Stop Using Google Analytics, Warns Sweden's Privacy Watchdog

Sweden's data protection watchdog has issued a couple of fines in relation to exports of European users' data via Google Analytics which it found breach the bloc's privacy rulebook owing to risks posed by U.S. government surveillance. It has also warned other companies against use of Google's tool. From a report: The fines -- just over $1.1 million for Swedish telco Tele2 and less than $30,000 for local online retailer CDON -- are notable as they are the first such fines following a raft of strategic privacy complaints targeting Google Analytics (and Facebook Connect) back in August 2020. The regulator found that so-called supplementary measures applied by Google to European users' data sent to the U.S. for processing were insufficient to raise the level of protection to the required legal standard. Including Google's use of IP address truncation (an anonymization measure) as, in the Tele2 case, it said the company did not clarify whether the truncation was performed before or after the transfer of the data to the U.S. so had failed to demonstrate there is "no potential access to the entire IP address before the last octet is truncated." The watchdog also found breaches of the bloc's General Data Protection Regulation (GDPR) rules on transfers to third countries in the case of two other companies' use of Google Analytics, Coop and Dagens Industries, but did not issue fines in those cases.

Read more of this story at Slashdot.

Pornhub cuts off more US users in ongoing protest over age-verification laws

Read 14 remaining paragraphs | Comments

Drone Realism

You can’t tell a story about drones without additionally telling a surveillance story.

Patient data for companies: Patient privacy, private profits and the public good

By Adrian Thorogood and Eva Winkler.

Our paper tackles a question that policymakers and public healthcare systems are wrestling with around the world: should for-profit companies be given access to medical data derived from patients for research?

In public healthcare systems, medical data is generated as part of the routine care of patients, and through administrative processes like billing and reimbursement. Medical data is a valuable resource for research and innovation that can advance medical science and improve healthcare. Beyond academic research, for-profit companies are increasingly interested in access to “real world” medical data to inform the discovery and development of drugs, medical technologies, and data-based health applications such as AI. Many countries are actively promoting data sharing to advance public health and wealth goals.

Despite this enthusiasm, for-profit re-use of medical data from public healthcare systems continues to be a source of controversy. Hospitals and data sharing initiatives have often been criticized for a lack of transparency and social license. Some have even been shuttered or sued. Empirical surveys consistently suggest patients and members of the public are less comfortable with companies accessing their sensitive health information than healthcare professionals or academic researchers.  This tension between the interests of patients and those of the public and for-profit corporations calls for a closer look at the interests of all parties involved.

Inspired by political philosophy, our paper aims to identify and evaluate the competing claims of different stakeholders relating to for-profit re-use of medical data. This includes the patients providing data, the companies seeking to use data, the society who funds and relies on its public healthcare system, and the healthcare institutions and professionals who painstakingly generate medical data.

Patients have a right to have their medical data treated with confidentiality, and a right to actively determine who accesses this sensitive form of personal data and why. Any re-use of their data should be subject to strict privacy and security safeguards, and to high standards of consent, transparency, and accountability. Patients might expect to receive a direct share in profits generated from the contribution of data. Assuming such a scheme could be practically implemented, does this claim override those of companies, hospitals and society? We argue that this is a weak claim: while medical data certainly fall under patients’ control required by the right to informational self-determination, data are generated primarily for their healthcare and no right to share in profits  can be deduced.

For-profit companies in the health sector do not have a right per se to access publicly funded medical data. However, they are entitled to freedom of research – a defensive right restricting state influence on research activities – and a right to a level playing field where access is provided (non-discriminatory access). Companies do have a legitimate right to pursue and realize profits from developing high-quality, life-saving or improving health products. Where products do not offer true value, are overpriced or are not domestically available, however, commercial practices can threaten the sustainability of health systems and patient access. This seems all the more unjust for products developed using data provided by health systems and patients. As part of corporate social responsibility, companies have ethical and reputational reasons to protect patient privacy and to deliver benefits to society, reflected by the current proliferations of guidelines around responsible AI.

