Saturday, December 31, 2011

Yes, the Feds Are Spying on Social Media

Just in case anyone still harbors illusions on this score, the answer is “Yes, the federal government is definitely spying on social media.” In the latest development, a group of online privacy advocates is suing the Department of Homeland Security for failing to release records of its online spying -- which isn’t terribly surprising, considering that it’s not really spying anymore if everyone knows what you’re doing.

The DHS has admitted in a public statement that it creates profiles to monitor “publicly available online forums, blogs, public websites, and message boards,” including social media sites like Facebook and Twitter, in what is known as the “Publicly Available Social Media Monitoring and Situational Awareness Initiative.” The aim is to “to provide situational awareness” for the federal, state, and local governments; the DHS “may also share this de-identified information with international partners and the private sector where necessary and appropriate for coordination.” Crucially, the DHS statement also reveals that participating agencies may reveal personally identifying information about Internet users in emergency, life-and-death situations.

The list of search and monitoring tools used by the DHS includes Collecta, RSSOwl, Social Mention, Spy, Who’s Talkin, and Shrook RSS Reader, while public content and media sharing sites monitored by DHS include Hulu, iReport.com, Live Leak, Magma, Time Tube, Vimeo, YouTube, and MySpace Video. Twitter alone is monitored through a score of Twitter-specific search engines and trend monitoring services.

The array of search terms used by DHS to keep tabs on social media includes “Secret Service,” “Border Patrol,” “Agent,” “Task Force,” “Air Marshal,” “Assassination,” “Attack,” “Drill,” “Exercise,” “Cops,” “Dirty Bomb,” “Militia,” “Shooting,” “Shots fired,” “Deaths,” “Explosion,” “Gangs,” “Breach,” and “Lockdown,” as well as -- surprise -- the names of agencies like the CIA, the FBI, and of course the DHS itself.

Back in April 2011 an organization called the Electronic Privacy Information Center filed a Freedom of Information Act request for records pertaining to the DHS use of social media monitoring -- a request that EPIC says the DHS has failed to respond to. Thus on December 20 EPIC filed an FOIA lawsuit against DHS for these records, which EPIC director Marc Rotenberg told ABC News will supply more information about when, where, and how social media monitoring is used.

ABC News quotes Rotenberg: “We want to know how they're collecting information online, what they're collecting online and if there's legal basis to do this… We are trying to understand what the circumstances are when the DHS is engaged in tracking to social media sites.”

In an earlier post I wrote about the fact that the DHS is using social networks to ferret out fake "green card" marriages between U.S. citizens and immigrants for the purpose of obtaining residency or citizenship for the latter. According to awesomely frank internal DHS records obtained by the Electronic Frontier Foundation under a Freedom of Information Act request, “Narcissistic tendencies in many people fuels a need to have a large group of ‘friends’ link to their pages and many of these people accept cyber-friends that they don't even know. This provides an excellent vantage point for [the Office of Fraud Detection and National Security] to observe the daily life of beneficiaries and petitioners who are suspected of fraudulent activities.”


Read more: http://www.mediapost.com/publications/article/164961/yes-the-feds-are-spying-on-social-media.html?print#ixzz1i7RR7pE7

Wednesday, November 30, 2011

FTC, Facebook Reach Privacy Settlement

Facebook has agreed to settle a Federal Trade Commission complaint by promising to obtain users' express consent before sharing their information with a wider audience than in the past.

The social networking service also promised to prevent anyone from accessing deleted accounts within 30 days of deletion. Plus, Facebook agreed to institute a comprehensive privacy policy and to submit to audits for 20 years.

The proposed settlement, announced Tuesday, would resolve an FTC complaint alleging that Facebook deceived users by repeatedly sharing information that users believed would be private when uploaded. The FTC's 19-page complaint, unveiled on Tuesday along with the proposed settlement, spells out a variety of ways that Facebook allegedly deceived users.

