Online PRIVACY

=== 

promoted to primary b/c of cory d and net neutrality beat, cf also DAPL tigerswan surveillance

see big data-base

see activist suppression, police, fusion ctrs

see PRIVACY 2

merri ok

---

---

AN 4 26

Oral arguments unfolded at the U.S. Supreme Court on Mondayin *Chatrie v. United States*, which will decide whether police demands for all Google data from anyone near a crime scene violate the Fourth Amendment's protection against unreasonable search.

The case surrounds a 2019 robbery of a federal credit union in Virginia. Law enforcement investigating the robbery served a warrant on Google, asking for information on any devices near the bank at the time. The district court found there was no probable cause but allowed the warrant anyway, citing the "good-faith exception."

The U.S. Court of Appeals for the Fourth Circuit affirmed. So, the Supreme Court will decide whether Americans can control their privacy and data held by third-party tech companies, and what the government must do if it intends to subpoena the digital records.

During the arguments, the justices sparked online debate about whether they fully comprehend the uses of technology they were debating.

In one discussion, Chief Justice John Roberts didn't understand why they were even meeting to discuss the issue, since users can ask their phones to turn off location services.

Roberts asked, "What's the issue?" Saying that people could simply turn it off.

Arguing for Chatrie, lawyer Adam Unikowsky explained that Americans shouldn't have to turn off "location services" just to avoid being surveilled by the government.

Location services are necessary for features like GPS directions in Google Maps or "find my phone" technology. Parents use the location services to keep an eye on where their kids are. Friends can share it with other friends when meeting up or use it for safety if they're going out with someone they met online.

Roberts argued that the government only gets access if the user decides to make it public.

Constitutional Law Professor Anthony Michael Kreis commented, "If you don’t want the government to track you, just turn the location off. Well, Chief Justice Roberts, maybe I want my friends to know where to find me if I’m dying in a ditch or lost at a festival without the government knowing. Such an unrealistic question."

One lawyer joked, "But under an originalist interpretation, nothing restricted the government from triangulating your location in real time by intercepting and tracing homing pigeons, which people were, of course, constantly sending and releasing at all times."

The justices generally make "originalist" arguments, but such arguments come from a time when technology available today didn't exist.

Another remarked, "If you don't want the electorate to track you, establish a docket to announce decisions without explanation."

This is a slight on the justices, specifically Roberts, who have tried to hide debate from the public using the "shadow docket," where there are no public oral arguments in the court.

Tech Crunch security editor Zack Whittaker confessed it took him just five minutes of listening to the oral arguments before he was "annoyed by Roberts' flawed logic."

A follower joked that Roberts was basically saying, "Just opt out like our Founders intended..."

---

---

kochava, the self-proclaimed industry leader in mobile app data analytics, is locked in a legal battle with the Federal Trade Commission in a case that could lead to big changes in the global data marketplace and in Congress’ approach to artificial intelligence and data privacy.

The stakes are high because Kochava’s secretive data acquisition and AI-aided analytics practices are commonplace in the global location data market. In addition to numerous lesser-known data brokers, the mobile data market includes larger players like Foursquare and data market exchanges like Amazon’s AWS Data Exchange. The FTC’s recently unsealed amended complaint against Kochava makes clear that there’s truth to what Kochava advertises: it can provide data for “Any Channel, Any Device, Any Audience,” and buyers can “Measure Everything with Kochava.”

Separately, the FTC is touting a settlement it just reached with data broker Outlogic, in what it calls the “first-ever ban on the use and sale of sensitive location data.” Outlogic has to destroy the location data it has and is barred from collecting or using such information to determine who comes and goes from sensitive locations, like health care centers, homeless and domestic abuse shelters, and religious places.

According to the FTC and proposed class-action lawsuits against Kochava on behalf of adults and children, the company secretly collects, without notice or consent, and otherwise obtains vast amounts of consumer location and personal data. It then analyzes that data using AI, which allows it to predict and influence consumer behavior in an impressively varied and alarmingly invasive number of ways, and serves it up for sale.

Kochava has denied the FTC’s allegations.

The FTC says Kochava sells a “360-degree perspective” on individuals and advertises it can “connect precise geolocation data with email, demographics, devices, households, and channels.” In other words, Kochava takes location data, aggregates it with other data and links it to consumer identities. The data it sells reveals precise information about a person, such as visits to hospitals, “reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities.” Moreover, by selling such detailed data about people, the FTC says “Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence.”

I’m a lawyer and law professor practicing, teaching and researching about AI, data privacy and evidence. These complaints underscore for me that U.S. law has not kept pace with regulation of commercially available data or governance of AI.

Most data privacy regulations in the U.S. were conceived in the pre-generative AI era, and there is no overarching federal law that addresses AI-driven data processing. There are Congressional efforts to regulate the use of AI in decision making, like hiring and sentencing. There are also efforts to provide public transparency around AI’s use. But Congress has yet to pass legislation.

The Federal Trade Commission’s suit against Kochava is set against a backdrop of minimal regulation of data brokers.

What litigation documents reveal

According to the FTC, Kochava secretly collects and then sells its “Kochava Collective” data, which includes precise geolocation data, comprehensive profiles of individual consumers, consumers’ mobile app use details and Kochava’s “audience segments.”

The FTC says Kochava’s audience segments can be based on “behaviors” and sensitive information such as gender identity, political and religious affiliation, race, visits to hospitals and abortion clinics, and people’s medical information, like menstruation and ovulation, and even cancer treatments. By selecting certain audience segments, Kochava customers can identify and target extremely specific groups. For example, this could include people who gender identify as “other,” or all the pregnant females who are African American and Muslim. The FTC says selected audience segments can be narrowed to a specific geographical area or, conceivably, even down to a specific building.

By identify, the FTC explains that Kochava customers are able to obtain the name, home address, email address, economic status and stability, and much more data about people within selected groups. This data is purchased by organizations like advertisers, insurers and political campaigns that seek to narrowly classify and target people. The FTC also says it can be purchased by people who want to harm others.

How Kochava acquires such sensitive data

The FTC says Kochava acquires consumer data in two ways: through Kochava’s software development kits that it provides to app developers, and directly from other data brokers. The FTC says those Kochava-supplied software development kits are installed in over 10,000 apps globally. Kochava’s kits, embedded with Kochava’s coding, collect hordes of data and send it back to Kochava without the consumer being told or consenting to the data collection.

Another lawsuit against Kochava in California alleges similar charges of surreptitious data collection and analysis, and that Kochava sells customized data feeds based on extremely sensitive and private information precisely tailored to its clients’ needs.

The data broker marketplace has been tracking you for years, thanks to mobile phones and web browser cookies.

AI pierces your privacy

The FTC’s complaint also illustrates how advancing AI tools are enabling a new phase in data analysis. Generative AI’s ability to process vast amounts of data is reshaping what can be done with and learned from mobile data in ways that invade privacy. This includes inferring and disclosing sensitive or otherwise legally protected information, like medical records and images.

AI provides the ability both to know and predict just about anything about individuals and groups, even very sensitive behavior. It also makes it possible to manipulate individual and group behavior, inducing decisions in favor of the specific users of the AI tool.

This type of “AI coordinated manipulation” can supplant your decision-making ability without your knowledge.

Privacy in the balance

The FTC enforces laws against unfair and deceptive business practices, and it informed Kochava in 2022 that the company was in violation. Both sides have had some wins and losses in the ongoing case. Senior U.S. District Judge B. Lynn Winmill, who is overseeing the case, dismissed the FTC’s first complaint and required more facts from the FTC. The commission filed an amended complaint that provided much more specific allegations.

Winmill has not yet ruled on another Kochava motion to dismiss the FTC’s case, but as of a Jan. 3, 2024 filing in the case, the parties are proceeding with discovery. A 2025 trial date is expected, but the date has not yet been set.

For now, companies, privacy advocates and policymakers are likely keeping an eye on this case. Its outcome, combined with proposed legislation and the FTC’s focus on generative AI, data and privacy, could spell big changes for how companies acquire data, the ways that AI tools can be used to analyze data, and what data can lawfully be used in machine- and human-based data analytics.

Anne Toomey McKenna, Visiting Professor of Law, University of Richmond

This article is republished from The Conversation under a Creative Commons license. Read the original article.

---

the talking cow?

https://www.alternet.org/2021/05/devin-nunes-bill-barr/

==

---

Edward Snowden: With technology, institutions have made ‘most effective means of social control in the history of our species’

NSA whistleblower Edward Snowden said Thursday that people in systems…

==

2207 patriot act renew but also another Act?

https://projects.propublica.org/graphics/surveillance-timeline

---

https://www.alternet.org/koch-brothers-are-watching-you-and-new-documents-reveal-just-how-much-they-know

new documents uncovered by the Center for Media and Democracy show that the billionaire Koch brothers have developed detailed personality profiles on 89 percent of the U.S. population; and are using those profiles to launch an unprecedented private propaganda offensive to advance Republican candidates in the 2018 midterms.

The documents also show that the Kochs have developed persuasion models — like their "Heroin Model" and "Heroin Treatment Model" — that target voters with tailored messaging on select issues, and partner with cable and satellite TV providers to play those tailored messages during “regular” television broadcasts.

Over the last decade, big data and microtargeting have revolutionized political communications. And the Kochs, who are collectively worth $120 billion, now stand at the forefront of that revolution — investing billions in data aggregation, machine learning, software engineering and Artificial Intelligence optimization.

In modern elections, incorporating AI into voter file maintenance has become a prerequisite to producing reliable data. The Kochs’ political data firm, i360 states that it has “been practicing AI for years. Our team of data scientists uses components of Machine learning, Deep Learning and Predictive Analytics, every day as they build and refine our predictive models.”

Thanks to that investment (and the Supreme Court’s campaign finance rulings that opened the floodgates for super PACs), the Koch network is better positioned than either the Democratic Party or the GOP to reach voters with their individually tailored communications.

That is a dangerous development, with potentially dramatic consequences for our democracy.

The Kochs and i360

The Kochs formally entered the data space nine years ago, developing the “Themis Trust” program for the 2010 midterms — an uncommonly impactful election cycle where Republican operatives executed their REDMAP program and algorithmically gerrymandered congressional maps across the country in their favor.

In 2011, the Kochs folded Themis into a data competitor it acquired, i360 LLC, which was founded by Michael Palmer, the former chief technology officer of Sen. John McCain’s 2008 presidential campaign. Palmer still leads the organization.

Back then, as journalists Kenneth Vogel and Mike Allen documented, the Kochs’ long-term funding commitments to i360 allowed the organization to think bigger than their political competitors.

“Right now, we’re talking about and building things that you won’t see in 2016, because it’s not going to be ready until 2018,” Michael Palmer said in the wake of the 2014 midterm cycle.

Those programs are now operational. And according to a successful GOP campaign manager, i360 is the “best in the business” at providing Republicans with voter data.

i360’s client list reflects that data superiority. The country’s most notorious and effective political spenders, like the National Rifle Association, use the platform to identify and influence voters, as do Republican party committees, and U.S. House and Senate campaigns.

(A full list of i360’s clients is available here. Some clients, like the Republican Party of Wisconsin, have multiple sub-campaigns they run. It is also important to note that many Koch political groups, like Americans for Prosperity and the Libre Initiative, signed data sharing agreements with i360 in 2016 that are most likely still in effect.)

i360 sweetens the deal to its clients by offering its services at below-market rates. And once clients are locked into the i360 platform, they have access to the company’s voter file — the beating heart of modern political campaigns.

Conservatives agree that the Kochs are subsidizing i360. The losses they sustain by undercharging clients, however, are a pittance compared to the down-stream public policy returns and political power the Kochs receive from operating what amounts to a shadow political party in the United States — one that vigilantly guards the fossil fuel subsidies, deregulatory schemes, and regressive tax structures that enable Koch Industries to bring in $115 billion annually in private revenue.

Inside the i360 Voter File

i360’s voter file identifies “more than 199 million active voters and 290 million U.S. consumers,” and provides its users with up to 1,800 unique data points on each identified individual.

As a result, i360 and the Kochs know your vitals, ethnicity, religion, occupation, hobbies, shopping habits, political leanings, financial assets, marital status and much more.

They know if you enjoy fishing — and if you do, whether you prefer salt or fresh water. They know if you have bladder control difficulty, get migraines or have osteoporosis. They know which advertising mediums (radio, TV, internet, email) are the most effective. For you.

i360 has the following attribute tags, among hundreds of others, ranked 1-10, or subdivided otherwise in their voter file.

Here’s an example of an i360 attribute tag and code name, using a 1-10 value scale:

But i360 attribute codes are not limited to that 1-10 scale. Their knowledge of your financial standing is granular, from how much equity you have in your home to your net wealth and expendable income.

They know where you live, what your mortgage status is and even how many bathrooms are in your house.

i360 has also created a set of 70 “clustercodes” to humanize its data for campaign operatives. These categories range from “Faded Blue Collars” to “Meandering Millennials,” and have flamboyant descriptions that correspond with their attribute headings.