Hospitals and clinics are ultimately the places where patient data is generated, through the dedicated efforts of healthcare professionals and staff. Do physicians and hospital leadership own the data and have a claim to share in eventual profits? These claims are complicated by the public funding supporting healthcare delivery, patient self-determination, and the fact that data generation is only the beginning of a complex value chain. They do, however, have a valid claim to appropriate compensation for data generation and curation, one that is all too often overlooked.

Society can benefit from for-profit re-use through things like improved drug safety, as well as more accurate and cost-effective care. How can the  state ensure public funds invested in health systems and data infrastructure maximally benefit society, while also maintaining public and patient trust?

Two key tensions arise: between profit maximation versus societal benefit, and between commercial and societal interests in exploiting data versus patient self-determination and privacy. To address these tensions, we conclude by suggesting conditions for ethically sound for-profit re-use of medical data:

• Limit for-profit re-use to uses that aim to improve health or health systems and ensure and document this return and contribution in a transparent way.
• Strengthen consent practices and offer patients meaningful consent opportunities, supported by data access oversight bodies including patient representatives.
• Establish privacy and security safeguards to minimize risks and hold companies to account for breaches.
• Transparently document public support for companies, and track how this contributes to profits and societal benefit.
• Explore mechanisms to encourage alignment between company and societal aims (e.g., fair licensing and pricing commitments, preferential health system access).

We conclude that there are good reasons to grant for-profit companies access to medical data if they meet certain conditions: among others they need to respect patients’ informational rights and their actions need to advance the public interest in better healthcare.

 

Paper title: Patient data for companies? – An ethical framework for sharing patients’ data with for-profit  companies for research

Authors: Winkler EC¹, Jungkunz M², Lotz V¹, Thorogood A³, Schickhardt C²

Affiliations:

1. University Hospital Heidelberg, Section for Translational Medical Ethics, Department of Medical Oncology, National Center for Tumor Diseases, Heidelberg, Germany

2. German Cancer Research Center, Section for Translational Medical Ethics, National Center for Tumor Diseases, Heidelberg, Germany
3. Terry Fox Research Institute, Vancouver, BC, CAN

Competing interests: ECW and CS have been receiving grants by the German Ministry of Education and Research (BMBF) in the frame of the German Medical Informatics Initiative (MII) and have been involved in the Working Group “Consent” of the MII

The post Patient data for companies: Patient privacy, private profits and the public good appeared first on Journal of Medical Ethics blog.

Twitter lawyer quits as Musk’s legal woes expand, report says

Read 6 remaining paragraphs | Comments

Tesla workers reportedly passed around private video from customers' cars

Just because a company — like, say, Tesla — promises that your privacy "is and will always be enormously important to us," doesn't mean your privacy is important to them. Nor does it mean your privacy will be protected. Where there's a camera, there's a way — to invade your privacy, that is. — Read the rest

Sheffield University criticised for hiring private investigator after protest

Private investigator hired to look into possible involvement of two student activists in occupation of building

Sheffield University has been criticised for hiring a private investigator to look into the possible involvement of two student activists in a protest in one of its buildings.

The two students received letters on 9 November informing them that the university had hired Intersol Global, a firm of investigators, to look into whether they were involved in a student occupation of a building in late October protesting against Sheffield’s links to the arms industry.

Continue reading...

Ctrl-Alt-Defeat: White Castle facing "annihilation" over worker surveillance; Congress gets hacked

This week's tech-politics roundup: Tiny burgers in big trouble; Bollywood credit-card scam; Twitter canary silenced

FBI admits to circumventing warrant laws by using capitalism instead

Surprise! The FBI has been involved in warrantless surveillance! But that's not particularly surprising; we've known that for a while now (even in some pundits like to pretend as if it's absolutely unprecedented when the FBI occasionally stops monitoring Muslims, Black rights, and environmental activists and turns their attention to money laundering networks surrounding right-wing politicians). — Read the rest

Sweaters that fool facial recognition

Protect your facial biometric data with knit wear? As absurd as that sounds, designer Rachele Didero, of the Italian startup Cap_able, has patented textiles that do just that. The patterns trick facial-recognition cameras into thinking it's not looking at a person. — Read the rest