Among others, in December of 2009 Facebook reclassified a host of data about users as “public” -- including people's names, photos and friend lists. “They didn't warn users that this change was coming, or get their approval in advance,” the FTC said in a statement. That Facebook shift also prompted the Electronic Privacy Information Center and other groups -- including the American Library Association, Center for Digital Democracy and Consumer Federation of America -- to file a complaint against the company.

The FTC also said that Facebook broke promises to users by allowing app developers to access profile information they didn't need. “A platform application with a narrow purpose, such as a quiz regarding a television show, in many instances could access a user’s relationship status, as well as the URL for every photo and video that the user had uploaded to Facebook’s Web site, despite the lack of relevance of this information to the application,” the FTC said in its complaint.

The authorities also alleged that Facebook shared some users' names with advertisers via referrer headers. (Facebook recently prevailed in a lawsuit stemming from that same issue. A judge in that case ruled that the users weren't harmed by any disclosures and, therefore, couldn't pursue their claim in court.)

Facebook CEO Mark Zuckerberg said in a blog post that the company had made “a bunch of mistakes.” He added: “I think that a small number of high-profile mistakes, like Beacon four years ago and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we've done.”

Zuckerberg also noted that Facebook had already fixed some of the issues noted by the FTC.

In the last two years, Facebook revised its privacy controls to give users more say over who can access their data. But the social networking service hadn't promised prior to Tuesday to seek users' opt-in consent to future privacy-related changes.

Sen. John Kerry (D-Mass.), who introduced an online privacy bill earlier this year, praised the deal.

“This settlement will help ensure that companies keep their promises to consumers and give those consumers a real voice in how their information is used, distributed, and managed,” Kerry stated. “These priorities are consistent with what Senator McCain and I had in mind when we introduced our Internet Privacy Bill of Rights.”

The terms of the Facebook settlement, which were first rumored earlier this month, are in line with the FTC's settlement with Google over its launch of Buzz. That deal requires Google to create a comprehensive privacy program and submit to independent privacy audits for the next 20 years. Google also promised that it will obtain people's express consent before sharing their information more broadly than its privacy policy allowed at the time of collection.

Buzz created social networks out of people's Gmail contacts. At launch, the service revealed information about the names of users' email contacts, if users activated Buzz without changing the defaults. That design meant that a host of confidential information could inadvertently become known, including the names of Gmail users' doctors, lawyers or coworkers.

The FTC will accept comment on the proposed Facebook settlement until Dec. 30.

by Wendy Davis

Wednesday, November 9, 2011

FTC Accuses Video Ad Network Of Using Flash Cookies For Tracking

In a first, the Federal Trade Commission has charged an ad network with engaging in a deceptive business practice by allegedly using Flash cookies to track Web users.

The regulators' complaint, unveiled on Tuesday, alleges that video ad network ScanScout violated its privacy policy by using Flash cookies from 2007 to 2009 in order to track users' online activity to serve them targeted ads.

Flash cookies were originally designed to remember users' preferences for online video players and other applications, but some companies use such cookies to store the same type of information that is normally found on HTTP cookies. Flash cookies are stored in a different place in people's browsers than HTTP cookies and, until recently, couldn't be deleted or blocked through browser controls.

ScanScout, which was acquired last year by Tremor Media, allegedly said in its privacy policy that users could opt out of receiving cookies by changing their browser settings. That statement was deceptive, the FTC says in the complaint.

“ScanScout represented, expressly or by implication, that consumers could prevent ScanScout from collecting data about their online activities by changing their browser settings to prevent the receipt of cookies,” the FTC alleges. “Consumers could not prevent ScanScout from collecting data about their online activities by changing their browser settings to prevent the receipt of cookies. Therefore, the representation ... was false or misleading.”