Here are some examples:

Koch Persuasion Models

Additionally, i360 has developed a series of persuasion models for its voter file. These models are often regionally sensitive — since voters have regional concerns — and are being used in federal elections and down-ballot races to assist Republicans across the country.

In 2016, i360 created a set of regional models while working with Sen. Rob Portman’s 2016 re-election campaign in Ohio. Portman started out the race polling nine points behind his Democratic opponent, Gov. Ted Strickland, but ultimately won with 58 percent of the vote.

The company developed a model that could predict whether a voter supported Portman or Strickland with 89 percent accuracy, and others that predicted voter policy preferences. Well aware of the 2016 landscape, i360 also made a Trump/Clinton model, an Anti-Hillary model, and a Ticket Splitter model.

Much of i360’s success in the race, however, was linked to understanding (after conducting extensive polling) that a “key local issue facing Ohio was the opioid epidemic.” In response, the company created a “heroin model” and a “heroin treatment model” that were particularly effective at convincing voters to support Portman.

When describing how they employed their “heroin model,” i360 was clear that Portman’s “position” on the crisis depended on the voter, emphasizing health care solution communications for some, and criminal justice solution communications for others.

Here is i360 on the subject:

…the issue of opioid abuse was particularly complex in that it was relatively unknown whether it was considered a healthcare issue or a criminal justice issue. The answer to this would dictate the most effective messaging. In addition, this was a particularly personal issue affecting some voters and not others.

By leveraging two predictive models — the Heroin model identifying those constituents most likely to have been affected by the issue of opioid abuse and the Heroin Treatment model determining whether those individuals were more likely to view the issue as one of healthcare or of criminal justice — the campaign was able to effectively craft their messaging about Senator Portman’s extensive work in the Senate to be tailored to each individual according to their disposition on the topic.

This manipulation of the opioid crisis for political gain has a perverse irony given the Kochs’ long-running work to provide corporate interests, including health care and pharmaceutical interests, with undue political power and influence over public policy decisions. The Kochs have gifted over a million dollars to ALEC, for example, an organization that counts Purdue Pharma — the unconscionable manufacturer of OxyContin — as a member.

The company also stated it joined Portman’s campaign 21 months before the election, and that, “Together, i360 and the campaign strategized a plan to execute one of the most custom-targeted, integrated campaigns to date with a focus on getting the right message to the right voter wherever that might be.”

This is notable because during the 2016 election, i360 also ran $11.7 million worth of “independent” expenditures for the National Rifle Association Political Victory Fund, Freedom Partners Action Fund, and Americans for Prosperity in Portman’s race.

These outside spenders, two of which are Koch-funded groups, and Portman’s campaign all used i360 to coordinate their digital marketing, phone banks and television ad buys, in the same market, in the same election.

Additionally, i360 supplied Portman’s campaign with other issue-based models on gun control, gay marriage and abortion that the company continues to supply to its clients in 2018.

Here are some examples of i360’s issue-based models:

The list goes on, but the structure stays the same. The Kochs are tailoring their advertising to you, because they know nearly everything about you.

==

===

https://www.salon.com/2018/09/17/an-errant-screenshot-reveals-massachusetts-police-monitor-liberal-groups/

salon no lnx

A social media blunder by the Massachusetts State Police last week has raised questions around how and why the agency appeared to be monitoring liberal activist groups.

“It is indeed alarming,” Kade Crockford, director of the Technology for Liberty Program of the American Civil Liberties Union (ACLU) of Massachusetts, told Salon.

Last Thursday evening, Massachusetts State Police tweeted a screenshot in regard to a natural gas emergency that affected nearly 8,000 people around the state. The agency’s tweet was meant to display a map of responses to fires and explosions, but the uncropped screenshot showed that the police computer's browser had bookmarked a selectgroup of left-wing activists, including some police brutality watchdog groups. Facebook groups for Mass. Action Against Police Brutality (MAAPB), the Coalition to Organize and Mobilize Boston Against Trump (COMBAT); and the "Resistance Calendar," which shares upcoming anti-Trump protests across the country, were among the list of bookmarked tabs on the police computer browser.

Massachusetts State Police deleted the original tweet, and shared another one — a cropped version in which the browser bookmarks were not visible — an hour later, according to WBUR.

The agency released a statement stating they have a “responsibility to know about all large public gatherings of any type and by any group, regardless of their purpose and position, for public safety reasons.”

The statement, provided by David Procopio, Director of Media Communications, said the agency does not “collect information about -- nor, frankly, do we care about -- any group’s beliefs or opinions.”

“We, obviously, need to know if large numbers of people, for whatever reason, are going to be on public roadways or public spaces, so that we may ensure the safety and rights of those who have gathered as well as of the members of the public around them,” the statement concluded. “That is a common – and common-sense – function of any police department.”

Crockford of the American Civil Liberties Union of Massachusetts told Salon such an explanation “falls flat” for several reasons.

“Massachusetts State Police doesn’t have jurisdiction over the Commonwealth of Massachusetts,” Crockford told Salon. “Unless a protest is on a highway or at the airport or public location it is none of their business if someone is having a protest. In most areas Massachusetts State Police is not responsible for ensuring public safety, it is local police.”

“The other issue is I’d like to see a list of the groups Massachusetts State Police is monitoring for this purpose," Crockford added. "It seems strange to only monitor a few that only might have a protest someday.”

Massachusetts State Police has not responded to Salon’s repeated requests for additional details on all organizations being monitored by the agency, and whether they kept browser tabs on any right-wing activist groups.

A peculiar detail regarding the incident is that the screenshot, as mentioned by the state police’s account, was taken at the Commonwealth Fusion Center, an information-gathering center in Maynard, Massachusetts. The center, which was opened in 2005, “collects and analyzes information from all available sources to produce and disseminate actionable intelligence to stakeholders for strategic and tactical decision-making in order to disrupt domestic and international terrorism,” according to its mission statement.

“These fusion centers were created in wake of 9/11, and now there are 80 of them nationwide run by state and local law enforcement to fight terrorism, but  instead they are focused on policing left-wing political organizations, and fighting the war on drugs,” Crockford added, explaining that police viewing left-wing groups as extremists likely dates back to the Red Scare.

One of the groups bookmarked, Coalition to Organize and Mobilize Boston Against Trump (COMBAT), released a statement regarding their inclusion on Facebook.

“Though COMBAT has not met in over a year and has become an inactive campaign, its social media pages remain online,” the statement said. “The fact that state police, who are funded by our tax dollars, are spending time monitoring groups on Facebook who oppose racist, sexist, homophobic and transphobic violence instead of those groups who perpetuate such violence is abhorrent and should be examined with scrutiny.”

Tom Arabia, A former member of COMBAT, who noted he is not speaking on behalf of the organization, told Salon there is no history between COMBAT and Massachusetts State Police, but he was not surprised to see COMBAT bookmarked.

“I think they have a practical and personal interest in left-wing organizations because we have their number, so to speak... organizations like COMBAT are being vigilant about their role in generalized oppression and brutality and literally some cases how they are literally getting away with murder,” Arabia said.

...

---

==

...But political advertising, like the ads you probably scroll past in your Facebook feed, has changed drastically over the past couple of decades. Unlike TV ads, which reach voters with undifferentiated mass messages, when it comes to online political ads, campaigns actually know a TON about you. They can target you based on your age, sex, income, where you live — even if you’re a Beyoncé fan. And they can tailor their messaging to how they think you, specifically, will respond.

How do they do that?

Political advertising online is more like Spotify’s Discover Weekly playlist than a traditional television ad: It uses lots of information about what you’ve done in the past to match you to the ads that you see today. Political campaigns and advocacy groups don’t have this data themselves; they enlist the help of so-called data brokers.

Data brokers gather public information about mortgages, car ownership and marital status, as well as consumer data like your income, education and which magazines you subscribe to. With this information, they make informed guesses about your political beliefs and assign you to a profile, which they sell to political advertisers. Campaigns then show you ads they think will persuade someone like you to vote for their candidate (or against the other one).

These ads appear lots of places online. You see them on search engines like Google, social networks like Twitter and, thanks to the services of online advertising networks that connect advertisers to digital promo opportunities, nearly any website that hosts ad space.

But Facebook (chef kiss) is the crème de la crème of political ad targeting. Everything you do on Facebook is being tracked — by Facebook.

Every time you …

• Like a post
• Tag a photo
• Update your favorite movies
• Post a comment
• Visit a page with a FB share button
• Use Instagram or WhatsApp (both owned by Facebook)

… Facebook uses all this data to guess your political leanings and interests, offering you up to candidates who want to target super specific groups of people.

So, the problem is …

Online ads are are hard to track. They appear on some people’s screens (sometimes for just a few hours), while never being shown to others. There’s also no way to monitor if political campaigns are changing their messaging based on the groups they are targeting — or whether they’re sending out ads that are misleading, contradictory or false.

The Federal Election Commission has strict rules about political ads broadcast on television and radio, but those rules haven’t kept up with the new power of online targeting. They tried recently — and failed.

Basically, in online political advertising, nearly anything goes.

Perhaps you’ll recall:

• During the 2016 presidential campaign, President Donald Trump’s operatives bragged to the press that they tried to dissuade African Americans from voting by targeting them with anti-Clinton Facebook posts.
• Last spring, a year and a half after Trump was elected, Democrats on the House Intelligence Committee released thousands of Facebook and Instagram ads placed by Russian operatives to influence the 2016 election.

We don’t know the full impact of this, but with no accountability, they open the door for disinformation.

Homework: Find Out How You’re Being Targeted.

To learn more about how candidates target you on Facebook, check out how the site has categorized you. Does Facebook think you’re very liberal, very conservative or somewhere in between?

• Go to https://facebook.com/ads/preferences on your browser. (You may have to log in to Facebook first.)
• That will bring you to a page with your ad preferences. Under the “Your Information” header, click the “Your categories” tab.
• Then look for a box titled “US Politics.” In parentheses, it will show what Facebook says it knows about you (and how it sells you to advertisers), with a description like liberal, moderate or conservative. Does it match up with how you actually identify yourself?
• See what else Facebook thinks you’re interested in on this page under the “Your interests” section at the top (it has a heart icon). Political advertisers sometimes use this information to reach potential voters, too.
• In your newsfeed, click the dots at the top right corner of any Facebook ad and select “Why am I seeing this?” It will give a brief explanation about some of the choices the advertiser made in showing it to you. It may be because of the state you live in, or your age, or because Facebook thinks you’re interested in a specific political party.

Homework: See the Ads You’re NOT Seeing.

Because Facebook thinks they have you all figured out, it’s important to remember there are a lot of ads that they won’t ever show you. To learn more about what other people see, there are a few steps you can take.

1. Visit the Facebook Political Ad Collector, our searchable database designed to create more transparency in targeted online ads. It lets you step into someone else’s shoes and see the Facebook ads that they see.
2. Browse Google’s library of political ads. This summer Google published a searchable archive of political ads that have run on the platform, searchable by candidate or advertiser.

Extra Credit

While ProPublica has collected almost 53,000 political ads from more than 11,000 users for our Facebook Political Ad Collector, we want to monitor more. If you use Chrome or Firefox, you can help by downloading our browser extension, which lets us collect the ads you see.

So far the add-on has found political ads that were actually scams and malware, ads that ignored FEC rules by failing to disclose who paid for and approved them, and Ohio’s Democratic gubernatorial candidate Richard Cordray’s made-up news pages.

Important privacy note: The extension doesn’t collect any personal information about its users; we just collect the ads you see, automatically. We don’t see any of your or your friends’ posts. Learn more here.

https://www.propublica.org/article/users-guide-to-democracy-political-advertising

==

yikes, aaron headsup

The reach of these technologies is astonishingly broad: governments can listen in on cell phone calls, use voice recognition to scan mobile networks, read emails and text messages, censor web pages, track a citizen’s every movement using GPS, and can even change email contents while en route to a recipient. Some tools are installed using the same type of malicious malware and spyware used by online criminals to steal credit card and banking information. They can secretly turn on webcams built into personal laptops and microphones in cell phones not being used. And all of this information is filtered and organized on such a massive scale that it can be used to spy on every person in an entire country.

This is a phenomenon that spans the globe and implicates dozens of corporations.  Over the past year, and partly in response to the uprisings that have swept the Arab world, concerns about these exports have been amplified in media reports and by digital rights organizations, sparking a debate as to the appropriate course of action.

For example, Narus, a Boeing subsidiary, was revealed to have sold to Egypt sophisticated equipment used for surveillance. California’s BlueCoat Systems, Inc was found to have equipment being used in Syria.

Germany-based Trovicor has sold technology to a dozen Middle Eastern and North African countries, including Bahrain, dozens of activists were tortured before and after being shown transcripts of their text messages and phone conversations captured from this technology.

Cisco Systems is facing litigation in both Maryland and California based on its alleged sales of surveillance equipment to the Chinese to track, monitor and otherwise facilitate the arrest, detention, or disappearance of human rights activists and religious minorities who have been subjected to gross human rights violations.  EFF has issued a petition calling on Cisco to stop aiding China's human rights abuses.