FBI, Pentagon Helped Research Facial Recognition for Street Cameras, Drones

The FBI and the Defense Department were actively involved in research and development of facial recognition software that they hoped could be used to identify people from video footage captured by street cameras and flying drones, according to thousands of pages of internal documents that provide new details about the government's ambitions to build out a powerful tool for advanced surveillance. WashingtonPost: The documents, revealed in response to an ongoing Freedom of Information Act lawsuit the American Civil Liberties Union filed against the FBI, show how closely FBI and Defense officials worked with academic researchers to refine artificial-intelligence techniques that could help in the identification or tracking of Americans without their awareness or consent. Many of the records relate to the Janus program, a project funded by the Intelligence Advanced Research Projects Agency, or IARPA, the high-level research arm of the U.S. intelligence community modeled after the Pentagon's Defense Advanced Research Projects Agency, known as DARPA. Program leaders worked with FBI scientists and some of the nation's leading computer-vision experts to design and test software that would quickly and accurately process the "truly unconstrained face imagery" recorded by surveillance cameras in public places, including subway stations and street corners, according to the documents, which the ACLU shared with The Washington Post. In a 2019 presentation, an IARPA program manager said the goal had been to "dramatically improve" the power and performance of facial recognition systems, with "scaling to support millions of subjects" and the ability to quickly identify faces from partially obstructed angles. One version of the system was trained for "Face ID ... at target distances" of more than a half-mile. To refine the system's capabilities, researchers staged a data-gathering test in 2017, paying dozens of volunteers to simulate real-world scenarios at a Defense Department training facility made to resemble a hospital, a subway station, an outdoor marketplace and a school, the documents show. The test yielded thousands of surveillance videos and images, some of which were captured by a drone. The improved facial recognition system was ultimately folded into a search tool, called Horus, and made available to the Pentagon's Combating Terrorism Technical Support Office, which helps provide military technologies to civilian police forces, the documents show. The Horus tool has since been offered for use to at least six federal agencies, and their feedback is "continuing to be used to refine the tool," Department of Homeland Security officials said last year.

Read more of this story at Slashdot.

The Privacy Loophole in Your Doorbell

Police were investigating his neighbor. A judge gave officers access to all his security-camera footage, including inside his home. From a report: The week of last Thanksgiving, Michael Larkin, a business owner in Hamilton, Ohio, picked up his phone and answered a call. It was the local police, and they wanted footage from Larkin's front door camera. Larkin had a Ring video doorbell, one of the more than 10 million Americans with the Amazon-owned product installed at their front doors. His doorbell was among 21 Ring cameras in and around his home and business, picking up footage of Larkin, neighbors, customers and anyone else near his house. The police said they were conducting a drug-related investigation on a neighbor, and they wanted videos of "suspicious activity" between 5 and 7 p.m. one night in October. Larkin cooperated, and sent clips of a car that drove by his Ring camera more than 12 times in that time frame. He thought that was all the police would need. Instead, it was just the beginning. They asked for more footage, now from the entire day's worth of records. And a week later, Larkin received a notice from Ring itself: The company had received a warrant, signed by a local judge. The notice informed him it was obligated to send footage from more than 20 cameras -- whether or not Larkin was willing to share it himself. As networked home surveillance cameras become more popular, Larkin's case, which has not previously been reported, illustrates a growing collision between the law and people's own expectation of privacy for the devices they own -- a loophole that concerns privacy advocates and Democratic lawmakers, but which the legal system hasn't fully grappled with. Questions of who owns private home security footage, and who can get access to it, have become a bigger issue in the national debate over digital privacy. And when law enforcement gets involved, even the slim existing legal protections evaporate. "It really takes the control out of the hands of the homeowners, and I think that's hugely problematic," said Jennifer Lynch, the surveillance litigation director of the Electronic Frontier Foundation, a digital rights advocacy group. In the debate over home surveillance, much of the concern has focused on Ring in particular, because of its popularity, as well as the company's track record of cooperating closely with law enforcement agencies. The company offers a multitude of products such as indoor cameras or spotlight cameras for homes or businesses, recording videos based on motion activation, with the footage stored for up to 180 days on Ring's servers. They amount to a large and unregulated web of eyes on American communities -- which can provide law enforcement valuable information in the event of a crime, but also create a 24/7 recording operation that even the owners of the cameras aren't fully aware they've helped to build.

