decide to either dismiss the suspicious activity as harmless or forward the report to the nearest FBI terrorism unit for further investigation.

At that unit, it would immediately be entered into the Guardian database, at which point one of three things could happen:

The FBI could collect more information, find no connection to terrorism and mark the file closed, though leaving it in the database.

It could find a possible connection and turn it into a full-fledged case.

Or, as most often happens, it could make no specific determination, which would mean that Suspicious Activity Report N03821 would sit in limbo for as long as five years, during which time many other pieces of information about the man photographing a boat on a Sunday morning could be added to his file: employment, financial and residential histories; multiple phone numbers; audio files; video from the dashboard-mounted camera in the police cruiser at the harbor where he took pictures; and anything else in government or commercial databases “that adds value,” as the FBI agent in charge of the database described it.

That could soon include biometric data, if it existed; the FBI is working on a way to attach such information to files. Meanwhile, the bureau will also soon have software that allows local agencies to map all suspicious incidents in their jurisdiction.

The Defense Department is also interested in the database. It recently transferred 100 reports of suspicious behavior into the Guardian system, and over time it expects to add thousands more as it connects 8,000 military law enforcement personnel to an FBI portal that will allow them to send and review reports about people suspected of casing U.S. bases or targeting American personnel.

And the DHS has created a separate way for state and local authorities, private citizens, and businesses to submit suspicious activity reports to the FBI and to the department for analysis.

As of December, there were 161,948 suspicious activity files in the classified Guardian database, mostly leads from FBI headquarters and state field offices. Two years ago, the bureau set up an unclassified section of the database so state and local agencies could send in suspicious incident reports and review those submitted by their counterparts in other states. Some 890 state and local agencies have sent in 7,197 reports so far.

 

Of those, 103 have become full investigations that have resulted in at least five arrests, the FBI said. There have been no convictions yet. An additional 365 reports have added information to ongoing cases.

But most remain in the uncertain middle, which is why within the FBI and other intelligence agencies there is much debate about the effectiveness of the bottom-up SAR approach, as well as concern over the privacy implications of retaining so much information on U.S. citizens and residents who have not been charged with anything.

The vast majority of terrorism leads in the United States originate from confidential FBI sources and from the bureau’s collaboration with federal intelligence agencies, which mainly work overseas. Occasionally a stop by a local police officer has sparked an investigation. Evidence comes from targeted FBI surveillance and undercover operations, not from information and analysis generated by state fusion centers about people acting suspiciously.

“It’s really resource-inefficient,” said Philip Mudd, a 20-year CIA counterterrorism expert and a top FBI national security official until he retired nine months ago. “If I were to have a dialogue with the country about this . . . it would be about not only how we chase the unknowns, but do you want to do suspicious activity reports across the country? . . . Anyone who is not at least suspected of doing something criminal should not be in a database.”

Charles Allen, a longtime senior CIA official who then led the DHS’s intelligence office until 2009, said some senior people in the intelligence community are skeptical that SARs are an effective way to find terrorists. “It’s more likely that other kinds of more focused efforts by local police will gain you the information that you need about extremist activities,” he said.

The DHS can point to some successes: Last year the Colorado fusion center turned up information on Najibullah Zazi, an Afghan-born U.S. resident planning to bomb the New York subway system. In 2007, a Florida fusion center provided the vehicle ownership history used to identify and arrest an Egyptian student who later pleaded guilty to providing material support to terrorism, in this case transporting explosives.

“Ninety-nine percent doesn’t pan out or lead to anything” said Richard Lambert Jr., the special agent in charge of the FBI’s Knoxville office. “But we’re happy to wade through these things.”

—-

Expert training?

Ramon Montijo has taught classes on terrorism and Islam to law enforcement officers all over the country.

“Alabama, Colorado, Vermont,” said Montijo, a former Army Special Forces sergeant and Los Angeles Police Department investigator who is now a private security consultant. “California, Texas and Missouri,” he continued.

What he tells them is always the same, he said: Most Muslims in the United States want to impose sharia law here.

“They want to make this world Islamic. The Islamic flag will fly over the White House – not on my watch!” he said. “My job is to wake up the public, and first, the first responders.”

With so many local agencies around the country being asked to help catch terrorists, it often falls to sheriffs or state troopers to try to understand the world of terrorism. They aren’t FBI agents, who have years of on-the-job and classroom training.

Instead, they are often people like Lacy Craig, who was a police dispatcher before she became an intelligence analyst at Idaho’s fusion center, or the detectives in Minnesota, Michigan and Arkansas who can talk at length about the lineage of gangs or the signs of a crystal meth addict.

Now each of them is a go-to person on terrorism as well.

“The CIA used to train analysts forever before they graduated to be a real analyst,” said Allen, the former top CIA and DHS official. “Today we take former law enforcement officers and we call them intelligence officers, and that’s not right, because they have not received any training on intelligence analysis.”

 

State fusion center officials say their analysts are getting better with time. “There was a time when law enforcement didn’t know much about drugs. This is no different,” said Steven W. Hewitt, who runs the Tennessee fusion center, considered one of the best in the country. “Are we experts at the level of [the National Counterterrorism Center]? No. Are we developing an expertise? Absolutely.”

But how they do that is usually left up to the local police departments themselves. In their desire to learn more about terrorism, many departments are hiring their own trainers. Some are self-described experts whose extremist views are considered inaccurate and harmful by the FBI and others in the intelligence community

Like Montijo, Walid Shoebat, a onetime Muslim who converted to Christianity, also lectures to local police. He too believes that most Muslims seek to impose sharia law in the United States. To prevent this, he said in an interview, he warns officers that “you need to look at the entire pool of Muslims in a community.”

When Shoebat spoke to the first annual South Dakota Fusion Center Conference in Sioux Falls this June, he told them to monitor Muslim student groups and local mosques and, if possible, tap their phones. “You can find out a lot of information that way,” he said.

A book expanding on what Shoebat and Montijo believe has just been published by the Center for Security Policy, a Washington-based neoconservative think tank. “Shariah: The Threat to America” describes what its authors call a “stealth jihad” that must be thwarted before it’s too late.

The book’s co-authors include such notables as former CIA director R. James Woolsey and former deputy undersecretary of defense for intelligence Lt. Gen. William G. Boykin, along with the center’s director, a longtime activist. They write that most mosques in the United States already have been radicalized, that most Muslim social organizations are fronts for violent jihadists and that Muslims who practice sharia law seek to impose it in this country.

Frank Gaffney Jr., director of the center, said his team has spoken widely, including to many law enforcement forums.