The case comes almost two years after consumer protection head David Vladeck expressed concern that companies were thwarting users' privacy settings with Flash cookies. Since then, several other companies have been accused of tracking people with Flash cookies and three companies -- Quantcast, Clearspring and Say Media's VideoEgg -- agreed to pay a total of $3.4 million to settle civil lawsuits.

The FTC hasn't publicly accused any companies other than ScanScout of using Flash cookies deceptively.

The same day that the FTC announced the complaint, it also announced that Tremor had agreed to settle the charges by promising to notify Web users about tracking and allow them to opt out. The company specifically said it will allow users to opt out of the collection of most data containing unique identifiers, including an IP addresses. The proposed settlement allows Tremor to continue collecting data from opted-out users for some purposes, including frequency capping, fraud prevention and age verification.

Tremor said two months ago that it planned to roll out the you-are-being-targeted icons developed by the umbrella group Digital Advertising Alliance on video ads. The company isn't admitting wrongdoing as part of the proposed settlement.

Tremor also is facing a lawsuit in federal court in Boston by consumers over ScanScout's alleged use of Flash cookies. Defendants in that case include AOL and Brightcove. All recently filed court papers asking for the matter to be dismissed. ScanScout said in its court papers in that matter that it “never used Flash or any other technology to respawn deleted cookies.”

by Wendy Davis

Monday, October 31, 2011

Google Introduces New Encryption Process for Organic Search Queries: Results May Vary

Google announced that starting October 18, 2011 a new privacy protection process for organic search analytics. Organic search queries executed by those consumers logged into Google products will no longer be available to web analytics systems (including Google Analytics, Adobe SiteCatalyst, WebTrends, Coremetrics, etc.) or other Google products (Keyword Tool, Trends, etc.). Note: this does NOT impact paid search analytics, even if a searcher is logged in to a Google property. Google’s view is that advertisers pay for this information in order to optimize their programs. Google will continue to provide total search volume on the platform, and it will continue to serve query level data for those organic search queries executed on the system that are from consumers not-logged into its web products. The purpose of this note is to discuss why they are doing this, and what search marketers should expect and do.

Why is Google implementing this? The answer is simple. Privacy. Searchers logged into Google through any of its products (Gmail, Google+, YouTube) receive search results that are customized to their search history—they are personalized. Even though the data that is passed on to web analytics products is, in most cases, impossible to reconcile to an individual searcher – this is a proactive move by Google to reduce privacy concerns (both in the US as well as the EU) by saying “no search queries that have been personalized will be available to any third party.”

What is the impact of this on search marketers? Google reported that less than 10% of search queries that are executed are done by consumers logged into Google products. We have no reason to dispute this statistic, so we recommend that advertisers assume that 5 – 10% of search queries are from personalized results. So any keyword level organic analysis reporting that advertisers use from their web analytics systems will start to show 5 – 10% lower referral volumes starting immediately. We do believe that this percentage will continue to increase over time, so this statistic will require on-going adjustments as additional benchmark statistics on personalization use come available. On a technical level, the process by which Google reports referential data is still unclear. For example, in Organic Search Insight™, we get data that is unique to the data, search engine, entry URL and search query. Google is saying they will continue to provide all of this data except the search query. We are in the process of testing how this is formatted through analysis of weblogs for our own site and will report on results when they come available.

It is our understanding that this encryption process is being rolled out globally. To understand the impact, we recommend that our customers do a benchmark for their top 25 organic search queries by analyzing daily variations over a 2 – 3 week period within each geography, as personalization percentages will be different by country. The purpose should be to see if there is a substantial fall off in daily keyword level referential volume—on Google only—for a particular geography. If the results for the post effective data (October 18, 2011) query volume are lower, this should be determined using 25 days prior and post the change date and this can be used as the best proxy for how to adjust query level volumes upward.

