At this point it should come as no surprise to anyone that regardless of what Facebook says about security and privacy, you can almost guarantee they will be caught in a lie, or at the very least, avoiding the truth. The latest boondoggle comes courtesy of a Freedom of Information Act finding made by an organization called Property of the People, a non-profit transparency group who has shared a document from the Federal Bureau of Investigation that details “Lawful Access” to your supposedly private and secure messaging on Facebook’s WhatsApp and Apple’s iMessage platforms, as well as several others.
What this means to you
In a nutshell, the document does indicate that in all cases, Facebook and Apple are true to their word that your conversations – as they happen – are encrypted, and the FBI cannot read them. What’s telling is what Apple and Facebook omitted in all of their marketing and soapboxing about privacy and security. According to the FBI document, which appears to be designed more as an executive summary, WhatsApp seems to be designed to give near real-time access to everything but the content of the user’s messages if they are served with a search warrant. Though not nearly as transparent in real time as WhatsApp, Apple’s iMessage will provide metadata surrounding a targeted user’s messages for up to 25 days.
The real cherry-on-top of this privacy-nightmare sundae is actually Apple’s to own: If the targeted user happens to be backing up their messages (both iMessage and WhatsApp apparently) to iCloud, a search warrant can also return the encryption keys to that supposed secure backup, which will allow authorities to decrypt and reveal the actual contents of the messages.
Of course, if you aren’t doing anything wrong, you should have nothing to worry about if the Feds are reading your messages, right? Let me point you to an article written in 2013 and published by the ACLU:
On top of the privacy issues this latest surprise reveals, I also want to make sure you note my other point: regardless of how much Apple and Facebook preach from their bully pulpits about protecting your privacy, it should be painfully clear this is more marketing ploy than protection of your rights. If a company is for profit, they are not looking out for you, they are looking out for their shareholders whose top priority is staying in business and cooperating with the authorities to make sure those dollars don’t stop. In the end it’s your choice whether you use these platforms, but don’t fool yourself into thinking you are choosing a “secure” platform that “protects your privacy.” At best, Facebook and Apple are being disingenuous about their privacy stances while behind the scenes they are laying the foundations for an Orwellian Nightmare.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Today’s smartphones are incredibly powerful. If you are savvy enough, and determined, you could probably do a good portion of your office job and manage most, if not all of your personal life just via a late model smartphone. Even someone like me can do a significant amount of work via smartphone. The tools are there, and the screen is just big enough to make it possible with some squinting and finger cramping, but I only do it in an emergency when I don’t have access to better tools or platforms. For most of you, email, video conferencing and phone conversations cover a large chunk of your professional life, and when you add in the social media apps, you’ve got the bases covered. But should you be using your smartphone for anything other than for what it was originally designed?
Should you be getting off my lawn?
I’ll admit it, I’ve definitely become much more conservative *gasp* when it comes to considering where technology intersects with our personal lives, especially as it pertains to privacy. Back when I had a full head of hair and maybe less brains, I fell firmly into the “what do you have to hide” category of privacy, but that was before our data was essentially and mercilessly monetized with zero regard for the consequences. And after it was purposefully gathered, categorized and analyzed, it was carelessly and unapologetically leaked repeatedly, where it could again be gathered, exploited and manipulated by folks with even less care for ethics or humanity in general. While most of us haven’t been significantly damaged individually by this in any way we can quantify, the merciless monetization of our data has definitely been to the detriment of society in general. While it might feel usefully prescient that Amazon seems to know exactly what you need when you visit their website, I’m betting you start feeling a little unsettled when every other website you visit thereafter also seems to know what you’re shopping for, like you just stepped into the Twilight Zone, or Black Mirror, for the younger generations. Whether you like it or not, the breakthrough in data gathering was courtesy of rise of the smartphone and its cornucopia of useful apps. For every function of your professional and personal life that you pursue with your cellphone, the carriers and app makers and their data-hungry customers gather oodles of telemetry about you – where you shop, what social and political beliefs you peruse and pursue, what kind of foods you like, what games you play, on and on. People view smartphones as a window to the world, but don’t forget that windows work both ways, and you are providing stark, unexpurgated view of your life to folks who only see you as a profit center.