==

mostly privacy

https://www.alternet.org/orwell-knew-heres-why-we-willingly-buy-screens-are-used-against-us

---

==

https://www.alternet.org/health-insurers-are-vacuuming-details-about-you-and-it-could-raise-your-rates

no lnx pro publ

Health Insurers Are Vacuuming Up Details About You — And It Could Raise Your Rates

Without any public scrutiny, insurers and data brokers are predicting your health costs based on data about things like race, marital status, how much TV you watch, whether you pay your bills on time or even buy plus-size clothing.

By Marshall Allen / ProPublica July 18, 2018, 4:03 AM GMT

To an outsider, the fancy booths at last month’s health insurance industry gathering in San Diego aren’t very compelling. A handful of companies pitching “lifestyle” data and salespeople touting jargony phrases like “social determinants of health.”

But dig deeper and the implications of what they’re selling might give many patients pause: A future in which everything you do — the things you buy, the food you eat, the time you spend watching TV — may help determine how much you pay for health insurance.

With little public scrutiny, the health insurance industry has joined forces with data brokers to vacuum up personal details about hundreds of millions of Americans, including, odds are, many readers of this story. The companies are tracking your race, education level, TV habits, marital status, net worth. They’re collecting what you post on social media, whether you’re behind on your bills, what you order online. Then they feed this information into complicated computer algorithms that spit out predictions about how much your health care could cost them.

Are you a woman who recently changed your name? You could be newly married and have a pricey pregnancy pending. Or maybe you’re stressed and anxious from a recent divorce. That, too, the computer models predict, may run up your medical bills.

Are you a woman who’s purchased plus-size clothing? You’re considered at risk of depression. Mental health care can be expensive.

Low-income and a minority? That means, the data brokers say, you are more likely to live in a dilapidated and dangerous neighborhood, increasing your health risks.

“We sit on oceans of data,” said Eric McCulley, director of strategic solutions for LexisNexis Risk Solutions, during a conversation at the data firm’s booth. And he isn’t apologetic about using it. “The fact is, our data is in the public domain,” he said. “We didn’t put it out there.”

Insurers contend they use the information to spot health issues in their clients — and flag them so they get services they need. And companies like LexisNexis say the data shouldn’t be used to set prices. But as a research scientist from one company told me: “I can’t say it hasn’t happened.”

At a time when every week brings a new privacy scandal and worries abound about the misuse of personal information, patient advocates and privacy scholars say the insurance industry’s data gathering runs counter to its touted, and federally required, allegiance to patients’ medical privacy. The Health Insurance Portability and Accountability Act, or HIPAA, only protects medical information.

“We have a health privacy machine that’s in crisis,” said Frank Pasquale, a professor at the University of Maryland Carey School of Law who specializes in issues related to machine learning and algorithms. “We have a law that only covers one source of health information. They are rapidly developing another source.”

Patient advocates warn that using unverified, error-prone “lifestyle” data to make medical assumptions could lead insurers to improperly price plans — for instance raising rates based on false information — or discriminate against anyone tagged as high cost. And, they say, the use of the data raises thorny questions that should be debated publicly, such as: Should a person’s rates be raised because algorithms say they are more likely to run up medical bills? Such questions would be moot in Europe, where a strict law took effect in May that bans trading in personal data.

This year, ProPublica and NPR are investigating the various tactics the health insurance industry uses to maximize its profits.Understanding these strategies is important because patients — through taxes, cash payments and insurance premiums — are the ones funding the entire health care system. Yet the industry’s bewildering web of strategies and inside deals often have little to do with patients’ needs. As the series’ first story showed, contrary to popular belief, lower bills aren’t health insurers’ top priority.

Inside the San Diego Convention Center last month, there were few qualms about the way insurance companies were mining Americans’ lives for information — or what they planned to do with the data.

The sprawling convention center was a balmy draw for one of America’s Health Insurance Plans’ marquee gatherings. Insurance executives and managers wandered through the exhibit hall, sampling chocolate-covered strawberries, champagne and other delectables designed to encourage deal-making.

Up front, the prime real estate belonged to the big guns in health data: The booths of Optum, IBM Watson Health and LexisNexisstretched toward the ceiling, with flat screen monitors and some comfy seating. (NPR collaborates with IBM Watson Health on national polls about consumer health topics.)

To understand the scope of what they were offering, consider Optum. The company, owned by the massive UnitedHealth Group, has collected the medical diagnoses, tests, prescriptions, costs and socioeconomic data of 150 million Americans going back to 1993, according to its marketing materials. (UnitedHealth Group provides financial support to NPR.) The company says it uses the information to link patients’ medical outcomes and costs to details like their level of education, net worth, family structure and race. An Optum spokesman said the socioeconomic data is de-identified and is not used for pricing health plans.

Optum’s marketing materials also boast that it now has access to even more. In 2016, the company filed a patent application to gather what people share on platforms like Facebook and Twitter, and link this material to the person’s clinical and payment information. A company spokesman said in an email that the patent application never went anywhere. But the company’s current marketing materials say it combines claims and clinical information with social media interactions.

I had a lot of questions about this and first reached out to Optum in May, but the company didn’t connect me with any of its experts as promised. At the conference, Optum salespeople said they weren’t allowed to talk to me about how the company uses this information.

It isn’t hard to understand the appeal of all this data to insurers. Merging information from data brokers with people’s clinical and payment records is a no-brainer if you overlook potential patient concerns. Electronic medical records now make it easy for insurers to analyze massive amounts of information and combine it with the personal details scooped up by data brokers.

It also makes sense given the shifts in how providers are getting paid. Doctors and hospitals have typically been paid based on the quantity of care they provide. But the industry is moving toward paying them in lump sums for caring for a patient, or for an event, like a knee surgery. In those cases, the medical providers can profit more when patients stay healthy. More money at stake means more interest in the social factors that might affect a patient’s health.

Some insurance companies are already using socioeconomic data to help patients get appropriate care, such as programs to help patients with chronic diseases stay healthy. Studies show social and economic aspects of people’s lives play an important role in their health. Knowing these personal details can help them identify those who may need help paying for medication or help getting to the doctor.

But patient advocates are skeptical health insurers have altruistic designs on people’s personal information.

The industry has a history of boosting profits by signing up healthy people and finding ways to avoid sick people — called “cherry-picking” and “lemon-dropping,” experts say. Among the classic examples: A company was accused of putting its enrollment office on the third floor of a building without an elevator, so only healthy patients could make the trek to sign up. Another tried to appeal to spry seniors by holding square dances.

The Affordable Care Act prohibits insurers from denying people coverage based on pre-existing health conditions or charging sick people more for individual or small group plans. But experts said patients’ personal information could still be used for marketing, and to assess risks and determine the prices of certain plans. And the Trump administration is promoting short-term health plans, which do allow insurers to deny coverage to sick patients.

Robert Greenwald, faculty director of Harvard Law School’s Center for Health Law and Policy Innovation, said insurance companies still cherry-pick, but now they’re subtler. The center analyzes health insurance plans to see if they discriminate. He said insurers will do things like failing to include enough information about which drugs a plan covers — which pushes sick people who need specific medications elsewhere. Or they may change the things a plan covers, or how much a patient has to pay for a type of care, after a patient has enrolled. Or, Greenwald added, they might exclude or limit certain types of providers from their networks — like those who have skill caring for patients with HIV or hepatitis C.

If there were concerns that personal data might be used to cherry-pick or lemon-drop, they weren’t raised at the conference.

At the IBM Watson Health booth, Kevin Ruane, a senior consulting scientist, told me that the company surveys 80,000 Americans a year to assess lifestyle, attitudes and behaviors that could relate to health care. Participants are asked whether they trust their doctor, have financial problems, go online, or own a Fitbit and similar questions. The responses of hundreds of adjacent households are analyzed together to identify social and economic factors for an area.

Ruane said he has used IBM Watson Health’s socioeconomic analysis to help insurance companies assess a potential market. The ACA increased the value of such assessments, experts say, because companies often don’t know the medical history of people seeking coverage. A region with too many sick people, or with patients who don’t take care of themselves, might not be worth the risk.

Ruane acknowledged that the information his company gathers may not be accurate for every person. “We talk to our clients and tell them to be careful about this,” he said. “Use it as a data insight. But it’s not necessarily a fact.”

In a separate conversation, a salesman from a different company joked about the potential for error. “God forbid you live on the wrong street these days,” he said. “You’re going to get lumped in with a lot of bad things.”

The LexisNexis booth was emblazoned with the slogan “Data. Insight. Action.” The company said it uses 442 non-medical personal attributes to predict a person’s medical costs. Its cache includes more than 78 billion records from more than 10,000 public and proprietary sources, including people’s cellphone numbers, criminal records, bankruptcies, property records, neighborhood safety and more. The information is used to predict patients’ health risks and costs in eight areas, including how often they are likely to visit emergency rooms, their total cost, their pharmacy costs, their motivation to stay healthy and their stress levels.

People who downsize their homes tend to have higher health care costs, the company says. As do those whose parents didn’t finish high school. Patients who own more valuable homes are less likely to land back in the hospital within 30 days of their discharge. The company says it has validated its scores against insurance claims and clinical data. But it won’t share its methods and hasn’t published the work in peer-reviewed journals.

McCulley, LexisNexis’ director of strategic solutions, said predictions made by the algorithms about patients are based on the combination of the personal attributes. He gave a hypothetical example: A high school dropout who had a recent income loss and doesn’t have a relative nearby might have higher than expected health costs.

But couldn’t that same type of person be healthy? I asked.

“Sure,” McCulley said, with no apparent dismay at the possibility that the predictions could be wrong.

McCulley and others at LexisNexis insist the scores are only used to help patients get the care they need and not to determine how much someone would pay for their health insurance. The company cited three different federal laws that restricted them and their clients from using the scores in that way. But privacy experts said none of the laws cited by the company bar the practice. The company backed off the assertions when I pointed that the laws did not seem to apply.

LexisNexis officials also said the company’s contracts expressly prohibit using the analysis to help price insurance plans. They would not provide a contract. But I knew that in at least one instance a company was already testing whether the scores could be used as a pricing tool.

Before the conference, I’d seen a press release announcing that the largest health actuarial firm in the world, Milliman, was now using the LexisNexis scores. I tracked down Marcos Dachary, who works in business development for Milliman. Actuaries calculate health care risks and help set the price of premiums for insurers. I asked Dachary if Milliman was using the LexisNexis scores to price health plans and he said: “There could be an opportunity.”

The scores could allow an insurance company to assess the risks posed by individual patients and make adjustments to protect themselves from losses, he said. For example, he said, the company could raise premiums, or revise contracts with providers.

It’s too early to tell whether the LexisNexis scores will actually be useful for pricing, he said. But he was excited about the possibilities. “One thing about social determinants data — it piques your mind,” he said.

Dachary acknowledged the scores could also be used to discriminate. Others, he said, have raised that concern. As much as there could be positive potential, he said, “there could also be negative potential.”

It’s that negative potential that still bothers data analyst Erin Kaufman, who left the health insurance industry in January. The 35-year-old from Atlanta had earned her doctorate in public health because she wanted to help people, but one day at Aetna, her boss told her to work with a new data set.

To her surprise, the company had obtained personal information from a data broker on millions of Americans. The data contained each person’s habits and hobbies, like whether they owned a gun, and if so, what type, she said. It included whether they had magazine subscriptions, liked to ride bikes or run marathons. It had hundreds of personal details about each person.

The Aetna data team merged the data with the information it had on patients it insured. The goal was to see how people’s personal interests and hobbies might relate to their health care costs. But Kaufman said it felt wrong: The information about the people who knitted or crocheted made her think of her grandmother. And the details about individuals who liked camping made her think of herself. What business did the insurance company have looking at this information? “It was a dataset that really dug into our clients’ lives,” she said. “No one gave anyone permission to do this.”

In a statement, Aetna said it uses consumer marketing information to supplement its claims and clinical information. The combined data helps predict the risk of repeat emergency room visits or hospital admissions. The information is used to reach out to members and help them and plays no role in pricing plans or underwriting, the statement said.

Kaufman said she had concerns about the accuracy of drawing inferences about an individual’s health from an analysis of a group of people with similar traits. Health scores generated from arrest records, home ownership and similar material may be wrong, she said.

Pam Dixon, executive director of the World Privacy Forum, a nonprofit that advocates for privacy in the digital age, shares Kaufman’s concerns. She points to a study by the analytics company SAS, which worked in 2012 with an unnamed major health insurance company to predict a person’s health care costs using 1,500 data elements, including the investments and types of cars people owned.

The SAS study said higher health care costs could be predicted by looking at things like ethnicity, watching TV and mail order purchases.

“I find that enormously offensive as a list,” Dixon said. “This is not health data. This is inferred data.”