Read more of this story at Slashdot.

Why Is TikTok Being Banned?

Governments have expressed concerns that TikTok, which is owned by the Chinese company ByteDance, may endanger sensitive user data.

BetterHelp Sold Customer Data While Promising It was Private, Says FTC

Online counseling company BetterHelp has agreed to pay $7.8 million to settle charges from the Federal Trade Commission that it improperly shared customers' sensitive data with companies like Facebook and Snapchat, even after promising to keep it private. The Verge reports: The proposed order, announced by the FTC on Thursday, would ban the same behavior in the future and require BetterHelp to make some changes to how it handles customer data. According to the regulator, the sign-up process for the company's service "promised consumers that it would not use or disclose their personal health data except for limited purposes." However, the FTC alleges that the company instead "used and revealed consumers' email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising purposes." The FTC also says that the company gave customer service agents false scripts to try and reassure users that it wasn't sharing personally identifiable or personal health information after a February 2020 report from Jezebel exposed some of its practices. The commission's complaint (PDF) accuses the company of misleading customers by putting a HIPAA seal on its website, despite the fact that "no government agency or other third party reviewed [BetterHelp]'s information practices for compliance with HIPAA, let alone determined that the practices met the requirements of HIPAA." If the FTC's order ends up going through, the $7.8 million would go to customers who signed up for the service between August 1st, 2017, and December 31st, 2020. Here are some of the other things BetterHelp would be required to do: - Stop sharing individually identifiable information about consumer's mental health with any third parties - Stop misrepresenting its data collection and use policies - Alert customers who created accounts before January 1st, 2021, that their personal info may have been used for advertising - Obtain "affirmative express consent" from a customer before sharing information with a third party - Reach out to third parties that received customer information and ask that it be deleted - Establish a "comprehensive privacy program" and have an independent third party carry out privacy assessments

Read more of this story at Slashdot.

SeaMonkey as an I2P Suite

I2P is one of the many darknets floating around (running over?) the internet and I’ve been playing around with it since, like, high school. It’s peer-to-peer, censorship resistant, and overall just super cool. And by peer-to-peer I mean that you can share files over the network (using torrents) while both remaining anonymous and not being a nuisance to other users (unlike Tor).

Also unlike Tor it doesn’t have its own “browser bundle”.

I mean, it did at one point. But then it got discontinued.

Before the browser bundle I had to rely on a manually configured secondary browser, which I am now back to doing. It’s not a majorly inconvenient process, but wow was that browser bundle very convenient.

---

I’ve been a die hard user of Firefox (and browsers based on/related to Firefox, like Camino or pre-Chromium Flock) since the early/mid 2000s and I have no plans to ever switch over to Chrome or its ilk. Even though the browser wars are over, I will forever continue the struggle as part of the dissident Firefox-users campaign. Sure, I have to rely on Google for plenty of other things (like my phone, calendar, contacts, cloud storage, captcha protection for this site, and so on), but they’ll never get my browser! Or email! Or web searches (mostly)!

You can have my Gecko layout engine when you uninstall it from my cold, bricked, SSD.

So obviously, I’d use something Firefox-ish for my manually configured secondary browser. And the Firefox-ish browser I’m using here is SeaMonkey; the direct descendant of the original Mozilla Application Suite which Firefox, as well as Thunderbird (which I still use as a desktop mail/RSS client), were spun off of from.

In addition to a browser, SeaMonkey includes an email (and newsgroup) client, an IRC client, an HTML editor, and an email address book.

So, why SeaMonkey? And not, like… a separate Firefox profile or container tab or something.

Well, for all their similarities (both being darknet-proxy-software things and all), I2P and Tor are different. They fill different niches, I guess. While they both have hidden services and out-proxies to the clearweb, Tor’s focus is definitely on the latter, while I2P seems to focus more on the former. And I2P’s hidden services aren’t all websites (I’m not saying all of Tor’s are though); I2P also has email, and IRC, and torrents too!