“Members of our team have been involved in training programs for several years now, many of which have been focused on local law enforcement intelligence, homeland security, state police, National Guard units and the like,” Gaffney said. “We’re seeing a considerable ramping-up of interest in getting this kind of training.”

Government terrorism experts call the views expressed in the center’s book inaccurate and counterproductive. They say the DHS should increase its training of local police, using teachers who have evidence-based viewpoints.

DHS spokeswoman Amy Kudwa said the department does not maintain a list of terrorism experts but is working on guidelines for local authorities wrestling with the topic.

So far, the department has trained 1,391 local law enforcement officers in analyzing public information and 400 in analytic thinking and writing skills. Kudwa said the department also offers counterterrorism training through the Federal Emergency Management Agency, which this year enrolled 94 people in a course called “Advanced Criminal Intelligence Analysis to Prevent Terrorism.”

—-

A lack of useful information

The DHS also provides local agencies a daily flow of information bulletins.

These reports are meant to inform agencies about possible terror threats. But some officials say they deliver a never-ending stream of information that is vague, alarmist and often useless. “It’s like a garage in your house you keep throwing junk into until you can’t park your car in it,” says Michael Downing, deputy chief of counterterrorism and special operations for the Los Angeles Police Department.

A review of nearly 1,000 DHS reports dating back to 2003 and labeled “For Official Use Only” underscores Downing’s description. Typical is one from May 24, 2010, titled “Infrastructure Protection Note: Evolving Threats to the Homeland.”

 

It tells officials to operate “under the premise that other operatives are in the country and could advance plotting with little or no warning.” Its list of vulnerable facilities seems to include just about everything: “Commercial Facilities, Government Facilities, Banking and Financial and Transportation . . .”

Bart R. Johnson, who heads the DHS’s intelligence and analysis office, defended such reports, saying that threat reporting has “grown and matured and become more focused.” The bulletins can’t be more specific, he said, because they must be written at the unclassified level.

Recently, the International Association of Chiefs of Police agreed that the information they were receiving had become “more timely and relevant” over the past year.

Downing, however, said the reports would be more helpful if they at least assessed threats within a specific state’s boundaries.

States have tried to do that on their own, but with mixed, and at times problematic, results.

In 2009, for instance, after the DHS and the FBI sent out several ambiguous reports about threats to mass-transit systems and sports and entertainment venues, the New Jersey Regional Operations Intelligence Center’s Threat Analysis Program added its own information. “New Jersey has a large mass-transit infrastructure,” its report warned, and “an NFL stadium and NHL/NBA arenas, a soccer stadium, and several concert venues that attract large crowds.”

In Virginia, the state’s fusion center published a terrorism threat assessment in 2009 naming historically black colleges as potential hubs for terrorism.

From 2005 to 2007, the Maryland State Police went even further, infiltrating and labeling as terrorists local groups devoted to human rights, antiwar causes and bike lanes.

And in Pennsylvania this year, a local contractor hired to write intelligence bulletins filled them with information about lawful meetings as varied as Pennsylvania Tea Party Patriots Coalition gatherings, antiwar protests and an event at which environmental activists dressed up as Santa Claus and handed out coal-filled stockings.

—-

‘We have our own terrorists’

Even if the information were better, it might not make a difference for the simplest of reasons: In many cities and towns across the country, there is just not enough terrorism-related work to do.

In Utah on one recent day, one of five intelligence analysts in the state’s fusion center was writing a report about the rise in teenage overdoses of an over-the-counter drug. Another was making sure the visiting president of Senegal had a safe trip. Another had just helped a small town track down two people who were selling magazine subscriptions and pocketing the money themselves.

In the Colorado Information Analysis Center, some investigators were following terrorism leads. Others were looking into illegal Craigslist postings and online “World of Warcraft” gamers.

The vast majority of fusion centers across the country have transformed themselves into analytical hubs for all crimes and are using federal grants, handed out in the name of homeland security, to combat everyday offenses.

This is happening because, after 9/11, local law enforcement groups did what every agency and private company did in Top Secret America: They followed the money.

The DHS helped the Memphis Police Department, for example, purchase 90 surveillance cameras, including 13 that monitor bridges and a causeway. It helped buy the fancy screens on the walls of the Real Time Crime Center, as well as radios, robotic surveillance equipment, a mobile command center and three bomb-sniffing dogs. All came in the name of port security and protection to critical infrastructure.

Since there hasn’t been a solid terrorism case in Memphis yet, the equipment’s greatest value has been to help drive down city crime. Where the mobile surveillance cameras are set up, criminals scatter, said Lt. Mark Rewalt, who, on a recent Saturday night, scanned the city from an altitude of 1,000 feet.

Flying in a police helicopter, Rewalt pointed out some of the cameras the DHS has funded. They are all over the city, in mall parking lots, in housing projects, at popular street hang-outs. “Cameras are what’s happening now,” he marveled.

Meanwhile, another post-9/11 unit in Tennessee has had even less terrorism-related work to do.

The Tennessee National Guard 45th Weapons of Mass Destruction Civil Support Team, one of at least 50 such units around the country, was created to respond to what officials still believe is the inevitable release of chemical, biological or radiological material by terrorists.

The unit’s 22 hazardous-materials personnel have the best emergency equipment in the state. A fleet of navy-blue vehicles – command, response, detection and tactical operations trucks – is kept polished and ready to roll in a garage at the armory in Smyrna.

 

The unit practices WMD scenarios constantly. But in real life, the crew uses the equipment very little: twice a year at NASCAR races in nearby Bristol to patrol for suspicious packages. Other than that, said Capt. Matt Hayes, several times a year they respond to hoaxes.

The fact that there has not been much terrorism to worry about is not evident on the Tennessee fusion center’s Web site. Click on the incident map, and the state appears to be under attack.

Red icons of explosions dot Tennessee, along with blinking exclamation marks and flashing skulls. The map is labeled: “Terrorism Events and Other Suspicious Activity.

But if you roll over the icons, the explanations that pop up have nothing to do with major terrorist plots: “Johnson City police are investigating three ‘bottle bombs’ found at homes over the past three days,” one description read recently. “. . . The explosives were made from plastic bottles with something inside that reacted chemically and caused the bottles to burst.”

Another told a similar story: “The Scott County Courthouse is currently under evacuation after a bomb threat was called in Friday morning. Update: Authorities completed their sweep . . . and have called off the evacuation.”

Nine years after 9/11, this map is part of the alternative geography that is Top Secret America, where millions of people are assigned to help stop terrorism. Memphis Police Director Godwin is one of them, and he has his own version of what that means in a city where there have been 86 murders so far this year.