Data scientist Cathy O’Neil said drawing conclusions about health risks on such data could lead to a bias against some poor people. It would be easy to infer they are prone to costly illnesses based on their backgrounds and living conditions, said O’Neil, author of the book “Weapons of Math Destruction,” which looked at how algorithms can increase inequality. That could lead to poor people being charged more, making it harder for them to get the care they need, she said. Employers, she said, could even decide not to hire people with data points that could indicate high medical costs in the future.

O’Neil said the companies should also measure how the scores might discriminate against the poor, sick or minorities.

American policymakers could do more to protect people’s information, experts said. In the United States, companies can harvest personal data unless a specific law bans it, although California just passed legislation that could create restrictions, said William McGeveran, a professor at the University of Minnesota Law School. Europe, in contrast, passed a strict law called the General Data Protection Regulation, which went into effect in May.

“In Europe, data protection is a constitutional right,” McGeveran said.

Pasquale, the University of Maryland law professor, said health scores should be treated like credit scores. Federal law gives people the right to know their credit scores and how they’re calculated. If people are going to be rated by whether they listen to sad songs on Spotify or look up information about AIDS online, they should know, Pasquale said. “The risk of improper use is extremely high. And data scores are not properly vetted and validated and available for scrutiny.”

As I reported this story I wondered how the data vendors might be using my personal information to score my potential health costs. So, I filled out a request on the LexisNexis website for the company to send me some of the personal information it has on me. A week later a somewhat creepy, 182-page walk down memory lane arrived in the mail. Federal law only requires the company to provide a subset of the information it collected about me. So that’s all I got.

LexisNexis had captured details about my life going back 25 years, many that I’d forgotten. It had my phone numbers going back decades and my home addresses going back to my childhood in Golden, Colorado. Each location had a field to show whether the address was “high risk.” Mine were all blank. The company also collects records of any liens and criminal activity, which, thankfully, I didn’t have.

My report was boring, which isn’t a surprise. I’ve lived a middle-class life and grown up in good neighborhoods. But it made me wonder: What if I had lived in “high risk” neighborhoods? Could that ever be used by insurers to jack up my rates — or to avoid me altogether?

I wanted to see more. If LexisNexis had health risk scores on me, I wanted to see how they were calculated and, more importantly, whether they were accurate. But the company told me that if it had calculated my scores it would have done so on behalf of their client, my insurance company. So, I couldn’t have them.

ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.

==

https://www.alternet.org/most-important-surveillance-story-you-will-see-years-report-reveals-how-att-buildings-serve-secret

jake johnson

"The most important surveillance story you will see for years just went online, revealing how AT&T became the internet's biggest enemy, secretly collaborating against its customers and partners to destroy your privacy."

That was how whistleblower and privacy advocate Edward Snowden reacted to the publication of an explosive story by The Intercept on Monday, which reveals for the first time how "fortress-like" AT&T buildings located in eight major American cities have played a central role in a massive National Security Agency (NSA) spying program "that has for years monitored billions of emails, phone calls, and online chats passing across U.S. territory."

"It's eye-opening and ominous the extent to which this is happening right here on American soil," Elizabeth Goitein, co-director of the Liberty and National Security Program at the Brennan Center for Justice, told The Intercept in an interview. "It puts a face on surveillance that we could never think of before in terms of actual buildings and actual facilities in our own cities, in our own backyards.. The Intercept's detailed report—based on a large body of evidence that includes public records, classified NSA documents, and interviews with former AT&T employees—shows how the telecom giant has willingly helped the NSA collect the data of its own customers and those of other companies, thanks to its "unique relationships with other phone and internet providers."

According to Intercept reporters Ryan Gallagher and Henrik Moltke, who bylined Monday's story, eight AT&T facilities—known as "peering sites"—in Atlanta, Chicago, Dallas, Los Angeles, New York City, San Francisco, Seattle, and Washington, D.C. "serve a specific function, processing AT&T customers' data and also carrying large quantities of data from other internet providers."

"The eight locations are featured on a top-secret NSA map, which depicts U.S. facilities that the agency relies upon for one of its largest surveillance programs, code-named FAIRVIEW," Gallagher and Moltke write. "AT&T is the only company involved in FAIRVIEW, which was first established in 1985, according to NSA documents, and involves tapping into international telecommunications cables, routers, and switches."

The report continues:

In 2003, the NSA launched new internet mass surveillance methods, which were pioneered under the FAIRVIEW program. The methods were used by the agency to collect—within a few months—some 400 billion records about people's internet communications and activity, the New York Timespreviously reported. FAIRVIEW was also forwarding more than one million emails every day to a "keyword selection system" at the NSA's Fort Meade headquarters.

Central to the internet spying are eight "peering link router complex" sites, which are pinpointed on the top-secret NSA map. The locations of the sites mirror maps of AT&T’s networks, obtained by The Intercept from public records

.

Fight for the Future (FFTF), an open internet advocacy group, reacted with alarm to The Intercept's reporting on Monday, writing on Twitter, "AT&T has bent over backwards to help the U.S. government spy on essentially all internet traffic."

"Giant telecom companies aren't just "anti-consumer," they're actively helping authoritarian governments and pushing for policies that endanger free expression," FFTF concluded.

==

==

https://www.alternet.org/how-wrestle-your-data-data-brokers-silicon-valley-and-cambridge-analytica

... certain: My personal data, and likely yours, is in more hands than ever. Tech firms, data brokers and political consultants build profiles of what they know — or think they can reasonably guess — about your purchasing habits, personality, hobbies and even what political issues you care about.

You can find out what those companies know about you but be prepared to be stubborn. Very stubborn. To demonstrate how this works, we’ve chosen a couple of representative companies from three major categories: data brokers, big tech firms and political data consultants.

Few of them make it easy. Some will show you on their websites, others will make you ask for your digital profile via the U.S. mail. And then there’s Cambridge Analytica, the controversial Trump campaign vendor that has come under intense fire in light of a report in the British newspaper The Observer and in The New York Times that the company used improperly obtained data from Facebook to help build voter profiles.

To find out what the chaps at the British data firm have on you, you’re going to need both stamps and a “cheque.”

Once you see your data, you’ll have a much better understanding of how this shadowy corner of the new economy works. You’ll see what seemingly personal information they know about you … and you’ll probably have some hypotheses about where this data is coming from. You’ll also probably see some predictions about who you are that are hilariously wrong.

And if you do obtain your data from any of these companies, please let us know your thoughts at politicaldata@propublica.org. We won’t share or publish what you say (unless you tell us that’s it’s OK).

Cambridge Analytica and Other Political Consultants

Making statistically informed guesses about Americans’ political beliefs and pet issues is a common business these days, with dozens of firms selling data to candidates and issue groups about the purported leanings of individual American voters.

Few of these firms have to give your data. But Cambridge Analytica is required to do so by an obscure European rule.

Cambridge Analytica:

Around the time of the 2016 election, Paul-Olivier Dehaye, a Belgian mathematician and founder of a website that helps people exercise their data protection rights called PersonalData.IO, approached me with an idea for a story. He flagged some of Cambridge Analytica’s claims about the power of its “psychographic” targeting capabilities and suggested that I demand my data from them.

So I sent off a request, following Dehaye’s coaching, and citing the UK Data Protection Act 1998, the British implementation of a little-known European Union data-protection law that grants individuals (even Americans) the rights to see the data Europeans companies compile about individuals.

How You Can Request Your Data From Cambridge Analytica:It worked. I got back a spreadsheet of data about me. But it took months, cost ten pounds — and I had to give them a photo ID and two utility bills. Presumably they didn’t want my personal data falling into the wrong hands.

1. Visit Cambridge Analytica’s website here and fill out this web form.
2. After you submit the form, the page will immediately request that you email to data.compliance@cambridgeanalytica.org a photo ID and two copies of your utility bills or bank statements, to prove your identity. This page will also include the company’s bank account details.
3. Find a way to send them 10 GBP. You can try wiring this from your bank, though it may cost you an additional $25 or so — or ask a friend in the UK to go to their bank and get a cashier’s check. Your American bank probably won’t let you write a GBP-denominated check. Two services I tried, Xoom and TransferWise, weren’t able to do it.
4. Eventually, Cambridge Analytica will email you a small Excel spreadsheet of information and a letter. You might have to wait a few weeks. Celeste LeCompte, ProPublica’s vice president of business development, requested her data on March 27 and still hasn’t received it.

Because the company is based in the United Kingdom, it had no choice but to fulfill my request. In recent weeks, the firm has come under intense fire after The New York Times and the British paper The Observer disclosed that it had used improperly obtained data from Facebook to build profiles of American voters. Facebook told me that data about me was likely transmitted to Cambridge Analytica because a person with whom I am “friends” on the social network had taken the now-infamous “This Is Your Digital Life” quiz. For what it’s worth, my data shows no sign of anything derived from Facebook.

What You Might Get Back From Cambridge Analytica:

Cambridge Analytica had generated 13 data points about my views: 10 political issues, ranked by importance; two guesses at my partisan leanings (one blank); and a guess at whether I would turn out in the 2016 general election.

They told me that the lower the rank, the higher the predicted importance of the issue to me.

Alongside that data labeled “models” were two other types of data that are run-of-the-mill and widely used by political consultants. One sheet of “core data” — that is, personal info, sliced and diced a few different ways, perhaps to be used more easily as parameters for a statistical model. It included my address, my electoral district, the census tract I live in and my date of birth.

The spreadsheet included a few rows of “election returns” — previous elections in New York State in which I had voted. (Intriguingly, Cambridge Analytica missed that I had voted in 2015’s snoozefest of a vote-for-five-of-these-five judicial election. It also didn’t know about elections in which I had voted in North Carolina, where I lived before I lived in New York.)

ALC Digital

ALC Digital is another data broker, which says that its info is “audiences are built from multi-sourced, verified information about an individual.” Their data is distributed via Oracle Data Cloud, a service that lets advertisers target specific audience of people — like, perhaps, people who are Boomer Voters and also Republicans.

The firm brags in an Oracle document posted online about how hard it is to avoid their data collection efforts, saying, “It has no cookies to erase and can’t be ‘cleared.’ ALC Real World Data is rooted in reality, and doesn’t rely on inferences or faulty models.”

How You Can Request Your Data From ALC Digital:

Here’s how to find the predictions about your political beliefs data in Oracle Data Cloud:

1. Visit //www.bluekai.com/registry/. If you use an ad blocker, there may not be much to see here.
2. Click on the Branded Segments tab.
3. Scroll on through until you find ALC Digital.

You may have to scroll for a while before you find it.

And not everyone appears to have data from ALC Digital, so don’t be shocked if you can’t find it. If you don’t, there may be other fascinating companies with data about who you are in your Oracle file.

What You Might Get Back From ALC Digital:

When I downloaded the data last year, it said I was “Socially Conservative,” “Boomer Voter” — as well as a female voter and a tax reform supporter.

Recently, when I checked my data, those categories had disappeared entirely from my data. I had nothing from ALC Digital.

ALC Digital is not required to release this data. It is disclosed via the Oracle Data Cloud. Fran Green, the company’s president, said that Aristotle, a longtime political data company, “provides us with consumer data that populates these audiences.” She also said that “we do not claim to know people’s ‘beliefs.’”

Big Tech

Big tech firms like Google and Facebook tend to make their money by selling ads, so they build extensive profiles of their users’ interests and activities. They also depend on their users’ goodwill to keep us voluntarily giving them our locations, our browsing histories and plain ol’ lists of our friends and interests. (So far, these popular companies have not faced much regulation.) All three make it easy to download the data that they keep on you.

Firms like Google and Facebook firms don’t sell your data — because it’s their competitive advantage. Google’s privacy page screams in 72 point type: “We do not sell your personal information to anyone.” As websites that we visit frequently, they sell access to our attention, so companies that want to reach you in particular can do so with these companies’ sites or other sites that feature their ads.

Facebook

How You Can Request Your Data From Facebook:

You of course have to have a Facebook account and be logged in:

1. Visit https://www.facebook.com/settings on your computer.
2. Click the “Download a copy of your Facebook data” link.
3. On the next page, click “Start My Archive.”
4. Enter your password, then click “Start My Archive” again.
5. You’ll get an email immediately, and another one saying “Your Facebook download is ready” when your data is ready to be downloaded. You’ll get a notification on Facebook, too. Mine took just a few minutes.
6. Once you get that email, click the link, then click Download Archive. Then reenter your password, which will start a zip file downloading..
7. Unzip the folder; depending on your computer’s operating system, this might be called uncompressing or “expanding.” You’ll get a folder called something like “facebook-jeremybmerrill,” but, of course, with your username instead of mine.
8. Open the folder and double-click “index.htm” to open it in your web browser.

What You Might Get Back From Facebook

Facebook designed its archive to first show you your profile information. That’s all information you typed into Facebook and that you probably intended to be shared with your friends. It’s no surprise that Facebook knows what city I live in or what my AIM screen name was — I told Facebook those things so that my friends would know.

But it’s a bit of a surprise that they decided to feature a list of my ex-girlfriends — what they blandly termed “Previous Relationships” — so prominently.