Full disclosure: On top of email, texting and phone calls, I do no small amount of social media lurking (though not posting), GPS navigation, music listening and a little shopping here and there on my smartphone. I’ve made my peace (for now) with the Faustian deal I make in trade for services I (and my clients) find incredibly useful, and to be extremely clear, even I don’t know to what extent my data has been harvested, exploited and monetized, but I like to think I’m going into it as clear-eyed as one can be in this day and age. Should we be considering this a reasonable tradeoff? Would you be willing to pay for services you use for free right if it meant you had more control over your data? Do you even care? Even I don’t know how to answer these questions right now.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
For the dwindling few of my clients who had any energy left to be outraged at something, a recent article from Forbes highlighting Google’s rather blatant disregard for user privacy energized at least a handful of them to delete the Gmail app from their iPhones. For the rest of you who haven’t encountered this story yet, it’s actually not something new that has occurred, but rather something that has been going on for awhile now, that is only coming to light in an understandable way thanks to Apple’s new privacy policy and its ongoing battle with Facebook. Up until now, Google has been letting Facebook take the brunt of the media attention on this issue, but it was only a matter of time before their equally egregious data harvesting practices came to light.
What this means for you
Let me be 100% transparent with you. I send out an email newsletter weekly via a platform called Mailchimp, and I’m using their “Free” tier of service in exchange for allowing them to use a portion of my email to advertise their service. I’m also quite certain they are gathering metadata from every email I send out, aggregating this data across all their other clients (paid or not!) and then reselling that information to various advertisers and market research firms. As we’ve been repeatedly told even well before the birth of the internet, there’s no such thing as a free lunch. Google’s Gmail service, for something that is free, is actually one of the best email platforms in existence, but, as you should already know, comes at a price.
If there is something I’ve gleaned from working with people and technology for over 30 years now, it’s that we all have a calculus we perform internally that measures convenience and cost against privacy and security. For some of us, that teeter-totter tips heavily on the privacy and security side, and for others much less so, especially if the convenience means that we are able to invest effort into other things that matter more. Regardless of how your inner-seesaw is tilted, privacy and security are not balanced or elevated without significant effort, and more is being required everyday. The longer companies like Google, Facebook, and yes, even Apple sit on one end of the teeter-totter gorging themselves on your data, the harder they will be to lift or even dislodge so that you can properly enjoy the ride with someone who doesn’t always tip the scales in their favor.
Don’t expect any company, especially a for-profit one, to stand up for your privacy regardless of what they tweet or tout in their advertisements, and the same can be said for many politicians who plainly have their pockets lined by big corporations. Whether we want to admit it or not, many of us are using services that may or may not be worth the privacy we give in exchange. Your privacy is valuable, so don’t give it up so easily. You’ll definitely miss it when it’s gone.
Reports are now popping up in my technology news feed that a database containing information from over 700 million LinkedIn members is now available for purchase on the dark web. Unlike some of the other information dumps that have made headlines recently, this one doesn’t contain passwords or other sensitive information, but it does contain the information that LinkedIn members typical put in their profiles, including phone numbers, addresses (mail and email), job and education history as well as whether or not a particular member might be looking for a job. According to LinkedIn and which other sources seem to corroborate, this isn’t actually a data breach, but what is known as an “information scrape” which is shorthand for a database built by reading and indexing information that is readily available on the web. Keep in mind, “readily available” does not necessarily mean authorized use, especially when it is gathered and put on sale by someone not LinkedIn.
What does this mean for you?
Even if you aren’t on LinkedIn, if you do any sort of business that requires to you interact with others via the internet, you should be aware of why these types of databases are still considered a significant security risk, and I can sum it up in one word: Phishing. One of the most common tactics in use now by phishers is leveraging data gathered in these databases to build and send fake emails that contain enough real information to trick even the most savvy email veteran. Especially vulnerable are the millions of job seekers who use LinkedIn everyday to contact plenty of people they don’t know directly, and have to rely on information found on the website. Cybercriminals are using this particular weakness to infect job seekers with trojans as part of a fake employment application, which can then lead to identity theft, extortion and a definite disruption in the job seeking process. In the end, there isn’t much you can do about this except the following:
- Set up 2-factor authentication on all your important accounts, especially email.