“We have our own terrorists, and they are taking lives every day,” Godwin said. “No, we don’t have suicide bombers – not yet. But you need to remain vigilant and realize how vulnerable you can be if you let up.”

Staff researcher Julie Tate contributed to this story.


Your Apps Are Watching You

In Uncategorized on December 18, 2010 at 4:10 pm

Oldspeak: “The Matrix is everywhere. It is all around us. Even now, in this very room…. Yes your most beloved possession is a tracking device, transmitting your private data to parties unknown who use it to flesh out detailed dossiers on you, while marketers are using it in an attempt to sell you shit you don’t need. A WSJ Investigation finds that iPhone and Android apps are breaching the privacy of smartphone users”

From  SCOTT THURM and YUKARI IWATANI KANE @ The Wall Street Journal:

Few devices know more personal details about people than the smartphones in their pockets: phone numbers, current location, often the owner’s real name—even a unique ID number that can never be changed or turned off.

These phones don’t keep secrets. They are sharing this personal data widely and regularly, a Wall Street Journal investigation has found.

An examination of 101 popular smartphone “apps”—games and other software applications for iPhone and Android phones—showed that 56 transmitted the phone’s unique device ID to other companies without users’ awareness or consent. Forty-seven apps transmitted the phone’s location in some way. Five sent age, gender and other personal details to outsiders.

The findings reveal the intrusive effort by online-tracking companies to gather personal data about people in order to flesh out detailed dossiers on them.

WSJ’s Julia Angwin explains to Simon Constable how smartphone apps collect and broadcast data about your habits. Many don’t have privacy policies and there isn’t much you can do about it.

Among the apps tested, the iPhone apps transmitted more data than the apps on phones using Google Inc.’s Android operating system. Because of the test’s size, it’s not known if the pattern holds among the hundreds of thousands of apps available.

Apps sharing the most information included TextPlus 4, a popular iPhone app for text messaging. It sent the phone’s unique ID number to eight ad companies and the phone’s zip code, along with the user’s age and gender, to two of them.

Both the Android and iPhone versions of Pandora, a popular music app, sent age, gender, location and phone identifiers to various ad networks. iPhone and Android versions of a game called Paper Toss—players try to throw paper wads into a trash can—each sent the phone’s ID number to at least five ad companies. Grindr, an iPhone app for meeting gay men, sent gender, location and phone ID to three ad companies.

“In the world of mobile, there is no anonymity,” says Michael Becker of the Mobile Marketing Association, an industry trade group. A cellphone is “always with us. It’s always on.”

The Journal’s Cellphone Testing Methodology

The Wall Street Journal analyzed 50 popular applications, or “apps,” on each of the iPhone and Android operating systems to see what information about the phones, their users and their locations the apps send to themselves and to outsiders. More >

iPhone maker Apple Inc. says it reviews each app before offering it to users. Both Apple and Google say they protect users by requiring apps to obtain permission before revealing certain kinds of information, such as location.

“We have created strong privacy protections for our customers, especially regarding location-based data,” says Apple spokesman Tom Neumayr. “Privacy and trust are vitally important.”

The Journal found that these rules can be skirted. One iPhone app, Pumpkin Maker (a pumpkin-carving game), transmits location to an ad network without asking permission. Apple declines to comment on whether the app violated its rules.

Smartphone users are all but powerless to limit the tracking. With few exceptions, app users can’t “opt out” of phone tracking, as is possible, in limited form, on regular computers. On computers it is also possible to block or delete “cookies,” which are tiny tracking files. These techniques generally don’t work on cellphone apps.

The makers of TextPlus 4, Pandora and Grindr say the data they pass on to outside firms isn’t linked to an individual’s name. Personal details such as age and gender are volunteered by users, they say. The maker of Pumpkin Maker says he didn’t know Apple required apps to seek user approval before transmitting location. The maker of Paper Toss didn’t respond to requests for comment.

Many apps don’t offer even a basic form of consumer protection: written privacy policies. Forty-five of the 101 apps didn’t provide privacy policies on their websites or inside the apps at the time of testing. Neither Apple nor Google requires app privacy policies.

To expose the information being shared by smartphone apps, the Journal designed a system to intercept and record the data they transmit, then decoded the data stream. The research covered 50 iPhone apps and 50 on phones using Google’s Android operating system. (Methodology at WSJ.com/WTK.)

The Journal also tested its own iPhone app; it didn’t send information to outsiders. The Journal doesn’t have an Android phone app.

Among all apps tested, the most widely shared detail was the unique ID number assigned to every phone. It is effectively a “supercookie,” says Vishal Gurbuxani, co-founder of Mobclix Inc., an exchange for mobile advertisers.

On iPhones, this number is the “UDID,” or Unique Device Identifier. Android IDs go by other names. These IDs are set by phone makers, carriers or makers of the operating system, and typically can’t be blocked or deleted.

“The great thing about mobile is you can’t clear a UDID like you can a cookie,” says Meghan O’Holleran of Traffic Marketplace, an Internet ad network that is expanding into mobile apps. “That’s how we track everything.”

Ms. O’Holleran says Traffic Marketplace, a unit of Epic Media Group, monitors smartphone users whenever it can. “We watch what apps you download, how frequently you use them, how much time you spend on them, how deep into the app you go,” she says. She says the data is aggregated and not linked to an individual.

The main companies setting ground rules for app data-gathering have big stakes in the ad business. The two most popular platforms for new U.S. smartphones are Apple’s iPhone and Google’s Android. Google and Apple also run the two biggest services, by revenue, for putting ads on mobile phones.

Apple and Google ad networks let advertisers target groups of users. Both companies say they don’t track individuals based on the way they use apps.

Apple limits what can be installed on an iPhone by requiring iPhone apps to be offered exclusively through its App Store. Apple reviews those apps for function, offensiveness and other criteria.

Apple says iPhone apps “cannot transmit data about a user without obtaining the user’s prior permission and providing the user with access to information about how and where the data will be used.” Many apps tested by the Journal appeared to violate that rule, by sending a user’s location to ad networks, without informing users. Apple declines to discuss how it interprets or enforces the policy.

Phones running Google’s Android operating system are made by companies including Motorola Inc. and Samsung Electronics Co. Google doesn’t review the apps, which can be downloaded from many vendors. Google says app makers “bear the responsibility for how they handle user information.”