As you dig deeper in your archive, you’ll find more information that you gave Facebook, but that you might not have expected the social network to keep hold of for years: if you’re me, that’s the Nickelback concert I apparently RSVPed to, posts about switching high schools and instant messages from my freshman year in college.

But finally, you’ll find the creepier information: what Facebook knows about you that you didn’t tell it, on the “Ads” page. You’ll find “Ads Topics” that Facebook decided you were interested in, like Housing, ESPN or the town of Ellijay, Georgia. And, you’ll find a list of advertisers who have obtained your contact information and uploaded it to Facebook, as part of a so-called Custom Audience of specific people to whom they want to show their ads.

You’ll find more of that creepy information on your Ads Preferences page. Despite Mark Zuckerberg telling Rep. Jerry McNerney, D-Calif., in a hearing earlier this month that “all of your information is included in your ‘download your information,’” my archive didn’t include that list of ad categories that can be used to target ads to me. (Some other types of information aren’t included in the download, like other people’s posts you’ve liked. Those are listed here, along with where to find them — which, for most, is in your Activity Log.)

This area may include Facebook’s guesses about who you are, boiled down from some of your activities. Most Americans’ will have a guess about their politics — Facebook says I’m a “moderate” about US Politics — and some will have a guess about so-called “multicultural affinity,” which Facebook insists is not a guess about your ethnicity, but rather what sorts of content “you are interested in or will respond well to.” For instance, Facebook recently added that I have a “Multicultural Affinity: African American.” (I’m white — though, because Facebook’s definition of “multicultural affinity” is so strange, it’s hard to tell if this is an error on Facebook’s part.)

Facebook also doesn’t include your browsing history — the subject of back-and-forths between Mark Zuckerberg and several members of Congress — it says it keeps that just long enough to boil it down into those “Ad Topics.”

For people without Facebook accounts, Facebook says to email datarequests@support.facebook.com or fill out an online form to download what Facebook knows about you. One puzzle here is how Facebook gathers data on people whose identities it may not know. It may know that a person using a phone from Atlanta, Georgia, has accessed a Facebook site and that the same person was last week in Austin, Texas, and before that Cincinnati, but it may not know that that person is me. It’s in principle difficult for the company to give the data it collects about logged-out users if it doesn’t know exactly who they are.

Google

Like Facebook, Google will give you a zip archive of your data. Google’s can be much bigger, because you might have stored gigabytes of files in Google Drive or years of emails in Gmail.

But like Facebook, Google does not provide its guesses about your interests, which it uses to target ads. Those guesses are available elsewhere.

How You Can Request Your Data From Google:

1. Visit https://takeout.google.com/settings/takeout/ to use Google’s cutely named Takeout service.
2. You’ll have to pick which data you want to download and examine. You should definitely select My Activity, Location History and Searches. You may not want to download gigabytes of emails, if you use Gmail, since that uses a lot of space and may take a while. (That’s also information you shouldn’t be surprised that Google keeps — you left it with Gmail so that you could use Google’s search expertise to hold on to your emails. )
3. Google will present you with a few options for how to get your archive. The defaults are fine.
4. Within a few hours, you should get an email with the subject “Your Google data archive is ready.” Click Download Archive and log in again. That should start the download of a file named something like “takeout-20180412T193535.zip.”
5. Unzip the folder; depending on your computer’s operating system, this might be called uncompressing or “expanding.”
6. You’ll get a folder called Takeout. Open the file inside it called “index.html” in your web browser to explore your archive.

What You Might Get Back From Google:

Once you open the index.html file, you’ll see icons for the data you chose in step 2. Try exploring “Ads” under “My Activity” — you’ll see a list of times you saw Google Ads, including on apps on your phone.

Google also includes your search history, under “Searches” — in my case, going back to 2013. Google knows what I had forgotten: I Googled a bunch of dinosaurs around Valentine’s Day that year … And it’s not just web searches: the Sound Search history reminded me that at some point, I used that service to identify Natalie Imbruglia’s song “Torn.”

Android phone users might want to check the “Android” folder: Google keeps a list of each app you’ve used on your phone.

Most of the data contained here are records of ways you’ve directly interacted with Google — and the company really does use the those to improve how their services work for me. I’m glad to see my searches auto-completed, for instance.

But the company also creates data about you: Visit the company’s Ads Settings page to see some of the “topics” Google guesses you’re interested in, and which it uses to personalize the ads you see. Those topics are fairly general — it knows I’m interested in “Politics” — but the company says it has more granular classifications that it doesn’t include on the list. Those more granular, hidden classifications are on various topics, from sports to vacations to politics, where Google does generate a guess whether some people are politically “left-leaning” or “right-leaning.”

Data Brokers

Here’s who really does sell your data. Data brokers like the credit reporting agency Experian and a firm named Epsilon.

These sometimes-shady firms are middlemen who buy your data from tracking firms, survey marketers and retailers, slice and dice the data into “segments,” then sell those on to advertisers.

Experian

Experian is best known as a credit reporting firm, but your credit cards aren’t all they keep track of. They told me that they “firmly believe people should be made aware of how their data is being used” — so if you print and mail them a form, they’ll tell you what data they have on you.

“Educated consumers,” they said, “are better equipped to be effective, successful participants in a world that increasingly relies on the exchange of information to efficiently deliver the products and services consumers demand.”

How You Can Request Your Data From Experian:

1. Visit Experian’s Marketing Data Request site and print the Marketing Data Report Request form.
2. Print a copy of your ID and proof of address.
3. Mail it all to Experian at Experian Marketing Services PO Box 40 Allen, TX 75013
4. Wait for them to mail you something back.

What You Might Get Back From Experian:

Expect to wait a while. I’ve been waiting almost a month.

They also come up with a guess about your political views that’s integrated with Facebook — our Facebook Political Ad Collector project has found that many political candidates use Experian’s data to target their Facebook ads to likely supporters.

You should hope to find a guess about your political views that’d be useful to those candidates — as well as categories derived from your purchasing data.

Experian told me they generate the data they have about you from a long list of sources, including public records and “historical catalog purchase information” — as well as calculating it from predictive models.

Epsilon

How You Can Request Your Data From Epsilon:

1. Visit Epsilon’s Marketing Data Summary Request form.
2. After entering your name and address, Epsilon will answer some of those identity-verification questions that quiz you about your old addresses and cars. If your identity can’t be verified with those, Epsilon will ask you to mail in a form.
3. Wait for Epsilon to mail you your data; it took about a week for me.

What You Might Get Back From Epsilon:

Epsilon has information on “demographics” and “lifestyle interests” — at the household level. It also includes a list of “household purchases.”

It also has data that political candidates use to target their Facebook ads, including Randy Bryce, a Wisconsin Democrat who’s seeking his party’s nomination to run for retiring Speaker Paul Ryan’s seat, and Rep. Tulsi Gabbard, D-Hawaii.

In my case, Epsilon knows I buy clothes, books and home office supplies, among other things — but isn’t any more specific. They didn’t tell me what political beliefs they believe I hold. The company didn’t respond to a request for comment.

Oracle

Oracle’s Data Cloud aggregates data about you from Oracle, but also so-called third party data from other companies.

How You Can Request Your Data From Oracle:

1. Visit //www.bluekai.com/registry/. If you use an ad blocker, there may not be much to see here.
2. Explore each tab, from “Basic Info” to “Hobbies & Interests” and “Partner Segment.”

Not fun scrolling through all those pages? I have 84 pages of four pieces of data each.

You can’t search. All the text is actually images of text. Oracle declined to say why it chose to make their site so hard to use.

What You Might Get Back From Oracle:

My Oracle profile includes nearly 1500 data points, covering all aspects of my life, from my age to my car to how old my children are to whether I buy eggs. These profiles can even say if you’re likely to dress your pet in a costume for Halloween. But many of them are off-base or contradictory.

Many companies in Oracle’s data, besides ALC Digital, offer guesses about my political views: Data from one company uploaded by AcquireWeb says that my political affiliations are as a Democrat and an Independent … but also that I’m a “Mild Republican.” Another company, an Oracle subsidiary called AddThis, says that I’m a “Liberal.” Cuebiq, which calls itself a “location intelligence” company, says I’m in a subset of “Democrats” called “Liberal Professions.”

If an advertiser wants to show an ad to Spring Break Enthusiasts, Oracle can enable that. I’m apparently a Spring Break Enthusiast. Do I buy eggs? I sure do. Data on Oracle’s site associated with AcquireWeb says I’m a cat owner …

But it also “knows” I’m a dog owner, which I’m not.

Al Gadbut, the CEO of AcquireWeb, explained that the guesses associated with his company weren’t based on my personal data, but rather the tendencies of people in my geographical area — hence the seemingly contradictory political guesses. He said his firm doesn’t generate the data, but rather uploaded it on behalf of other companies. Cuebiq’s guess was a “probabilistic inference” they drew from location data submitted to them by some app on my phone. Valentina Marastoni-Bieser, Cuebiq’s senior vice president of marketing, wouldn’t tell me which app it was, though.

Data for sale here includes a long list what TV shows I — supposedly — watch.

But it’s not all wrong. AddThis can tell that I’m “Young & Hip.”

Takeaways:

The above list is just a sampling of the firms that collect your data and try to draw conclusions about who you are — not just sites you visit like Facebook and controversial firms like Cambridge Analytica.

You can make some guesses as to where this data comes from — especially the more granular consumer data from Oracle. For each data point, it’s worth considering: Who’d be in a position to sell a list of what TV shows I watch, or, at least, a list of what TV shows people demographically like me watch? Who’d be in a position to sell a list of what groceries I, or people similar to me in my area, buy? Some of those companies — companies who you’re likely paying, and for whom the internet adage that “if you’re not paying, you’re the product” doesn’t hold — are likely selling data about you without your knowledge. Other data points, like the location data used by Cuebiq, can come from any number of apps or websites, so it may be difficult to figure out exactly which one has passed it on.

Companies like Google and Facebook often say that they’ll let you “correct” the data that they hold on you — tacitly acknowledgingly that they sometimes get it wrong. But if receiving relevant ads is not important to you, they’ll let you opt-out entirely — or, presumably, “correct” your data to something false.

An upcoming European Union rule called the General Data Protection Regulation portends a dramatic change to how data is collected and used on the web — if only for Europeans. No such law seems likely to be passed in the U.S. in the near future.

ProPublica

---

https://www.alternet.org/internet-designed-corporations-not-people

Urban spaces are often designed to be subtly hostile to certain uses. Think about, for example, the seat partitions on bus terminal benches that make it harder for the homeless to sleep there or the decorative leaves on railings in front of office buildings and on university campuses that serve to make skateboarding dangerous.

Scholars call this “hostile urban architecture.”

When a few weeks ago, news broke that Facebook shared millions of users’ private information with Cambridge Analytica, which then used it for political purposes, I saw the parallels.

As a scholar of the social and political implications of technology, I would argue the internet is designed to be hostile to the people who use it. I call it a “hostile information architecture.”

The depth of the privacy problem

Let’s start with Facebook and privacy. Sites like Facebook supposedly protect user privacy with a practice called “notice and consent.” This practice is the business model of the internet. Sites fund their “free” services by collecting information about users and selling that information to others.

Of course, these sites present privacy policies to users to notify them how their information will be used. They ask users to “click here to accept” them. The problem is that these policies are nearly impossible to understand. As a result, no one knows what they have consented to.

But that’s not all. The problem runs deeper than that. Legal scholar Katherine Strandburg has pointed out that the entire metaphor of a market where consumers trade privacy for services is deeply flawed. It is advertisers, not users, who are Facebook’s real customers. Users have no idea what they are “paying” and have no possible way of knowing the value of their information. Users are also unable to protect themselves, as opting out of sites like Facebook and Google isn’t viable for most.

As I have argued in an academic journal, the main thing notice and consent does is subtly communicate to users the idea that their privacy is a commodity that they trade for services. It certainly does not protect their privacy. It also hurts innocent people.

Not unrelated, news broke recently that thousands of Google Play apps – probably illegally – track children. We can expect stories like this to surface again and again. The truth is there is too much money in personal information.It’s not just that most of those whose data made it to Cambridge Analytica did not consent to that transfer, but it’s also the case that Facebook has vast troves of data even on those who refuse to use its services.

Facebook’s hostile information architecture

Facebook’s privacy problem is both a symptom of its hostile information architecture and an excellent example of it.

Several years ago, two of my colleagues, Celine Latulipe and Heather Lipfordand I published an article in which we argued that many of Facebook’s privacy issues were problems of design.

Our argument was that these design elements violated ordinary people’s expectations of how information about them would travel. For example, Facebook allowed apps to collect information on users’ friends (this is why the Cambridge Analytica problem impacted so many people). But no one who signed up for, say, tennis lessons would think that the tennis club should have access to personal information about their friends.

The internet’s hostile architecture

The details have changed since then, but they aren’t better. Facebook still makes it very hard for you to control how much data it gets about you. Everything about the Facebook experience is very carefully curated. Users who don’t like it have little choice, as the site has a virtual monopoly on social networking.