- Back up your important data. Cloud-based backups are best.
- Make sure you are running malware protection on your computer.
- Make sure your network (home and work) is protected by a proper firewall.
- Establish freezes on all your major credit reporting identities via these websites: Experian. TransUnion. EquiFax.
- Never trust an email link, especially one that seems to ask for a password right off the bat. Always call and verify.
Amazon announced its controversial “Sidewalk” platform nearly two years ago, but most of you probably missed the announcement and the uproar it caused as we were consequently distracted by the mother of all distractions in 2020. Now that we are all starting to stumble into the daylight like hermits emerging from a cave, Amazon is taking advantage of our befuddlement and online shopping addictions to roll out Sidewalk for realsies. On June 8th 2021, unless you specifically opt-out, your Amazon devices like Ring doorbells and security cameras, and the various smart-speaker/screen devices like Dot and Echo, will be automatically enrolled in Amazon’s ambitious effort to bring better network connectivity to your neighborhood. But what is it actually doing?
What is Sidewalk and why should you care?
In a nutshell, Amazon is leveraging the absolutely gigantic install base of Echos, Dots, Rings and Tiles to create what amounts to a vast mesh network. Depending on your training and professional interests, your reaction to this may vary from the “Awesome, maybe my Ring doorbell won’t keep falling off the internet,” (average homeowner reaction) to “This seems like a very bad idea,” (average security/technology consultant reaction). If you were concerned about Sidewalk bogarting your bandwidth, according their specs, it should be skimming a very small amount off the top which, unless you are on very constrained bandwidth (DSL is still the only choice in many neighborhoods believe it or not!), should not even be noticeable. From a security standpoint, Amazon seems to have its head on straight, again at least on paper, about how they are keeping the data transmissions encrypted and separate from your data. Huge caveat on this one – just because a bunch of engineers say something is safe now, does not make it so forever, as we have seen numerous network standards get dismantled and abandoned as dangerous flaws are discovered.
The big concern should be what else Amazon will be doing on the Sidewalk network. In case you hadn’t guessed it, they will be gathering data. An absolute monstrous amount of data on thousands and thousands of households, neighborhoods, camera feeds, pet walking routes, delivery times, recipe requests, song playlists, etc. All of it tagged with geolocation and numerous other telemetry points that give Amazon (and its data customers) an absolutely staggering market advantage. Depending on your leanings and privacy concerns, this may be of no big concern, or perhaps you’ve decided that Amazon gets enough of your dollars already and as such are not deserving of any more of your data than you’ve already sacrificed on the online shopping altar. If this is the case, then disabling Sidewalk is as simple as (wait for it) using your Alexa app to turn it off. Yes, this is like using the stones to destroy the stones. At least you can just delete the Alexa app after installing it to turn off Sidewalk. Until our government decides it’s time to regulate business use of our private data, it will be up to the average household to draw the line in the ongoing privacy war. Which side will you be on?
There are so many reports of this nature that I literally can’t even. My vacation can’t come soon enough, but in reality I’m just going to be worrying about all of you staying safe in the face of widespread negligence and malfeasance. Read on if you dare:
AT&T employees took bribes to plant malware on the company’s network
TLDR: Pakastani hackers bribe ATT employees $1M+ over the course of 5 years to unlock phones and install malware and rogue devices on ATT networks.
More N.S.A. Call Data Problems Surface as Law’s Expiration Approaches
TLDR: Remember all that secret data collection the NSA got caught doing a few years back? They were supposed to delete that data, but Oops! they didn’t.
Yelp is Screwing Over Restaurants By Quietly Replacing Their Phone Numbers
TLDR: Yelp set up a shady deal with GrubHub to redirect customer calls through their hub instead of dialing the restaurant direct. Restaurants get charged a marketing fee for this sleight-of-hand.
Twitter may have shared your data with ad partners without consent
TLDR: Twitter may have inadvertently shared data on your viewing habits that it collected without authorization. And then used that data to show you more ads. “Oops.”
Democratic Senate campaign group exposed 6.2 million Americans’ emails
TLDR: Dumb campaign staffer puts unsecured spreadsheet online in 2010. Emails have been exposed for nearly 10 years.