Google requires Android apps to notify users, before they download the app, of the data sources the app intends to access. Possible sources include the phone’s camera, memory, contact list, and more than 100 others. If users don’t like what a particular app wants to access, they can choose not to install the app, Google says.

“Our focus is making sure that users have control over what apps they install, and notice of what information the app accesses,” a Google spokesman says.

Neither Apple nor Google requires apps to ask permission to access some forms of the device ID, or to send it to outsiders. When smartphone users let an app see their location, apps generally don’t disclose if they will pass the location to ad companies.

Lack of standard practices means different companies treat the same information differently. For example, Apple says that, internally, it treats the iPhone’s UDID as “personally identifiable information.” That’s because, Apple says, it can be combined with other personal details about people—such as names or email addresses—that Apple has via the App Store or its iTunes music services. By contrast, Google and most app makers don’t consider device IDs to be identifying information.

A growing industry is assembling this data into profiles of cellphone users. Mobclix, the ad exchange, matches more than 25 ad networks with some 15,000 apps seeking advertisers. The Palo Alto, Calif., company collects phone IDs, encodes them (to obscure the number), and assigns them to interest categories based on what apps people download and how much time they spend using an app, among other factors.

By tracking a phone’s location, Mobclix also makes a “best guess” of where a person lives, says Mr. Gurbuxani, the Mobclix executive. Mobclix then matches that location with spending and demographic data from Nielsen Co.

In roughly a quarter-second, Mobclix can place a user in one of 150 “segments” it offers to advertisers, from “green enthusiasts” to “soccer moms.” For example, “die hard gamers” are 15-to-25-year-old males with more than 20 apps on their phones who use an app for more than 20 minutes at a time.

Mobclix says its system is powerful, but that its categories are broad enough to not identify individuals. “It’s about how you track people better,” Mr. Gurbuxani says.

Some app makers have made changes in response to the findings. At least four app makers posted privacy policies after being contacted by the Journal, including Rovio Mobile Ltd., the Finnish company behind the popular game Angry Birds (in which birds battle egg-snatching pigs). A spokesman says Rovio had been working on the policy, and the Journal inquiry made it a good time to unveil it.

Free and paid versions of Angry Birds were tested on an iPhone. The apps sent the phone’s UDID and location to the Chillingo unit of Electronic Arts Inc., which markets the games. Chillingo says it doesn’t use the information for advertising and doesn’t share it with outsiders.

Apps have been around for years, but burst into prominence when Apple opened its App Store in July 2008. Today, the App Store boasts more than 300,000 programs.

Other phone makers, including BlackBerry maker Research in Motion Ltd. and Nokia Corp., quickly built their own app stores. Google’s Android Market, which opened later in 2008, has more than 100,000 apps. Market researcher Gartner Inc. estimates that world-wide app sales this year will total $6.7 billion.

Many developers offer apps for free, hoping to profit by selling ads inside the app. Noah Elkin of market researcher eMarketer says some people “are willing to tolerate advertising in apps to get something for free.” Of the 101 apps tested, the paid apps generally sent less data to outsiders.

Ad sales on phones account for less than 5% of the $23 billion in annual Internet advertising. But spending on mobile ads is growing faster than the market overall.

Central to this growth: the ad networks whose business is connecting advertisers with apps. Many ad networks offer software “kits” that automatically insert ads into an app. The kits also track where users spend time inside the app.

Some developers feel pressure to release more data about people. Max Binshtok, creator of the DailyHoroscope Android app, says ad-network executives encouraged him to transmit users’ locations.

Mr. Binshtok says he declined because of privacy concerns. But ads targeted by location bring in two to five times as much money as untargeted ads, Mr. Binshtok says. “We are losing a lot of revenue.”

Other apps transmitted more data. The Android app for social-network site MySpace sent age and gender, along with a device ID, to Millennial Media, a big ad network.

In its software-kit instructions, Millennial Media lists 11 types of information about people that developers may transmit to “help Millennial provide more relevant ads.” They include age, gender, income, ethnicity, sexual orientation and political views. In a re-test with a more complete profile, MySpace also sent a user’s income, ethnicity and parental status.

A spokesman says MySpace discloses in its privacy policy that it will share details from user profiles to help advertisers provide “more relevant ads.” My Space is a unit of News Corp., which publishes the Journal. Millennial did not respond to requests for comment on its software kit.

App makers transmitting data say it is anonymous to the outside firms that receive it. “There is no real-life I.D. here,” says Joel Simkhai, CEO of Nearby Buddy Finder LLC, the maker of the Grindr app for gay men. “Because we are not tying [the information] to a name, I don’t see an area of concern.”

Scott Lahman, CEO of TextPlus 4 developer Gogii Inc., says his company “is dedicated to the privacy of our users. We do not share personally identifiable information or message content.” A Pandora spokeswoman says, “We use listener data in accordance with our privacy policy,” which discusses the app’s data use, to deliver relevant advertising. When a user registers for the first time, the app asks for email address, gender, birth year and ZIP code.

Google was the biggest data recipient in the tests. Its AdMob, AdSense, Analytics and DoubleClick units collectively heard from 38 of the 101 apps. Google, whose ad units operate on both iPhones and Android phones, says it doesn’t mix data received by these units.

Google’s main mobile-ad network is AdMob, which it bought this year for $750 million. AdMob lets advertisers target phone users by location, type of device and “demographic data,” including gender or age group.

A Google spokesman says AdMob targets ads based on what it knows about the types of people who use an app, phone location, and profile information a user has submitted to the app. “No profile of the user, their device, where they’ve been or what apps they’ve downloaded, is created or stored,” he says.

Apple operates its iAd network only on the iPhone. Eighteen of the 51 iPhone apps sent information to Apple.

Apple targets ads to phone users based largely on what it knows about them through its App Store and iTunes music service. The targeting criteria can include the types of songs, videos and apps a person downloads, according to an Apple ad presentation reviewed by the Journal. The presentation named 103 targeting categories, including: karaoke, Christian/gospel music, anime, business news, health apps, games and horror movies.

People familiar with iAd say Apple doesn’t track what users do inside apps and offers advertisers broad categories of people, not specific individuals.

Apple has signaled that it has ideas for targeting people more closely. In a patent application filed this past May, Apple outlined a system for placing and pricing ads based on a person’s “web history or search history” and “the contents of a media library.” For example, home-improvement advertisers might pay more to reach a person who downloaded do-it-yourself TV shows, the document says.

The patent application also lists another possible way to target people with ads: the contents of a friend’s media library.