Lawrence Lessig, one of the leading legal scholars of the internet, wrote a pioneering book that discussed the similarities between architecture in physical space and things like interfaces online. Both can regulate what you do in a place, as anyone who has tried to access content behind a “paywall” immediately understands.

In the present context, the idea that the internet is at least somewhat of a public space where one can meet friends, listen to music, go shopping, and get news is a complete myth.

Unless you make money by trafficking in user data, internet architecture is hostile from top to bottom. That the business model of companies like Facebook is based on targeted advertising is only part of the story. Here are some other examples of how the internet is designed by and for companies, not the public.

Consider first that the internet in the U.S. isn’t actually, in any legal sense, a public space. The hardware is all owned by telecom companies, and they have successfully lobbied 20 state legislatures to ban efforts by cities to build out public broadband.

The Federal Trade Commission has recently declared its intention to undo Obama-era net neutrality rules. The rollback, which treats the internet as a vehicle for delivering paid content, would allow ISPs like the telecom companies to deliver their own content, or paid content, faster than (or instead of) everyone else’s. So advertising could come faster, and your blog about free speech could take a very long time to load.

Copyright law gives sites like YouTube very strong legal incentives to unilaterally and automatically, without user consent, take down material that someone says is infringing, and very few incentives to restore it, even if it is legitimate. These takedown provisions include content that would be protected free speech in other contexts; both President Barack Obama and Senator John McCain campaigns had material removed from their YouTube channels in the weeks prior to the 2008 elections.

Federal requirements that content-filtering software is installed in public libraries that receive federal funding regulate the only internet the poor can access. These privately produced programs are designed to block access to pornography, but they tend to sweep up other material, particularly if it is about LGBTQ+ issues. Worse, the companies that make these programs are under no obligation to disclose how or what their software blocks.

In short, the internet has enough seat dividers and decorative leaves to be a hostile architecture. This time, though, it’s a hostile information architecture.

A broader conversation

So let’s do have a conversation about Facebook. But let’s make that part of a bigger conversation about information architecture, and how much of it should be ceded to corporate interests.

As the celebrated urban theorist and activist Jane Jacobs famously wrote, the best public spaces involve lots of side streets and unplanned interactions. Our current information architecture, like our heavily surveilled urban architecture, is going in the opposite direction.

Gordon Hull, Associate Professor of Philosophy, Director of Center for Professional and Applied Ethics, University of North Carolina – Charlotte

---

https://kpfa.org/episode/letters-and-politics-march-15-2018/

The Secret Military History of the Internet

Mitch Jeserich talks to Yasha Levine about the secret origins of the internet, tracing it back to a Pentagon counterinsurgency surveillance project. Yasha Levine is an investigative journalist for Pando Daily, a San Francisco-based news magazine focused on covering the politics and power of big tech. He is the author of the book Surveillance Valley: The Secret …

DAC domain activity? ctr oakland ~ Occupy oakland b/c shutting down port; cameras;

ggl one stop clud services, nsa, cia, fbi, dhs ggl is military contractor, offered to Oakland

==

==

https://kpfa.org/episode/upfront-october-23-2017/

3 tools/sites for pvy

Zoe Quinn, the target of the now-infamous Gamergate online harassment campaign, talks to Brian Edwards-Tiekert about what it was like to be bullied and abused online. Quinn explains the threats she faced, including threats of sexual violence, threats against her family and death threats.

http://www.crashoverridenetwork.com/

:{:{}:

}:

https://www.lastpass.com/

---

https://www.alternet.org/labor/technology-being-used-control-workers-tech-companies-freakishly-dystopian

ou’ve been fired. According to your employer’s data, your facial expressions showed you were insubordinate and not trustworthy. You also move your hands at a rate that is considered substandard. Other companies you may want to work for could receive this data, making it difficult for you to find other work in this field.

That may sound like a scenario straight out of a George Orwell novel, but it’s the future many American workers could soon be facing.

In early February, media outlets reported that Amazon had received a patent for ultrasonic wristbands that could track the movement of warehouse workers’ hands during their shifts. If workers’ hands began moving in the wrong direction, the wristband would buzz, issuing an electronic corrective. If employed, this technology could easily be used to further surveil employees who already work under intense supervision.

Whole Foods, which is now owned by Amazon, recently instituted a complex and punitive inventory system where employees are graded based on everything from how quickly and effectively they stock shelves to how they report theft. The system is so harsh it reportedly causes employees enough stress to bring them to tears on a regular basis.

UPS drivers, who often operate individually on the road, are now becoming increasingly surveilled. Sensors in every UPS truck track when drivers’ seatbelts are put on, when doors open and close and when the engines start in order to monitor employee productivity at all times.

The technology company Steelcase has experimented with monitoring employees’ faces to judge their expressions. The company claims that this innovation, which monitors and analyzes workers’ facial movements throughout the work day, is being used for research and to inform best practices on the job. Other companies are also taking interest in this kind of mood-observing technology, from Bank of America to Cubist Pharmaceuticals Inc.

These developments are part of a larger trend of workers being watched and judged—often at jobs that offer low pay and demand long hours. Beyond simply tracking worker performance, it is becoming more common for companies to monitor the emails and phone calls their employees make, analyzing personal traits along with output.

Some companies are now using monitoring techniques—referred to as “people analytics”—to learn as much as they can about you, from your communication patterns to what types of websites you visit to how often you use the bathroom. This type of privacy invasion can cause employees immense stress, as they work with the constant knowledge that their boss is aware of their every behavior—and able to use that against them as they see fit.

Lewis Maltby, president of the National Workrights Institute at Cornell University, tells In These Times that the level of surveillance workers are facing is increasing exponentially.

...

==

https://cup.columbia.edu/book/creditworthy/9780231168083

Creditworthy

A History of Consumer Surveillance and Financial Identity in America

Josh Lauer

Columbia University Press

==

https://www.alternet.org/news-amp-politics/tinders-data-more-treasure-trove-selfies

==

https://www.nrdc.org/experts/john-walke/political-vendetta-against-health-safeguards-founded-shocking-falsehoods

Political Vendetta Against Health Safeguards Founded on Shocking Falsehoods

August 01, 2013 John Walke 

:{:{}:

Some Congressional Republicans have mounted a feverish campaign against long-established science showing a clear causal association between fine soot pollution (PM2.5) and premature death. Their all-too-transparent agenda is to attack clean air health safeguards that are projected to save tens of thousands of lives and avoid hundreds of thousands of asthma attacks and heart attacks annually, while delivering health benefits to Americans that outweigh costs to polluters by tens of billions of dollars. Republicans have failed in numerous prior attempts to eliminate these safeguards legislatively.

So now they have revived and ramped up a political tactic from the late 1990's that already has been discredited, when Republicans and industry lobbyists unsuccessfully challenged EPA's 1997 smog and soot standards. (Query: where were Republican members of Congress with their indignation and assaults when the George W. Bush administration relied upon these same studies and science for 8 years?)

Congressman Lamar Smith (R-TX ) has vowed to subpoena EPA to seize confidential patient data underlying a subset of the medical studies showing this soot-death linkage. Smith took to the pages of the Wall Street Journalthis week to level a fusillade of charges against EPA that was as notable for its cascade of misrepresentations and omitted facts, as it was for its vehemence.

}:

==

https://www.c-span.org/video/?431356-2/darkening-web

JULY 17, 2017

The Darkening Web

Alexander Klimburg talked about his book The Darkening Web: The War for Cyberspace, in which he looks at current cyber attacks and the consequences of cyber warfare on politics. He was joined in discussion by several industry experts.

---

omfg:

Bruce Lund, a senior member of In-Q-Tel’s technical staff, noted in a 2012 paper that “monitoring social media” is increasingly essential for government agencies seeking to keep track of “erupting political movements, crises, epidemics, and disasters, not to mention general global trends.”

The recent wave of investments in social media-related companies suggests the CIA has accelerated the drive to make collection of user-generated online data a priority. Alongside its investments in start-ups, In-Q-Tel has also developed a special technology laboratory in Silicon Valley, called Lab41, to provide tools for the intelligence community to in large sets of data.

In February, Lab41 published an article exploring the ways in which a Twitter user’s location could be predicted with a degree of certainty through the location of the user’s friends. On Github, an open source website for developers, Lab41 currently has a project to ascertain the “feasibility of using architectures such as Convolutional and Recurrent Neural Networks to classify the positive, negative, or neutral sentiment of Twitter messages towards a specific topic.”

Collecting intelligence on foreign adversaries has potential benefits for counterterrorism, but such CIA-supported surveillance technology is also used for domestic law enforcement and by the private sector to spy on activist groups.

Palantir, one of In-Q-Tel’s earliest investments in the social media analytics realm, was exposed in 2011 by the hacker group LulzSec to be in negotiationfor a proposal to track labor union activists and other critics of the U.S. Chamber of Commerce, the largest business lobbying group in Washington. The company, now celebrated as a “tech unicorn” — a term for start-ups that reach over $1 billion in valuation — distanced itself from the plan after it was exposed in a cache of leaked emails from the now-defunct firm HBGary Federal.

:{:{}:

Lee Guthman, an executive at Geofeedia,toldreporter John Knefel that his company could predict the potential for violence at Black Lives Matter protests just by using the location and sentiment of tweets. Guthman said the technology could gauge sentiment by attaching “positive and negative points” to certain phrases, while measuring “proximity of words to certain words.”Yet other In-Q-Tel-backed companies are now openly embracing the practice. Geofeedia, for instance, promotes its research into Greenpeace activists, student demonstrations, minimum wage advocates, and other political movements. Police departments in Oakland, Chicago, Detroit, and other major municipalities have contracted with Geofeedia, as well as private firms such as the Mall of America and McDonald’s.}:

Privacy advocates, however, have expressed concern about these sorts of automated judgments.

“When you have private companies deciding which algorithms get you a so-called threat score, or make you a person of interest, there’s obviously room for targeting people based on viewpoints or even unlawfully targeting people based on race or religion,” said Lee Rowland, a senior staff attorney with the American Civil Liberties Union.

She added that there is a dangerous trend toward government relying on tech companies to “build massive dossiers on people” using “nothing but constitutionally protected speech.”

Related:

CIA’s Venture Capital Arm Is Funding Skin Care Products That Collect DNA

---

---

THESE DAYS IT seems like every government has a far-reaching and well-developed digital surveillance operation, complete with defense, international espionage, and offensive components. Smaller nations even join spy alliances to pool resources. But there are still many nation-states that for various reasons prefer not to handle their cyber intelligence development in-house. So they do what we all do when we need software: They buy it from a vendor.

On Thursday, researchers published evidence that an established private cyberarms dealer called NSO Group, whose clientele primarily comprises governments, has been selling masterful spyware that is delivered to mobile devices through a series of critical vulnerabilities in Apple's iOS mobile operating system. Once established on a device, this tool, known as Pegasus, can surveil virtually anything, relaying phone calls, messages, emails, calendar data, contacts, keystrokes, audio and video feeds, and more back to whomever is controlling the attack. Apple says it has fully patched the three vulnerabilities, collectively called Trident, as part of today's iOS 9.3.5 update.

"This is the first time any security researchers, as far as any of us are aware, have ever gotten a copy of NSO Group's spyware and been able to reverse engineer it," says Mike Murray, vice president of Lookout, the security research firm that discovered the spyware along with the Citizen Lab at the University of Toronto's Munk School of Global Affairs. "They are a really sophisticated threat actor and the software they have reflects that. They are incredibly committed to stealth."

Citizen Lab stumbled upon Trident and Pegasus after prominent human rights activist Ahmed Mansoor sent the group some suspicious SMS text messages he had received on his iPhone 6. Mansoor, who is based in the United Arab Emirates, has been targeted by lawful intercept surveillance software before, and Citizen Lab worked with him when his devices were compromised by FinFisher’s FinSpy malware in 2011, and Hacking Team’s Remote Control System in 2012. FinSpy and Hacking Team are similar businesses to NSO Group, selling spy tools to governments (potentially including oppressive regimes) for a premium.

"As a human rights defender in a country that considers such a thing as a threat, an enemy or traitor, I have to be more careful than the average person," says Mansoor. "Nothing is surprising to me." Masoor received two phishing texts messages, one on August 10 and the other on August 11. His iPhone was running the latest version of iOS at the time. Both messages read "New secrets about torture of Emiratis in state prisons," and offered a link to see more information. "Such content was enough to trigger all the red flags with me," Mansoor says.

He sent screenshots of the texts and the URL to Citizen Lab, where senior researchers Bill Marczak and John Scott-Railton used a stock factory­-reset iPhone 5 running iOS 9.3.3, like Mansoor's, to load the URL. All they saw was Apple's Safari browser opening to a blank page and then closing about 10 seconds later. After monitoring data the phone subsequently sent and received over the Internet, though, as well as the Web servers it was connecting to, the team started piecing together both how the attack works, and its origin. They recognized some features from other research they had been doing into cyber attacks targeting dissidents in the UAE. They also contacted Lookout for additional technical analysis.