This will impact the ability of systems to look at paid and organic synergy as these types of analytics require query level granularity to see how individual searches interact between the paid and organic listing. Search advertisers may get more traffic from organic search than is reported. They may erroneously conclude that they need to purchase additional PPC volume for particular keywords when in fact their shortfalls on organic are the results of this encryption process. No changes should be made to process until the benchmarking process above is completed – again, by geography.

by Jeff MacGurn

Friday, July 8, 2011

How The White House Blogged Nothing About The New Piracy Agreement

The White House decided a new voluntary agreement between ISPs and Hollywood on internet privacy was important enough to blog about. Unfortunately, the blog post pretty much said nothing. Since I already wasted time reading that White House post, I decided I should waste more time deconstructing what a waste of time it was.

The Administration is committed to reducing infringement of American intellectual property as part of our ongoing commitment to support jobs, increase exports and maintain our global competitiveness.

Well, I assume you’re committed to reducing anything that’s against the law, right? I mean, that’s why we have laws. But if you want to give me the this is all about jobs spiel, I suppose an election year is coming up.
The joining of Internet service providers and entertainment companies…

I’m sorry. Was there a merger of some sort? Is the FTC involved? Don’t some of the entertainment companies already own ISPs? But go on, I’m sure you’ll explain more.

…in a cooperative effort to combat online infringement can further this goal and we commend them for reaching this agreement. We believe it will have a significant impact on reducing online piracy.

Say what? What effort? What are they doing? Got a link or anything about this? Sounds pretty important. If I wanted to understand more about it, um, you want to point me to anything in particular?

We believe that this agreement is a positive step and consistent with our strategy of encouraging voluntary efforts to strengthen online intellectual property enforcement and with our broader Internet policy principles, emphasizing privacy, free speech, competition and due process.

Again, what agreement? You’re telling me this is all wonderful, but you can’t explain what’s going on? I mean, I know it’s all voluntary or whatever, and you’ve got nothing apparently to do with it other than saying you support it. But if you are so supportive of it to do a blog post, maybe you could explain it?

As such, we will follow the implementation and outcomes of this arrangement with great interest. Our expectation is that the new organization created by it will have ongoing consultations with privacy and freedom of expression advocacy groups to assure that its practices are fully consistent with the democratic values that have helped the Internet to flourish.

There’s a new organization? What’s it called? Does it have a web site? A Twitter account? Throw me a bone here. Maybe tell me some of the organizations behind it?

Simultaneously, the Administration will continue to pursue comprehensive solutions to the problems associated with Internet piracy, including increased law enforcement and educational awareness. To win the future and succeed in the global economy, it is critical to protect the intellectual property of America’s innovators and creators.
Really, that’s it? You called me over to the blog to tell me basically nothing? Thanks. I ended up having to head over to Techmeme, to read what journalists were writing about this new rosy future. Thank goodness they were around, because you told me zilch.

Next time, if you have nothing to say, then say nothing.
Oh, special request. If you’re all for helping Hollywood fight piracy, how about helping those consumers who actually do buy thing legitimately. For one, I never, ever, ever want a DVD to force me to sit through 5 minutes of previews. Can we have a law that if I push Menu, I immediately get the Menu button?

And that FBI warning? Enough. Let them put it on the box. I don’t need to see that logo over and over again. What other industry gets to shove those kind of warnings down the throats of consumers over and over again, outside of maybe the airline industry. And it’s not like we’re getting safety instructions, or anything.

By Danny Sullivan

Monday, January 24, 2011

Ad Groups Granted Extension To Comment On Do-Not-Track

At the request of a coalition of industry groups, the Federal Trade Commission has extended the deadline for comments to its privacy report until Feb. 18. The original deadline was Jan. 31.

Stuart Ingis, counsel to the umbrella organization Digital Advertising Alliance, asked for an extension in a letter to the FTC sent late last year. He said that business associations needed more time to evaluate the FTC's report -- which called on Web companies to create a universal mechanism for consumers to opt out of online tracking -- as well as a separate report about privacy issued by the Department of Commerce.