How would Apple learn who a cellphone user’s friends are, and what kinds of media they prefer? The patent says Apple could tap “known connections on one or more social-networking websites” or “publicly available information or private databases describing purchasing decisions, brand preferences,” and other data. In September, Apple introduced a social-networking service within iTunes, called Ping, that lets users share music preferences with friends. Apple declined to comment.

Tech companies file patents on blue-sky concepts all the time, and it isn’t clear whether Apple will follow through on these ideas. If it did, it would be an evolution for Chief Executive Steve Jobs, who has spoken out against intrusive tracking. At a tech conference in June, he complained about apps “that want to take a lot of your personal data and suck it up.”

—Tom McGinty and Jennifer Valentino-DeVries contributed to this report.

 

Facebook Admits Major Breach Of Privacy

In Uncategorized on October 21, 2010 at 11:17 am

Oldspeak:”This is beginning to become a regular thing now. No Bueno. Can’t wait for Diaspora to come online. ‘ ”Apps” are pieces of software that let Facebook’s 500 million users play games or share common interests with one another. The Wall Street Journal found that all of the 10 most popular apps on Facebook were transmitting users’ IDs to outside companies.’

From Emily Steele & Geoffrey A. Fowler @ The Wall Street Journal:

Many of the most popular applications, or “apps,” on the social-networking site Facebook Inc. have been transmitting identifying information—in effect, providing access to people’s names and, in some cases, their friends’ names—to dozens of advertising and Internet tracking companies, a Wall Street Journal investigation has found.

The issue affects tens of millions of Facebook app users, including people who set their profiles to Facebook’s strictest privacy settings. The practice breaks Facebook’s rules, and renews questions about its ability to keep identifiable information about its users’ activities secure.

Facebook says it is taking steps to “dramatically limit” the exposure of users’ personal information, after a WSJ investigation showed that personal IDs were being transmitted to third parties via Facebook apps. But how hard is it to fix such a breach – and how concerned should users be about the sharing of these IDs? Julia Angwin joins Digits to discuss.

The problem has ties to the growing field of companies that build detailed databases on people in order to track them online—a practice the Journal has been examining in its What They Know series. It’s unclear how long the breach was in place. On Sunday, a Facebook spokesman said it is taking steps to “dramatically limit” the exposure of users’ personal information.

Many top applications on Facebook have been transmitting identifying information to Internet tracking and ad companies. Emily Steel discusses. Also, Michael Ramsey discusses skepticism about the auto industry’s big bet that battery-powered cars will become big sellers.

“A Facebook user ID may be inadvertently shared by a user’s Internet browser or by an application,” the spokesman said. Knowledge of an ID “does not permit access to anyone’s private information on Facebook,” he said, adding that the company would introduce new technology to contain the problem identified by the Journal.

“Our technical systems have always been complemented by strong policy enforcement, and we will continue to rely on both to keep people in control of their information,” the Facebook official said.

“Apps” are pieces of software that let Facebook’s 500 million users play games or share common interests with one another. The Journal found that all of the 10 most popular apps on Facebook were transmitting users’ IDs to outside companies.

The apps, ranked by research company Inside Network Inc. (based on monthly users), include Zynga Game Network Inc.’s FarmVille, with 59 million users, and Texas HoldEm Poker and FrontierVille. Three of the top 10 apps, including FarmVille, also have been transmitting personal information about a user’s friends to outside companies.

Most apps aren’t made by Facebook, but by independent software developers. Several apps became unavailable to Facebook users after the Journal informed Facebook that the apps were transmitting personal information; the specific reason for their unavailability remains unclear.

The information being transmitted is one of Facebook’s basic building blocks: the unique “Facebook ID” number assigned to every user on the site. Since a Facebook user ID is a public part of any Facebook profile, anyone can use an ID number to look up a person’s name, using a standard Web browser, even if that person has set all of his or her Facebook information to be private. For other users, the Facebook ID reveals information they have set to share with “everyone,” including age, residence, occupation and photos.

The apps reviewed by the Journal were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of Internet users by tracking their online activities.

Defenders of online tracking argue that this kind of surveillance is benign because it is conducted anonymously. In this case, however, the Journal found that one data-gathering firm, RapLeaf Inc., had linked Facebook user ID information obtained from apps to its own database of Internet users, which it sells. RapLeaf also transmitted the Facebook IDs it obtained to a dozen other firms, the Journal found.

Name Games

All 10 of the top Facebook apps transmitted users’ IDs, The Journal found

RapLeaf said that transmission was unintentional. “We didn’t do it on purpose,” said Joel Jewitt, vice president of business development for RapLeaf.

Facebook said it previously has “taken steps … to significantly limit Rapleaf’s ability to use any Facebook-related data.”

Facebook prohibits app makers from transferring data about users to outside advertising and data companies, even if a user agrees. The Journal’s findings shed light on the challenge of policing those rules for the 550,000 apps on its site.

The Journal’s findings are the latest challenge for Facebook, which has been criticized in recent years for modifying its privacy rules to expose more of a user’s information. This past spring, the Journal found that Facebook was transmitting the ID numbers to advertising companies, under some circumstances, when a user clicked on an ad. Facebook subsequently discontinued the practice.

“This is an even more complicated technical challenge than a similar issue we successfully addressed last spring on Facebook.com,” a Facebook spokesman said, “but one that we are committed to addressing.”

The privacy issue follows Facebook’s effort just this month to give its users more control over its apps, which privacy activists had cited as a potential hole in users’ ability to control who sees their information. On Oct. 6, Facebook created a control panel that lets users see which apps are accessing which categories of information about them. It indicates, for example, when an application accesses a user’s “basic information” (including a user ID and name). However, it doesn’t detail what information friends’ applications have accessed about a user.

Video From ‘What They Know’ Series

It’s rarely a coincidence when you see Web ads for products that match your interests. WSJ’s Christina Tsuei explains how advertisers use cookies to track your online habits.

A new report in the Wall Street Journal’s “What They Know” series illustrates how companies like Microsoft must balance conflicting interests: helping people surf the Web with its browser to keep their mouse clicks private, and helping advertisers who want to see those clicks. WSJ’s Julia Angwin, Nick Wingfield, and Jessica Vascellaro join host Simon Constable as panelists on this special Digits live show.

Facebook apps transform Facebook into a hub for all kinds of activity, from playing games to setting up a family tree. Apps are considered an important way for Facebook to extend the usefulness of its network. The company says 70% of users use apps each month.

Applications are also a growing source of revenue beyond advertising for Facebook itself, which sells its own virtual currency that can be used to pay for games.