And also I’m already comfortable doing things this way. Leave me alone.

---

Installing I2P and SeaMonkey

The first thing I did here was actually getting the software. I did a manual download/installation rather than relying on my machine’s package manager, because I didn’t want to have to build possibly outdated versions from the AUR that may overwrite whatever changes I made after an update. Links to download both SeaMonkey and I2P are below.

Download SeaMonkey → https://www.seamonkey-project.org/releases/

Download I2P → https://geti2p.net/en/download

Configuring the browser

Like I said before, I2P hidden services aren’t all websites, but that is a large part of them, so configuring SeaMonkey’s browser was going to be necessary.

Configuring the browser is pretty straightforward. The process for SeaMonkey is more-or-less the same as the process for Firefox, the only difference being the location of where the changes needed to be made. In SeaMonkey, the Preferences are in the Edit menu, and the proxy settings will be in Proxies under the Advanced section.

And once that’s configured (and once I2P is running) the router homepage can be found here: http://127.0.0.1:7657

I will admit that it has been a bit painful when I have to run updates for SeaMonkey, as I’ve had to temporarily disable the proxy. Updates to I2P, however, are done entirely within I2P! Via torrents!

I love torrents.

Configuring the mail client

Thanks to the mysterious and venerable postman, getting an I2P email address is super easy. And it works like any other email address; messages can be sent to whoever! And that ain’t just limited to other folks with I2P email addresses. It works Clearnet-to-I2P (and vice versa) as well!

I don’t really make use of the email service, because I’d really only be sending encrypted emails talking about encryption (relevant xkcd), but it’s still a useful tool for folks that need it. And by default, I2P actually has a pre-configured browser-integrated mail client that works great.

But sometimes having a dedicated(-ish) mail client is good. It’s not something I need, but still, I can do it with SeaMonkey.

If you can set up a mail client for a normal email account then you can do the same for an I2P mail account. Only POP3 works though, so that’s what I had to use; no IMAP. Also, I didn’t have to select any encryption/connection security settings because all packets being sent through I2P are encrypted anyways.

I used 127.0.0.1 as the host for both POP and SMTP over ports 7660 and 7659 respectively (as mentioned in I2P’s list of used ports). By default, these ports are tunneled to/from the mail service that postman runs, but if I wanted to use another service I can change them in the I2P tunnel settings.

Configuring the IRC client

I was able to configure the IRC client, Chatzilla, pretty quickly as well. It was just the matter of adding a network named irc2p, and then adding a server under that network, with the actual “server” being 127.0.0.1 and the port being 6668.

And again, no encryption/connection security settings were necessary here either because everything’s encrypted anyways.

I2P has some documentation on configuring other IRC clients that’s definitely worth a read.

Like the email service, the mentioned port (6668) is also set to tunnel to/from the a service run by postman, but I can always change this if I want (same way as the email stuff).

Configuring a desktop shortcut

Since I did a manual install of both SeaMonkey and I2P, I had to do some manual work to actually set up a shortcut. I installed both pieces of software in the same directory (i2p-browser) and then wrote a bash script to, first, start the I2P router (in headless mode) and, then, start SeaMonkey. After SeaMonkey exits, I then stop the router.

#!/bin/bash

/path/to/my/i2p-browser/i2p/i2prouter start && wait
/path/to/my/i2p-browser/seamonkey/seamonkey && wait
/path/to/my/i2p-browser/i2p/i2prouter stop

I then created a .desktop file to point at this script, and stuck it where all of those custom .desktop files go in GNOME (~/.local/share/applications/). That way a shortcut will be in my applications menu, and I can start the whole thing with one click.

[Desktop Entry]
Type=Application
Name=i2p Browser
Comment=
Categories=Network;WebBrowser;Security;
Exec=bash /path/to/my/i2p-browser/i2p_browser_start.sh
Icon=/path/to/my/i2p-browser/i2p/docs/console.ico

Yeah, I use GNOME. Fight me.