Image courtesy of TAW4 at FreeDigitalPhotos.net
Even if you haven’t read the seminal novel 1984 in many decades, you will surely recall the omnipresent “Big Brother” and the even more haunting reminder/warning that “Big Brother is watching you.” Rather than actually representing a single person (or even celestial being) readers quickly come to realize Big Brother is the result of countless numbers of citizens informing on their family, friends and neighbors in service of the Party “groupthink“. Fast forward to the present, where, believe it or not, Big Brother is watching and listening, but maybe not quite in the way Orwell had originally imagined.
“Alexa! Play doubleplusgood prolefeed!“
Most of you have come to accept that devices like Amazon’s smart speakers, Echo and it’s petite sibling, Dot, are always listening, ostensibly to be able to snap to action the second you shout, “Alexa!” But what you might not realize (or remember) is that Amazon is recording and keeping a copy of everything the device hears after you speak the trigger word. Depending on how cynical I’ve made you about technology over the years, this may or may not come as a surprise to you, and if you’ve been reading this blog for any length of time, I even wrote about this nearly three years ago. Despite very clearly dancing on knife-edge of child-protection laws in 2016, regulation has not halted or even slowed the proliferation of millions of eavesdropping, smart-devices.
If you are curious about what your own Alexa-powered smart speaker has recorded in your private home or office, have a look at http://www.amazon.com/alexaprivacy. Fortunately for our house, most of these recordings consist of teenagers ironically asking Alexa to play Despacito, our family belting out the lyrics to various Queen anthems, and desperate searches for recipes based on the contents of pantries ravaged by previously mentioned teenagers. More importantly, despite living with someone who is a staunch advocate of privacy and who has made no effort to hide that fact, our family has obviously agreed to give up some of that privacy for the (sometimes meager) convenience and amusement the device offers. We also have a Ring doorbell on our porch and have also opted into sharing some of that video footage (at our discretion) with our neighbors, again potentially sacrificing some privacy in trade for a technologically amplified neighborhood watch.
Each person and family must decide how much privacy they are willing to sacrifice in exchange for security, and keep a very watchful eye for the point at which the sacrifice escalates from privacy to the abrogation of personal freedoms. Though we aren’t explicitly told how Orwell’s Oceania transformed into the nightmarish surveillance state, it’s easy to see how they got there. The seductive lure of convenience and personal gratification is a sure-fire way to gradually erode personal privacy and security without raising an eyebrow, just as sure and slow as a stream carving a grand canyon.
Last year was not a good year for Facebook. Starting with the Cambridge Analytica, the social media giant seemed to stumble through a series of gaffes that literally erased billions from Mark Zuckerberg’s net worth. Yet, here we are again with the social media giant continuing to act with cavalier indifference towards its users’ privacy, and at this point, are you really surprised? We’re all adults here – I’m in no position to tell you what you should be keeping private or not, but I feel it’s my duty to make sure you are aware with whom you are sharing data, and that they are NOT here to serve you, but vice versa. And let’s put one big, stinging fact on the table – despite all of this, Facebook’s stock bounced back easily from last year’s drubbing, and is now poised to surge ahead thanks to better-than-expected fourth quarter earnings.
The latest proof that Facebook doesn’t care about your privacy
A few years back, Facebook instituted two-factor authentication for its login process, asking user’s for a phone number as the second factor. At this point, 2FA is the new security hotness, and millions are already smarting from a variety of virus infections, identity theft and account hacks to agree that 2FA was the best way to secure their accounts. While they weren’t (and still aren’t) wrong, could they have guessed that Facebook would start using that phone number as a means for other people to search for you, even if the searcher wasn’t someone you actually knew? How about doing this without even asking if its OK? This setting can be changed, but by default it’s set to allow “Public” access to use the 2FA phone number to help others find you. I don’t know about you, but that feels like the opposite of what everyone thought sharing this number with Facebook would do.
Strike two this month comes in the form of Facebook openly admitting that it receives data from many apps, including ones that help users track menstrual cycles, heart rates and website viewing habits, even if the user didn’t have a Facebook account. If this looks eerily similar to a recent article I wrote about a certain cell provider who was not being a good steward of your data, it is because it is yet another iteration of the same questionable practice.