Following an investigation by the Canadian Privacy Commissioner, Facebook in June limited applications to accessing only the public parts of a user’s profile, unless the user grants additional permission. (Canadian officials later expressed satisfaction with Facebook’s steps.) Previously, applications could tap any data the user had access to, including detailed profiles and information about a user’s friends.

It’s not clear if developers of many of the apps transmitting Facebook ID numbers even knew that their apps were doing so. The apps were using a common Web standard, known as a “referer,” which passes on the address of the last page viewed when a user clicks on a link. On Facebook and other social-networking sites, referers can expose a user’s identity.

The company says it has disabled thousands of applications at times for violating its policies. It’s unclear how many, if any, of those cases involved passing user information to marketing companies.

Facebook also appeared to have shut down some applications the Journal found to be transmitting user IDs, including several created by LOLapps Media Inc., a San Francisco company backed with $4 million in venture capital. LOLapp’s applications include Gift Creator, with 3.5 million monthly active users, Quiz Creator, with 1.4 million monthly active users, Colorful Butterflies and Best Friends Gifts.

Since Friday, users attempting to access those applications received either an error message or were reverted to Facebook’s home screen.

“We have taken immediate action to disable all applications that violate our terms,” a Facebook spokesman said.

Data From ‘What They Know’

[wtkkids2]

The Wall Street Journal analyzed the tracking files installed on people’s computers by the 50 most popular websites, plus WSJ.com. Explore the data here and see separate analysis of the files on popular children’s sites.

A spokeswoman for LOLapps Media declined to comment.

The applications transmitting Facebook IDs may have breached their own privacy policies, as well as industry standards, which say sites shouldn’t share and advertisers shouldn’t collect personally identifiable information without users’ permission. Zynga, for example, says in its privacy policy that it “does not provide any Personally Identifiable Information to third-party advertising companies.”

A Zynga spokeswoman said, “Zynga has a strict policy of not passing personally identifiable information to any third parties. We look forward to working with Facebook to refine how web technologies work to keep people in control of their information.”

The most expansive use of Facebook user information uncovered by the Journal involved RapLeaf. The San Francisco company compiles and sells profiles of individuals based in part on their online activities.

The Journal found that some LOLapps applications, as well as the Family Tree application, were transmitting users’ Facebook ID numbers to RapLeaf. RapLeaf then linked those ID numbers to dossiers it had previously assembled on those individuals, according to RapLeaf. RapLeaf then embedded that information in an Internet-tracking file known as a “cookie.”

RapLeaf says it strips out the user’s name when it embeds the information in the cookie and shares that information for ad targeting. However, The Wall Street Journal found that RapLeaf transmitted Facebook user IDs to a dozen other advertising and data firms, including Google Inc.’s Invite Media.

All 12 companies said that they didn’t collect, store or use the information.

Ilya Nikolayev, chief executive of Familybuilder, maker of the Family Tree application, said in an email, “It is Familybuilder’s corporate policy to keep any actual, potential, current or prior business partnerships, relationships, customer details, and any similar information confidential. As this story relates to a company other than Familybuilder, we have nothing further to contribute.”

Write to Emily Steel at emily.steel@wsj.com and Geoffrey A. Fowler at geoffrey.fowler@wsj.com


Wiretapped Phones, Now Internet? Obama Wants To Wiretap Internet Communications.

In Uncategorized on September 28, 2010 at 8:46 am

Oldspeak: Big Brother is a nosey fucker ain’t he? He wanna know ALL YA BUSINESS. :-|  Americans are unwittingly being relieved of more and more of their civil liberties and rights to privacy in the name of national security. ‘In the wake of the Sept. 11 terrorist attacks, Congress passed a succession of laws that has made it far easier for law enforcement and security officials to spy on online and other communications with or without warrants…Now they want the additional benefit of the internet being wiretap-friendly”

From Troy Wolverton @ The San Hose Mercury News:

Privacy advocates on Monday sharply criticized a U.S. government plan to make it easier for police and spy agencies to eavesdrop on Internet communications.

National security and U.S. law enforcement officials are preparing to submit a bill to Congress that would require all Internet companies to be able to tap into any online communications that they enable, The New York Times reported Monday. While government officials quoted by the Times said the legislation is needed because much communication among criminals and terrorists has moved online, privacy advocates called the proposal dangerous and excessive.

Google, Facebook, Skype and other local Internet companies contacted by the Mercury News declined to comment on the proposal. But Jeff Chester, executive director of the Center for Digital Democracy, a group that promotes the rights and interests of online consumers, said it “would give away the digital keys to our consumer data kingdom.”

“This is too much to give away to any government, Republican or Democrat,” he said. “This proposal should be fought by civil libertarians, consumers and business leaders.”

The bill, which hasn’t yet been released, would require companies that provide encrypted communications to be able to break into those coded signals upon receiving a legal wiretapping order, according to the Times. It would also require companies that provide peer-to-peer software, such as Skype, to be able to spy on phone calls and instant messages made over that software, which probably would require fundamental changes in the way those applications work.

Government officials quoted by the Times argued that the proposal would merely preserve their current powers, rather than grant new ones. Law enforcement officials have long had the ability to record or listen in on traditional phone calls.

But increasingly, telephone calls and other communications are encrypted or made outside the traditional phone networks using technologies such as Voice over Internet Protocol and peer-to-peer networking. Because peer-to-peer phone calls don’t pass through a central server or communications hub, they aren’t easy to tap midstream. And encryption can be difficult to break if officials don’t have a digital key to unlock it.

The Obama administration’s concerns are similar to those raised recently by India and Dubai, which have threatened to block Research In Motion’s BlackBerry service if not given access to the encrypted messages sent through RIM’s servers.

But privacy advocates challenged the claim that U.S. officials are losing their policing abilities. In the wake of the Sept. 11 terrorist attacks, Congress passed a succession of laws that has made it far easier for law enforcement and security officials to spy on online and other communications with or without warrants, noted Marc Rotenberg, president of the Electronic Privacy Information Center, an online civil liberties group. The government has also amassed massive databases of electronic information that it can use in investigations, he said.

“This view that law enforcement is being left in the dark by technology is a myth,” Rotenberg said. Government officials have a “lot of ways” to investigate crimes and terrorist threats.

“Now they want the additional benefit of the network being wiretap-friendly,” he added. “We’re saying that simply goes too far.”

Encryption and peer-to-peer networking have become widely used on the Internet for everyday communications, advocates say. Online purchases, financial transactions and even e-mail messages are routinely encrypted these days. And some new laws setting privacy standards have encouraged the wide use of encryption for storing and transmitting health information and other electronic or online records.