The cascade of exploits begins by taking advantage of a vulnerability in Safari's WebKit, the engine the browser uses to layout and render web pages. This then triggers a second stage, where the attack uses a bug in the protections surrounding the kernel (the core program in an operating system that controls all systems) to access the kernel, initiating the third and final stage of the attack, which exploits the kernel itself and jailbreaks the phone.

Jailbreaking an iPhone gives root access, which means that a user can make whatever changes he or she wants to a device. People sometimes jailbreak their phones intentionally so they can customize their user experience beyond what Apple will allow, but in this case the jailbreak was used to give a remote party access to the devices contents and activity.

Jon Clay, a cybersecurity and threat expert for Trend Micro, says that utilizing multiple exploits in an attack is common for most platforms. But since relatively few vulnerabilities are found in iOS to begin with (compared to platforms like Windows) it would be unique to see an attack sequencing multiple exploits. Notably, a group of hackers claimed a $1 million rewardlast year from the security startup Zerodium for delivering a remotely executable jailbreak for iOS.

When Citizen Lab and Lookout brought their findings to Apple, the company patched the bugs within 10 days. Apple said in a statement that, "We were made aware of this vulnerability and immediately fixed it with iOS 9.3.5. We advise all of our customers to always download the latest version of iOS to protect themselves against potential security exploits."

NSO Group won't be able to use this particular attack anymore on iPhones running the latest version of iOS—and one of the operating system's strongest selling points is its high adoption rates for new versions. In the meantime, the Citizen Lab and Lookout researchers say that there is evidence that the group has ways to get Pegasus spyware onto other mobile operating systems, notably Android. Additionally, though Trident is a particularly elegant attack, NSO Group could have other strategies for delivering Pegasus to iOS devices.

The revelation that an iOS zero-day vulnerability has been up for sale also bolsters Apple's case that law enforcement agencies like the FBI should not be able to force the company to create special access to its devices. Exploits already exist, and creating new ones only adds more risk.

Little is known about the Israel-based NSO Group, by design. Its LinkedIn profile says that it was founded in 2010 and has between 201 and 500 employees, but the company doesn't maintain a website or post any other information. NSO Group's nation state clientele includes governments like Mexico, which was reported to use its services in 2014 and seems to be an ongoing customer according to Citizen Lab and Lookout's findings. Last fall, Bloomberg estimated the company's annual earnings at $75 million, with its sophisticated exploits presumably commanding a hefty sum. The kind that governments can afford.

"One thing about NSO is that like Hacking Team and FinFisher, they represent themselves as selling lawful intercept tools exclusively to government," says Citizen Lab Senior Researcher John Scott-Railton. "So that has the interesting feature that when you find it you can assume that you’re probably looking at a government actor.”

Meanwhile, even though this vulnerability has been patched, the next one likely won't be far behind, especially given NSO's seemingly advanced infrastructure.

"How many people are walking around with three Apple zero days in their pocket? Not very many," says Murray of Lookout. "We see evidence of [NSO Group] having their own internal quality assurance organization. We see debugging calls—it looks like professional, enterprise-grade software. They have a full software development organization just like any enterprise software company."

When their next release is ready, it seems likely that governments will be eager to buy.

---

https://www.democracynow.org/2017/7/10/headlines/nyt_mexican_govt_surveilled_international_investigators_probing_ayotzinapa_case

The New York Times is reporting that the Mexican government used an Israeli-made spy software to surveila team of international investigators who had been dispatched to Mexico to investigate the high-profile disappearance of 43 students at the Ayotzinapa teachers’ college in Guerrero in 2014. The international investigators included some of Latin America’s most prominent lawyers, who had been granted a form of diplomatic immunity to carry out their investigation. The Times has also reported the Mexican government also used the spying software called Pegasus to spy on Mexican human rights activists and journalists.

---

---

guard uk no links (many)

gXardian.com/politics/2017/feb/26/robert-mercer-breitbart-war-on-media-steve-bannon-donald-trump-nigel-farage

Mercer: the big data billionaire waging war on mainstream media

With links to Donald Trump, Steve Bannon and Nigel Farage, the rightwing US computer scientist is at the heart of a multimillion-dollar propaganda network

Carole Cadwalladr

Sunday 26 February 2017

This article is the subject of a legal complaint on behalf of Cambridge Analytica LLC and SCL Elections Limited.

Just over a week ago, Donald Trump gathered members of the world’s press before him and told them they were liars. “The press, honestly, is out of control,” he said. “The public doesn’t believe you any more.” CNN was described as “very fake news… story after story is bad”. The BBC was “another beauty”.

That night I did two things. First, I typed “Trump” in the search box of Twitter. My feed was reporting that he was crazy, a lunatic, a raving madman. But that wasn’t how it was playing out elsewhere. The results produced a stream of “Go Donald!!!!”, and “You show ’em!!!” There were star-spangled banner emojis and thumbs-up emojis and clips of Trump laying into the “FAKE news MSM liars!”

Trump had spoken, and his audience had heard him. Then I did what I’ve been doing for two and a half months now. I Googled “mainstream media is…” And there it was. Google’s autocomplete suggestions: “mainstream media is… dead, dying, fake news, fake, finished”. Is it dead, I wonder? Has FAKE news won? Are we now the FAKE news? Is the mainstream media – we, us, I – dying?

It leads to a website called CNSnews.com and an article: “The Mainstream media are dead.” They’re dead, I learn, because they – we, I – “cannot be trusted”. How had it, an obscure site I’d never heard of, dominated Google’s search algorithm on the topic? In the “About us” tab, I learn CNSnews is owned by the Media Research Center, which a click later I learn is “America’s media watchdog”, an organisation that claims an “unwavering commitment to neutralising leftwing bias in the news, media and popular culture”.

Another couple of clicks and I discover that it receives a large bulk of its funding – more than $10m in the past decade – from a single source, the hedge fund billionaire Robert Mercer. If you follow US politics you may recognise the name. Robert Mercer is the money behind Donald Trump. But then, I will come to learn, Robert Mercer is the money behind an awful lot of things. He was Trump’s single biggest donor. Mercer started backing Ted Cruz, but when he fell out of the presidential race he threw his money – $13.5m of it – behind the Trump campaign.

It’s money he’s made as a result of his career as a brilliant but reclusive computer scientist. He started his career at IBM, where he made what the Association for Computational Linguistics called “revolutionary” breakthroughs in language processing – a science that went on to be key in developing today’s AI – and later became joint CEO of Renaissance Technologies, a hedge fund that makes its money by using algorithms to model and trade on the financial markets.

One of its funds, Medallion, which manages only its employees’ money, is the most successful in the world – generating $55bn so far. And since 2010, Mercer has donated $45m to different political campaigns – all Republican – and another $50m to non-profits – all rightwing, ultra-conservative. This is a billionaire who is, as billionaires are wont, trying to reshape the world according to his personal beliefs.

Donald Trump’s presidential campaigned received $13.5m from Robert Mercer.

Robert Mercer very rarely speaks in public and never to journalists, so to gauge his beliefs you have to look at where he channels his money: a series of yachts, all called Sea Owl;a $2.9m model train set; climate change denial (he funds a climate change denial thinktank, the Heartland Institute); and what is maybe the ultimate rich man’s plaything – the disruption of the mainstream media. In this he is helped by his close associate Steve Bannon, Trump’s campaign manager and now chief strategist. The money he gives to the Media Research Center, with its mission of correcting “liberal bias” is just one of his media plays. There are other bigger, and even more deliberate strategies, and shining brightly, the star at the centre of the Mercer media galaxy, is Breitbart.

It was $10m of Mercer’s money that enabled Bannon to fund Breitbart – a rightwing news site, set up with the express intention of being a Huffington Post for the right. It has launched the careers of Milo Yiannopoulos and his like, regularly hosts antisemitic and Islamophobic views, and is currently being boycotted by more than 1,000 brands after an activist campaign. It has been phenomenally successful: the 29th most popular site in America with 2bn page views a year. It’s bigger than its inspiration, the Huffington Post, bigger, even, than PornHub. It’s the biggest political site on Facebook. The biggest on Twitter.

Prominent rightwing journalist Andrew Breitbart, who founded the site but died in 2012, told Bannon that they had “to take back the culture”. And, arguably, they have, though American culture is only the start of it. In 2014, Bannon launched Breitbart London, telling the New York Times it was specifically timed ahead of the UK’s forthcoming election. It was, he said, the latest front “in our current cultural and political war”. France and Germany are next.

A determined plutocrat and a brilliant media strategist can, and have, found a way to mould journalism to their own ends

But there was another reason why I recognised Robert Mercer’s name: because of his connection to Cambridge Analytica, a small data analytics company. He is reported to have a $10m stake in the company, which was spun out of a bigger British company called SCL Group. It specialises in “election management strategies” and “messaging and information operations”, refined over 25 years in places like Afghanistan and Pakistan. In military circles this is known as “psyops” – psychological operations. (Mass propaganda that works by acting on people’s emotions.)

Cambridge Analytica worked for the Trump campaign and, so I’d read, the Leave campaign. When Mercer supported Cruz, Cambridge Analytica worked with Cruz. When Robert Mercer started supporting Trump, Cambridge Analytica came too. And where Mercer’s money is, Steve Bannon is usually close by: it was reported that until recently he had a seat on the board.

Last December, I wrote about Cambridge Analytica in a piece about howGoogle’s search results on certain subjects were being dominated by rightwing and extremist sites. Jonathan Albright, a professor of communications at Elon University, North Carolina, who had mapped the news ecosystem and found millions of links between rightwing sites “strangling” the mainstream media, told me that trackers from sites like Breitbart could also be used by companies like Cambridge Analytica to follow people around the web and then, via Facebook, target them with ads.

On its website,Cambridge Analytica makes the astonishing boast that it has psychological profiles based on 5,000 separate pieces of data on 220 million American voters – its USP is to use this data to understand people’s deepest emotions and then target them accordingly. The system, according to Albright, amounted to a “propaganda machine”.

A few weeks later, the Observer received a letter. Cambridge Analytica was not employed by the Leave campaign, it said. Cambridge Analytica “is a US company based in the US. It hasn’t worked in British politics.”

Which is how, earlier this week, I ended up in a Pret a Manger near Westminster with Andy Wigmore, Leave.EU’s affable communications director, looking at snapshots of Donald Trump on his phone. It was Wigmore who orchestrated Nigel Farage’s trip to Trump Tower – the PR coup that saw him become the first foreign politician to meet the president elect.

Wigmore scrolls through the snaps on his phone. “That’s the one I took,” he says pointing at the now globally famous photo of Farage and Trump in front of his golden elevator door giving the thumbs-up sign. Wigmore was one of the “bad boys of Brexit” – a term coined by Arron Banks, the Bristol-based businessman who was Leave.EU’s co-founder.

Cambridge Analytica had worked for them, he said. It had taught them how to build profiles, how to target people and how to scoop up masses of data from people’s Facebook profiles. A video on YouTube shows one of Cambridge Analytica’s and SCL’s employees, Brittany Kaiser, sitting on the panel at Leave.EU’s launch event.

Facebook was the key to the entire campaign, Wigmore explained. A Facebook ‘like’, he said, was their most “potent weapon”. “Because using artificial intelligence, as we did, tells you all sorts of things about that individual and how to convince them with what sort of advert. And you knew there would also be other people in their network who liked what they liked, so you could spread. And then you follow them. The computer never stops learning and it never stops monitoring.”

It sounds creepy, I say.

“It is creepy! It’s really creepy! It’s why I’m not on Facebook! I tried it on myself to see what information it had on me and I was like, ‘Oh my God!’ What’s scary is that my kids had put things on Instagram and it picked that up. It knew where my kids went to school.”

They hadn’t “employed” Cambridge Analytica, he said. No money changed hands. “They were happy to help.”

Why?

“Because Nigel is a good friend of the Mercers. And Robert Mercer introduced them to us.He said, ‘Here’s this company we think may be useful to you.’ What they were trying to do in the US and what we were trying to do had massive parallels. We shared a lot of information. Why wouldn’t you?” Behind Trump’s campaign and Cambridge Analytica, he said, were “the same people. It’s the same family.”

There were already a lot of questions swirling around Cambridge Analytica, and Andy Wigmore has opened up a whole lot more. Such as: are you supposed to declare services-in-kind as some sort of donation? The Electoral Commission says yes, if it was more than £7,500. And was it declared? The Electoral Commission says no. Does that mean a foreign billionaire had possibly influenced the referendum without that influence being apparent? It’s certainly a question worth asking.

In the last month or so, articles in first the Swiss and the US press have asked exactly what Cambridge Analytica is doing with US voters’ data. In a statement to the Observer, the Information Commissioner’s Office said: “Any business collecting and using personal data in the UK must do so fairly and lawfully. We will be contacting Cambridge Analytica and asking questions to find out how the company is operating in the UK and whether the law is being followed.”