Image courtesy of Stuart Miles from FreeDigitalPhotos.net
Full disclosure – I’ve long been a fan of many of Google’s services. I’ve used Gmail since the first beta, rely on Google search all day long, use a Pixel as my smartphone and listen to music all day long through their music service. It pains me when my favorite tech brands make poor choices, and unfortunately, Googles leadership seem to have forgotten their founders original scree, “Don’t be evil,” in favor of behaving like any profit-driven, ethically-ambiguous megacorp. The latest scandal comes from one of Google’s recent tech acquisitions in the form of a failure to disclose the presence of microphones in the Nest Secure home devices. Now, the presence of microphones in security devices shouldn’t come as a surprise, but Google’s failure to mention it in any documentation is a glaring breach of trust on their part.
What this means for you
When I first heard this news, I though to myself, “Well duh, of course these things have microphones. They are security monitoring devices,” and thought that, once again, naive consumers were purchasing and installing the devices without RTFM (“reading the fine manual” except substitute your own f-word). But no, Google (and Nest) didn’t actually document the presence of a microphone at all until it recently revealed that the Google Assistant technology could now be used on the Nest Secure device which, oh by the way, uses voice control…which, erm, requires a microphone…that is already on the device. According to Google, the microphone was disabled by default and can only be activated when the user specifically enables it. Which doesn’t make the whole failure to disclose any better, because how do we know it wasn’t enabled, and why should we trust them to be telling the truth now?
Unfortunately for you, even if you were being a careful consumer and reading the fine manual (or label, or reviews, etc.) the only way you would have known there was a microphone in the device would have been to dismantle it yourself, but why would you do that because the product documentation clearly lists the device’s specs, doesn’t it? Does this sound familiar? Like some other technology megacorp abusing its users’ trust? Is it going to take dragging these companies in front of Congress to get them stop being so lackadaisical with our privacy? Well, before we do that, let’s make sure we elect Congress critters that know iPhones aren’t made by Google.
Surprisingly, most people don’t realize that the popular idiom, “The Devil is in the detail” is actually derived from the more encouraging phrase, “God is in the detail,” i.e. pay attention to the small things as they are important. Both adages are more relevant now than ever, particularly because the average human is now daily agreeing to privacy policies with which, if they were to actually read the fine print, would probably not agree to at all. Such is the case with the numerous policies you are “accepting” when you install apps on your smartphone. What policy acceptance? The one hidden behind a small pop-up that says your data will be shared with other parties to improve your experience, or some other vaguely worded reminder that you are sharing data with a company in exchange for the free (or sometimes paid) use of an app.
What this means for you
“Yeah, yeah, I know, they are watching my every move,” my clients have said to me, “I’ve got nothing to hide.” Or, “It’s a small price to pay for this wonderful app/service/game.” Except most aren’t aware of how much data is being tracked, or what it can used for, aside from advertising. If you’d like a small taste of how this data is being assembled and the level of detail it can offer into everyone’s daily routines, read this article from the NY Times, “Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret” – it’s a very easy read and has some nice interactive visual aids to bring the point home. Despite its approachable tone, the content of the article should be unsettling for everyone. For example, when asked to explain why their prompt to grant access to very precise coordinate data and permission to share with 16 companies was instead presented as a way to “recommend local teams and players that are relevant to you,” a spokesperson for the app responded (emphasis ours):
…the language in the prompt was intended only as a “quick introduction to certain key product features” and that the full uses of the data were described in the app’s privacy policy.
Let’s be honest here: I’m in this business up to my neck, and even I don’t read those privacy policies, but only because I know exactly what I’m trading for the use of a “free” app. You have a much more relatable excuse: “Ain’t nobody got time for ‘dat.” You are not wrong, but in the pursuit of better deals, faster commutes, cheaper gas or just weather updates, we have traded a precious commodity: privacy. And lest you forget, privacy is not about hiding secrets, but about not wanting to share everything about your life with complete strangers who only view you as a profit center. This is yet another glimpse of the elephant on the internet around which everyone is still carefully tip-toeing. Make sure you are paying attention!
Image courtesy of TAW4 at FreeDigitalPhotos.net