“For (government officials) at this point to try and set back the clock would be a mistake,” said Phil Zimmerman, who created the popular encryption program PGP and who helped spearhead the successful fight against a similar law enforcement effort in the 1990s. “We would all oppose it and we would probably prevail.”

Zimmerman and other advocates argue that providing a “back door” into online communications to allow government officials to spy on them would make those communications fundamentally insecure, providing a point of vulnerability that hackers could exploit. In Greece in 2005, hackers used just such a back door to eavesdrop on phone calls made by the prime minister and other officials.

“This is a bad idea,” Rotenberg said. “Not just bad in the sense that it opens the door to Big Brother surveillance, but it “… puts Internet users and companies at greater risk of identity theft, corporate espionage and surreptitious spying.”

How Facebook Betrayed Users And Undermined Online Privacy

In Uncategorized on August 10, 2010 at 11:59 am

Oldspeak:“Facebook has collected loads of private information about their users — far more than ever before.  That information, and aggregated versions of it, can and is being sold to marketers one way or another. Once you share your data on a network—even with your friends—you cease to own it. The social networks are scrambling to provide clever “products” and ways for you to input more and more personal information on their servers. In the scale of what they are collecting, the benefit to users who have given up most of their privacy is negligible.”

From Allan Badiner @ Alternet:

In just six years Facebook has crossed the threshold of 500 million users. In the past nine months it has doubled in size and is now the number one most visited Web site in the world, surpassing Google. Facebook’s motto is “Making the world open and connected,” where a lone voice can have a powerful impact, as evidenced this year by one activist’s post on Facebook that sparked a demonstration of 12 million people against the Revolutionary Forces of Columbia (FARC), which had been terrorizing Colombian citizens for years.

But along with its policy of openness and potential for social change, Facebook has repeatedly come under fire for its lax policies toward the privacy of its members.

Behind the Wall

Facebook members have a “wall” where they can post pictures and information (essentially their own web page), chat with each other, and read the latest on everyone in “The Feed.” But behind the wall, users are creating a cumulative data repository of all the relationships in the entire world and the intimate details of everyone’s lives. The databases and algorithms employed at Facebook to store, crunch, and make inferences about you are far greater holders of data than any government agency.

Facebook founder and CEO Mark Zuckerberg has often claimed to be a champion of privacy and promised, “we will never sell your information.” Nevertheless, many users were shocked to discover late last year that their names and profile pictures, along with basic information about them, had been made public. At the heart of the storm is not the complexity of controls on Facebook, although that was an issue. The anger was about Facebook sharing personal information in new ways without prior permission from its users.

Ironically, Facebook has made an international impact it had not intended. German officials launched legal proceedings against Facebook over its policy of saving information about people who aren’t members of the social network but have various details posted on it thanks to their friends on Facebook. Following an investigation by the Canadian Privacy Commissioner, Facebook implemented new privacy policies. In the U.S., members of Congress and the Federal Trade Commission called for more regulation and Zuckerberg was all but forced to agree to more privacy controls. In June, four U.S. senators wrote to Zuckerberg telling him they were concerned about Facebook’s privacy practices.

The Beacon

Fastbook first aroused controversy on its violations of privacy with its use of web beacons. Web beacons are tiny image files that, when combined with small text files called “cookies,” will track your activities on other sites and automatically send information about you, including keystrokes, to the originating Web site. Facebook designed them to broadcast back to users and their friends what actions Facebook members took on participating Web sites. Users were not informed that data on their activities at other sites was flowing back to Facebook, nor were they given the option to block that information from being transmitted.

Lawsuits were filed, and even MoveOn moved into the issue. Facebook announced that it would allow people to opt out of the use of beacons, and Zuckerberg apologized for the controversy. Facebook ultimately settled a class action lawsuit and announced it would completely shut down the beacon program.

Instant Personalization

But the storm was only beginning to build. The controversy rose to a roar in May, centered on unilateral and sudden changes to Facebook policies that severely limited what users could keep private. The Instant Personalization pilot program that Facebook created spins users’ personal interests into public Web sites that are searchable and available for the world to see, and share their data with other Web sites such as Yelp, Microsoft and Pandora.

Facebook not only forced users to opt out rather than opt in if they wanted their information shared, but required users to delete information from their pages if they didn’t want to share it publicly. Adding injury to insult, embarrassing technical glitches came to light that exposed the personal messages of some users.

After considerable clamor, Facebook allowed you to opt out of Instant Personalization. But it isn’t simple and it requires you to delete all of your biographical information containing your general preferences about ideas and products, i.e., all of your “likes.”

Asked why Facebook doesn’t simply make such pilot programs as Instant Personalization usable on an opt-in basis, Zuckerberg dodged the question and said only that doing so would create “a lot more friction.”

Open Graph

At a developer conference, Zuckerberg recently announced the end of Facebook’s policy of not allowing third-party sites to store and cache any data for more than 24 hours. This led to a discussion about what Facebook calls the Open Graph, through which Facebook plans to connect disparate corners of the web with the preferences of its users. “If you mapped out all the connections between people and the things they care about,” says Zuckerberg, “it would form a graph that connects everyone together.” “Yelp will map the part of the graph relating to small businesses, Pandora will take on the music part, and Microsoft will handle document sharing,” Zuckerberg said. And Facebook owns the graph.

All partner sites can use “social plugins” that record the “likes” of users and their friends, and make the data available to advertisers. For example, you can click the Like button on a movie at the Amazon-owned Internet Movie Database, and your preference will be stored on your Facebook profile. The profiles or identities of Facebook users slowly cease to be just what they constructed on Facebook, and are shaped by their behavior elsewhere on the web. Web sites will begin to tailor themselves to individual users.

Not everyone is complaining about the lack of privacy on Facebook. NPR reported that credit collection agencies start their pursuit of debtors with the most promising source of all the information they need: Facebook. They search the Open Graph for keywords or “friend request” until they have access to a subject’s inner circle.

Additionally, 30 percent of employers have rejected applicants because of things they’ve found on Facebook and other social networks, according to David Kirkpatrick.
In fairness, Facebook has done a good job with ads—they are minimal in number and unobtrusive. But these ads are only foot-soldiers for the advertising invasion they have been planning.

Facebook’s True Face

Facebook is both an infomediary and an intermediary. It occupies a pivotal position as the preeminent hub in the new information economy, and it is also the primary custodian of more information than has ever before been collected about human beings. As intermediaries and hosts for our communications with lovers, family members, friends, and colleagues, social network providers have access to extremely sensitive information, including data gathered over time and from many different individuals.