By default, when I2P starts, it will open the router console in the default browser. Since I didn’t want this, and wanted to use SeaMonkey, I unchecked that settings in the router config.

---

A web browser, mail client, and IRC client. That pretty much covers everything that’s part of SeaMonkey. And once it’s all configured, it’s on to browsing the invisible internet.

But what about torrents? I’ve mentioned torrents a few times here. How am I going to start using those? Well I could try configuring my normal torrent client, Deluge, to proxy traffic through I2P using a SAM Bridge and…

I2P actually includes, by default, a browser-accessible torrent client called I2PSnark! And, because of how I2P works, it’s totally anonymous! Since, like, everything is encrypted. And also I2P is a darknet.

I2P has plenty of other cool features that I really need to explore, like anonymous git hosting. Maybe after I play around with (finally) setting up my own hidden service on I2P (they’re called eepsites) like I did with Tor I can finally do that.

The Washington Post Says There's 'No Real Reason' to Use a VPN

Some people try to hide parts of their email address from online scrapers by spelling out "at" and "dot," notes a Washington Post technology newsletter. But unfortunately, "This spam-fighting trick doesn't work. At all." They warn that it's not just a "piece of anti-spam fiction," but "an example of the digital self-protection myths that drain your time and energy and make you less safe. "Today, let's kill off four privacy and security bogus beliefs, including that you need a VPN to stay safe online. (No, you probably don't.) Myth No. 3: You need a VPN to stay safe online. ...for most people in the United States and other democracies, "There is no real reason why you should use a VPN," said Frédéric Rivain, chief technology officer of Dashlane, a password management service that also offers a VPN.... If you're researching sensitive subjects like depression and don't want family members to know or corporations to keep records of your activities, Rivain said you might be better off using a privacy-focused web browser such as Brave or the search engine DuckDuckGo. If you use a VPN, that company has records of what you're doing. And advertisers will still figure out how to pitch ads based on your online activities. P.S. If you're concerned about crooks stealing your info when you use WiFi networks in coffee shops or airports and want to use a VPN to disguise what you're doing, you probably don't need to. Using public WiFi is safe now in most circumstances, my colleague Tatum Hunter has reported. "Many VPNs are also dodgy and may do far more harm than good," their myth-busting continues, referring readers to an earlier analysis by the Washington Post (with some safe recommendations). On a more sympathetic note, they acknowledge that "It's exhausting to be a human on the internet. Companies and public officials could be doing far more to protect you." But as it is, "the internet is a nonstop scam machine and a little paranoia is healthy."

Read more of this story at Slashdot.

Germany raises red flags about Palantir’s big data dragnet

Read 13 remaining paragraphs | Comments

New York Moves Against Stalkerware

An anonymous reader shares a report: Stalkers and domestic abusers in the US for years have been able to access the kind of surveillance tools typically associated with foreign spies. That's all because of a pervasive industry that promises to help people who want to secretly monitor their family members. Now, because of an action brought by the New York Attorney General, one player in the so-called stalkerware industry has agreed to notify the people who were infected with its spyware. But it was required to pay just $410,000 in civil penalties, in part because rather than taking issue with the harmful nature of the technology, state prosecutors cited only the companies' use of deceptive marketing. A detailed legal filing provides a glimpse into the pernicious capabilities that stalkerware firms provide to consumers -- enabling buyers to collect victims' texts, photos, emails, direct messages, you name it. The case is the latest evidence that such apps are more popular than previously understood. The New York investigation determined that one Florida man owned 16 companies, distributing apps with names such as PhoneSpector and AutoForward Data Services that promoted mobile surveillance software. Once installed on a device, some of the apps would be invisible on a user's home screen and allow a stalker to remotely activate an individual's camera or microphone without their knowledge, according to the legal filing.

Read more of this story at Slashdot.

Data Free Disney

Each day, 50,000 people enter Disney’s theme parks, along with their phones, purchases, locations, and photos. What happens to the data?

The post Data Free Disney appeared first on Public Books.

The flight tracker that powered @ElonJet has taken a left turn

Read 24 remaining paragraphs | Comments