"Additional time will allow business to evaluate the potential impact on the proposals to important business operations and critical services to consumers," he wrote. "By allowing members to fully digest the two proposals and provide thoughtful input in the form of additional comments, we believe we can provide the Commission with more meaningful input from a broad spectrum of affected industries."

The American Association of Advertising Agencies, American Advertising Federation, Association of National Advertisers, Direct Marketing Association, Newspaper Association and U.S. Chamber of Commerce were among the groups that requested extra time. They had asked for an extension until March 15.

In a separate letter, the Securities Industry and Financial Markets also asked for a 30-day extension. That organization said the FTC's report "may impact the financial services industry to a significant extent."

In its privacy report, the FTC sought comment on a host of issues, including whether it should recommend legislation requiring do-not-track if the industry doesn't voluntarily implement "an effective uniform choice mechanism."

The separate Commerce Department report called for business groups and consumer advocates to work together to develop self-regulatory privacy policies based on Fair Information Practices principles. That report also called for comments about whether new laws are needed. The deadline for those responses is Jan. 28.

The Senate is expected to conduct a hearing next month about online privacy.

To date, the FTC has received more than 200 comments on its report, primarily from individuals, but also from at least one business organization -- the Management Association for Private Photogrammetric Surveyors, made up of private firms engaged in remote sensing, spatial data and geographic information systems.

That group takes issue with a section of the report calling for companies to seek consumers' affirmative consent before collecting "precise geolocation data" -- included in the FTC's proposed definition of sensitive information. MAPPS says this restriction could "hamper the ability of firms, agencies and organizations to collect, use, share, or apply geospatial data."

The organization is asking the FTC to either exempt geolocation data from the prior-consent requirement or define the term more precisely. "It would be impractical, if not impossible, for our member firms to obtain prior approval or consent from individual citizens prior to acquiring or applying data such as satellite imagery, aerial photography, or parcel, address, or transportation data," the group writes.

By Wendy Davis

Friday, January 21, 2011

Verizon: FCC Neutrality Regulations An 'Abuse'

Following through on its threat to challenge net neutrality rules in court, Verizon on Thursday filed suit against the Federal Communications Commission. In court papers filed with the U.S. Circuit Court of Appeals for the D.C. Circuit, Verizon alleges that the FCC exceeded its authority by voting to promulgate open Internet rules. The telecom giant also argues that the new rules are "arbitrary, capricious, and an abuse of discretion."

The FCC's controversial open Internet rules prohibit wireline providers from blocking or degrading traffic or otherwise engaging in unreasonable discrimination. The order also prohibits wireless providers from blocking sites or competing applications, but doesn't prohibit wireless carriers from creating fast lanes for companies that pay extra.

The rules -- which the FCC approved by a 3-2 vote in December -- drew criticism from many observers, ranging from consumer advocates, who say the rules don't go far enough to telecoms, who say that regulation will discourage investment and innovation. Verizon immediately vowed to challenge the rules in court.

The telecom giant isn't alone in trying to ax the new rules. The Republican leadership of the House Energy and Commerce Committee also aims to vacate them. An Energy and Commerce Committee memo circulated this week lists nullifying net neutrailty as among this year's priorities. Congress has the power to vacate the FCC's rules, but only if a majority of the House and Senate vote to do so within 60 days of the regulations' official publication. The FCC has not yet published its order in the Federal Register, but is expected to do so soon.

The committee, now under the leadership of Fred Upton (R-Mich.), also intends to hold hearings "on the harm regulation of the Internet will cause to investment, innovation and jobs, as well as the FCC's abuse of authority and process," according to the memo.

Some lawmakers also are gearing up to legislate against neutrality laws. Earlier this month, Marsha Blackburn (R-Tenn.) introduced a bill that would strip the FCC of authority to regulate the Internet. Her measure -- which has garnered support from 60 other Congress members -- would ban the FCC from issuing "any regulations regarding the Internet or IP-enabled services."

By Wendy Davis