Despite Homeland Security, Google Analytics, and Facebook’s Data Team, people still hold to the ideal that they are free and have choice in their own lives. It is reasonable to expect Facebook to respect this democratic ethic and voluntarily assume a kind of fiduciary duty to its users. This kind of duty has to come before the realization of Facebook’s dreams for reengineering mobile communications and the web to become a more people-centric and integrated community. The Facebook motto, “Making the world open and connected,” may need to be thought through more carefully in terms of how they “make” it happen, and in what ways the citizens of the world want it to be “open” and “connected.”

While Mark Zuckerberg may believe in a concept called “radical transparency,” Peter Eckersley, senior staff technologist at the Electronic Frontier Foundation, has called for Facebook “to stop acting as if they have a mission to make all of our private lives public.”

Electronic Frontier Foundation is also promoting a Bill of Privacy Rights for Social Network Users, including the right to be clearly informed about the options for privacy, what information is being shared to whom, and notified when any legal entity requests information about them. The bill also declares that users retain control over the use and disclosure of their data, and that they should have the right to have all personal data removed from social network servers if they decide to leave the service.

The Future of Facebook

And leaving the service is what a small but growing number of people have in mind. “Quit Facebook Day,” an online protest started by Canadian users, took place a few weeks ago—and there may be more. Over 35,000 Facebook users have pledged to permanently erase their profiles from Facebook’s database. They cannot, however, take their data with them. It was only last year that Canada asked Facebook to cease holding on to personal information from deactivated accounts, which is illegal under Canadian law. The changes that Facebook is making to quell the outcry, inadequate as they may seem, are possibly more a result of pressure from foreign governments than anything else. There has been “unusually strong international pressure from policymakers to force Facebook to change,” says Jeffrey Chester of the Center for Digital Democracy.

Will this upset over privacy slow down the meteoric growth of the company? It is interesting that Facebook gained only 320,000 new U.S. users in June after a blockbuster gain in May of more than 7.8 million. And a new report from the American Customer Satisfaction Index ranks Facebook in the bottom 5 percent of social media sites. In the survey, users complained about privacy concerns, interface changes, navigation problems, and aggressive advertising.

Mark Zuckerberg takes it all with a smile and does not seem overly concerned about the ruckus, or the severity of Facebook’s PR debacle. Zuckerberg and Facebook have been the focus of at least two books and are now the subject of a film, The Social Network, directed by David Fincher and based on technology reporter David Kirkpatrick’s account of the Facebook phenomenon. Zuckerberg says he doesn’t read a lot of the press, books or articles about Facebook and does not plan to see the movie. To the great modern prophet of staying connected, being disconnected sometimes is a good thing.

“Over time,” says Zuckerberg, “people will remember us for what we build and how useful it is to them.” Looking at the low number of actual defectors and the onrush of new users, Zuckerberg’s confidence is not misplaced. But, sooner or later, Facebook will have to learn that disclosure of our most personal information should be on an opt-in rather than opt-out basis. As blogger Chris Messina stresses, your identity is too important to be owned by any one company.

In fact, most users of Facebook are hoping that the company will act wisely and in a fashion that demonstrates a respect for user privacy. The challenge is that Facebook is on a firm trajectory of personalizing the web, which by nature requires information from users. At the same time, advertisers have ceased to be interested in buying space on Web sites—and now want to access user profiles. While not exactly locked in, users have invested Facebook with a great deal of data, and they tend not to want to close their accounts. This fact is not lost on Facebook.

Way Forward

Privacy is on the front burner for a reason: social network providers are eager to have the income from marketers and advertisers that help them sell their products in the most efficient way possible. This means that the data users are so eager to keep private has value. The Faustian bargain people make with social networks—your personal information for a platform to share it on—has been changing. Facebook and other networks are collecting far more information about their users than ever before.

That information, and aggregated versions of it, can and is being sold to marketers one way or another. Once you share your data on a network—even with your friends—you cease to own it. The social networks are scrambling to provide clever “products” and ways for you to input more and more personal information on their servers. In the scale of what they are collecting, the benefit to users who have given up most of their privacy is negligible.

Why should users give Facebook their information, preferences, relationship flow chart, and the ability to infer what it isn’t told directly? Users have almost no control over how information about them is used, or who ends up with the rights to use it in the future. But imagine how much users would share if they were building for themselves an income stream with their data. Imagine if Facebook revolutionized the industry and partnered with users to monetize their personal information, and in so doing the users took a share of it.

Trust is crucial for the sustained success of social networks. It may seem to Zuckerberg that Facebook users are tolerating the erosion of it well and keeping their accounts. But as soon as a viable alternative begins to pick up momentum, a mass exodus could ensue. Facebook could easily and quickly become the new MySpace. First, the early adopters achieve a critical mass at another new networking site. Then, the next wave of the techno savvy looking to bail start to migrate. And a little while later, only mom and dad are left on Facebook wondering where the kids went.

Viable alternatives are already springing up. A new network has been touted in the media that allows users to fully control the information they share by setting up their own personal servers, called “seeds.” Raphael Sofaer, co-founder of Diaspora, says that centralized networks like Facebook are not necessary. “In our real lives, we talk to each other,” he said. “We don’t need to hand our messages to a hub.”

Facebook’s growth curve is so strong that the recent privacy flaps seem not to have affected the numbers, but that can be deceptive. The biggest threat to Facebook is what Augie Ray, senior analyst at Forrester Research, calls “death by a thousand privacy cuts.” Messages about how Facebook has turned on its users and betrayed their trust are flooding the feed, and a new application called PrivacyDefender, a tool that automatically configures your Facebook privacy settings, is doing brisk business. The accumulation of lawmaker concerns, high-profile deleters, organizations raising consumer awareness, and security bugs (such as those found in Yelp) can create growing and important problems for Facebook.

Facebook is working on plans for its one billionth user celebration, projected to take place before the end of 2011. What better way to celebrate than for Facebook to announce a new philosophy for its relationship with its users: one of real partnership and respect. A plan could follow that specified how users will participate financially from the use of their data. Share personal information? No problem. Opt in? No problem. Facebook will be doing things differently, and it will get very different results.

Allan Hunt Badiner is a writer, activist and editor of three books: ‘Dharma Gaia: A Harvest of Essays in Buddhism and Ecology,’ ‘Zig Zag Zen: Buddhism and Psychedelics’ and ‘Mindfulness in the Marketplace: Compassionate Responses to Consumerism.’

Follow

Get every new post delivered to your Inbox.

Join 175 other followers