Cambridge Analytica said last Friday they are in touch with the ICO and are completely compliant with UK and EU data laws. It did not answer other questions the Observer put to it this week about how it built its psychometric model, which owes its origins to original research carried out by scientists at Cambridge University’s Psychometric Centre, research based on a personality quiz on Facebook that went viral. More than 6 million people ended up doing it, producing an astonishing treasure trove of data.

These Facebook profiles – especially people’s “likes” – could be correlated across millions of others to produce uncannily accurate results. Michal Kosinski, the centre’s lead scientist,found that with knowledge of 150 likes, their model could predict someone’s personality better than their spouse. With 300, it understood you better than yourself. “Computers see us in a more robust way than we see ourselves,” says Kosinski.

But there are strict ethical regulations regarding what you can do with this data. Did SCL Group have access to the university’s model or data, I ask Professor Jonathan Rust, the centre’s director? “Certainly not from us,” he says. “We have very strict rules around this.”

A scientist, Aleksandr Kogan, from the centre was contracted to build a model for SCL, and says he collected his own data. Professor Rust says he doesn’t know where Kogan’s data came from. “The evidence was contrary. I reported it.” An independent adjudicator was appointed by the university. “But then Kogan said he’d signed a non-disclosure agreement with SCL and he couldn’t continue [answering questions].”

Kogan disputes this and says SCL satisfied the university’s inquiries. But perhaps more than anyone,Professor Rust understands how the kind of information people freely give up to social media sites could be used.

“The danger of not having regulation around the sort of data you can get from Facebook and elsewhere is clear. With this, a computer can actually do psychology, it can predict and potentially control human behaviour. It’s what the scientologists try to do but much more powerful. It’s how you brainwash someone. It’s incredibly dangerous.

“It’s no exaggeration to say that minds can be changed. Behaviour can be predicted and controlled. I find it incredibly scary. I really do. Because nobody has really followed through on the possible consequences of all this. People don’t know it’s happening to them. Their attitudes are being changed behind their backs.”

Mercer invested in Cambridge Analytica, the Washington Post reported, “driven in part by an assessment that the right was lacking sophisticated technology capabilities”. But in many ways, it’s what Cambridge Analytica’s parent company does that raises even more questions.

Emma Briant, a propaganda specialist at the University of Sheffield, wrote about SCL Group in her 2015 book, Propaganda and Counter-Terrorism: Strategies for Global Change. Cambridge Analytica has the technological tools to effect behavioural and psychological change, she said, but it’sSCL that strategises it. It has specialised, at the highest level – for Nato, the MoD, the US state department and others – in changing the behaviour of large groups. It models mass populations and then it changes their beliefs.

SCL was founded by someone called Nigel Oakes, who worked for Saatchi & Saatchi on Margaret Thatcher’s image, says Briant, and the company had been “making money out of the propaganda side of the war on terrorism over a long period of time. There are different arms of SCL but it’s all about reach and the ability to shape the discourse. They are trying to amplify particular political narratives. And they are selective in who they go for: they are not doing this for the left.”

In the course of the US election, Cambridge Analytica amassed a database, as it claims on its website, of almost the entire US voting population – 220 million people – and the Washington Post reported last week thatSCL was increasing staffing at its Washington office and competing for lucrative new contracts with Trump’s administration. “It seems significant that a company involved in engineering a political outcome profits from what follows. Particularly if it’s the manipulation, and then resolution, of fear,” says Briant.

It’s the database, and what may happen to it, that particularly exercises Paul-Olivier Dehaye, a Swiss mathematician and data activist who has been investigating Cambridge Analytica and SCL for more than a year. “How is it going to be used?” he says. “Is it going to be used to try and manipulate people around domestic policies? Or to ferment conflict between different communities? It is potentially very scary. People just don’t understand the power of this data and how it can be used against them.”

There are two things, potentially, going on simultaneously: the manipulation of information on a mass level, and the manipulation of information at a very individual level. Both based on the latest understandings in science about how people work, and enabled by technological platforms built to bring us together.

Are we living in a new era of propaganda, I ask Emma Briant? One we can’t see, and that is working on us in ways we can’t understand? Where we can only react, emotionally, to its messages? “Definitely. The way that surveillance through technology is so pervasive, the collection and use of our data is so much more sophisticated. It’s totally covert. And people don’t realise what is going on.”

Public mood and politics goes through cycles. You don’t have to subscribe to any conspiracy theory, Briant says, to see that a mass change in public sentiment is happening. Or that some of the tools in action are straight out of the military’s or SCL’s playbook.

But then there’s increasing evidence that our public arenas – the social media sites where we post our holiday snaps or make comments about the news – are a new battlefield where international geopolitics is playing out in real time. It’s a new age of propaganda. But whose? This week, Russia announced the formation of a new branch of the military: “information warfare troops”.

Sam Woolley of the Oxford Internet Institute’s computational propaganda institute tells me that one third of all traffic on Twitter before the EU referendum was automated “bots” – accounts that are programmed to look like people, to act like people, and to change the conversation, to make topics trend. And they were all for Leave. Before the US election, they were five-to-one in favour of Trump – many of them Russian. Last week they have been in action in the Stoke byelection – Russian bots, organised by who? – attacking Paul Nuttall.

You can take a trending topic, such as fake news, and then weaponise it, turn it against the media that uncovered it

“Politics is war,” said Steve Bannon last year in the Wall Street Journal. And increasingly this looks to be true.

There’s nothing accidental about Trump’s behaviour, Andy Wigmore tells me. “That press conference. It was absolutely brilliant. I could see exactly what he was doing. There’s feedback going on constantly. That’s what you can do with artificial intelligence. You can measure ever reaction to every word. He has a word room, where you fix key words. We did it. So with immigration, there are actually key words within that subject matter which people are concerned about. So when you are going to make a speech, it’s all about how can you use these trending words.”

Wigmore met with Trump’s team right at the start of the Leave campaign. “And they said the holy grail was artificial intelligence.”

Who did?

“Jared Kushner and Jason Miller.”

Later, when Trump picked up Mercer and Cambridge Analytica, the game changed again. “It’s all about the emotions. This is the big difference with what we did. They call it bio-psycho-social profiling. It takes your physical, mental and lifestyle attributes and works out how people work, how they react emotionally.”

Bio-psycho-social profiling, I read later, is one offensive in what is called “cognitive warfare”. Though there are many others: “recoding the mass consciousness to turn patriotism into collaborationism,” explains a Nato briefing document on countering Russian disinformation written by an SCL employee. “Time-sensitive professional use of media to propagate narratives,” says one US state department white paper. “Of particular importance to psyop personnel may be publicly and commercially available data from social media platforms.”

Yet another details the power of a “cognitive casualty” – a “moral shock” that “has a disabling effect on empathy and higher processes such as moral reasoning and critical thinking”. Something like immigration, perhaps. Or “fake news”. Or as it has now become: “FAKE news!!!!”

How do you change the way a nation thinks? You could start by creating a mainstream media to replace the existing one with a site such as Breitbart. You could set up other websites that displace mainstream sources of news and information with your own definitions of concepts like “liberal media bias”, like CNSnews.com. And you could give the rump mainstream media, papers like the “failing New York Times!” what it wants: stories. Because the third prong of Mercer and Bannon’s media empire is the Government Accountability Institute.

Bannon co-founded it with $2m of Mercer’s money. Mercer’s daughter, Rebekah, was appointed to the board. Then they invested in expensive, long-term investigative journalism. “The modern economics of the newsroom don’t support big investigative reporting staffs,” Bannon told Forbes magazine. “You wouldn’t get a Watergate, a Pentagon Papers today, because nobody can afford to let a reporter spend seven months on a story. We can. We’re working as a support function.”

Welcome to the future of journalism in the age of platform capitalism. News organisations have to do a better job of creating new financial models. But in the gaps in between, a determined plutocrat and a brilliant media strategist can, and have, found a way to mould journalism to their own ends.

In 2015, Steve Bannon described to Forbes how theGAI operated, employing a data scientist to trawl the dark web (in the article he boasts of having access to $1.3bn worth of supercomputers) to dig up the kind of source material Google can’t find. One result has been a New York Times bestseller, Clinton Cash: The Untold Story of How and Why Foreign Governments and Businesses Helped Make Bill and Hillary Rich, written by GAI’s president, Peter Schweizer and later turned into a film produced by Rebekah Mercer and Steve Bannon.

This, Bannon explained, is how you “weaponise” the narrative you want. With hard researched facts. With those, you can launch it straight on to the front page of the New York Times, as the story of Hillary Clinton’s cash did.Like Hillary’s emails it turned the news agenda, and, most crucially, it diverted the attention of the news cycle. Another classic psyops approach. “Strategic drowning” of other messages.

This is a strategic, long-term and really quite brilliant play. In the 1990s, Bannon explained, conservative media couldn’t take Bill Clinton down because “they wound up talking to themselves in an echo chamber”.

As, it turns out, the liberal media is now. We are scattered, separate, squabbling among ourselves and being picked off like targets in a shooting gallery. Increasingly, there’s a sense that we are talking to ourselves. And whether it’s Mercer’s millions or other factors,Jonathan Albright’s map of the news and information ecosystem shows how rightwing sites are dominating sites like YouTube and Google, bound tightly together by millions of links.

Is there a central intelligence to that, I ask Albright? “There has to be. There has to be some type of coordination. You can see from looking at the map, from the architecture of the system, that this is not accidental. It’s clearly being led by money and politics.”

There’s been a lot of talk in the echo chamber about Bannon in the last few months, but it’s Mercer who provided the money to remake parts of the media landscape. And while Bannon understands the media, Mercer understands big data. He understands the structure of the internet. He knows how algorithms work.

Robert Mercer did not respond to a request for comment for this piece. Nick Patterson, a British cryptographer, who worked at Renaissance Technologies in the 80s and is now a computational geneticist at MIT, described to me how he was the one who talent-spotted Mercer. “There was an elite group working at IBM in the 1980s doing speech research, speech recognition, and when I joined Renaissance I judged that the mathematics we were trying to apply to financial markets were very similar.”

Play VideoPlay

Bannon scorns media in rare public appearance at CPAC

He describes Mercer as “very, very conservative. He truly did not like the Clintons. He thought Bill Clinton was a criminal. And his basic politics, I think, was that he’s a rightwing libertarian, he wants the government out of things.”

He suspects that Mercer is bringing the brilliant computational skills he brought to finance to bear on another very different sphere. “We make mathematical models of the financial markets which are probability models, and from those we try and make predictions. What I suspect Cambridge Analytica do is that they build probability models of how people vote. And then they look at what they can do to influence that.”

Finding the edge is what quants do. They build quantitative models that automate the process of buying and selling shares and then they chase tiny gaps in knowledge to create huge wins. Renaissance Technologies was one of the first hedge funds to invest in AI. But what it does with it, how it’s been programmed to do it, is completely unknown. It is, Bloomberg reports, the “blackest box in finance”.

Johan Bollen, associate professor at Indiana University School of Informatics and Computing, tells me how he discovered one possible edge: he’s done research that shows you can predict stock market moves from Twitter. You can measure public sentiment and then model it. “Society is driven by emotions, which it’s always been difficult to measure, collectively. But there are now programmes that can read text and measure it and give us a window into those collective emotions.”

The research caused a huge ripple among two different constituencies. “We had a lot attention from hedge funds. They are looking for signals everywhere and this is a hugely interesting signal. My impression is hedge funds do have these algorithms that are scanning social feeds. The flash crashes we’ve had – sudden huge drops in stock prices – indicates these algorithms are being used at large scale. And they are engaged in something of an arms race.”

The other people interested in Bollen’s work are those who want not only to measure public sentiment, but to change it. Bollen’s research shows how it’s possible. Could you reverse engineer the national, or even the global, mood? Model it, and then change it?

Google, democracy and the truth about internet search

“It does seem possible. And it does worry me. There are quite a few pieces of research that show if you repeat something often enough, people start involuntarily to believe it. And that could be leveraged, or weaponised for propaganda. We know there are thousands of automated bots out there that are trying to do just that.”

THE war of the bots is one of the wilder and weirder aspects of the elections of 2016. At the Oxford Internet Institute’s Unit for Computational Propaganda, its director, Phil Howard, and director of research, Sam Woolley, show me all the ways public opinion can be massaged and manipulated. But is there a smoking gun, I ask them, evidence of who is doing this? “There’s not a smoking gun,” says Howard. “There are smoking machine guns. There are multiple pieces of evidence.”

“Look at this,” he says and shows me how, before the US election, hundreds upon hundreds of websites were set up to blast out just a few links, articles that were all pro-Trump. “This is being done by people who understand information structure, who are bulk buying domain names and then using automation to blast out a certain message. To make Trump look like he’s a consensus.”

And that requires money?

“That requires organisation and money. And if you use enough of them, of bots and people, and cleverly link them together, you are what’s legitimate. You are creating truth.”

You can take an existing trending topic, such as fake news, and then weaponise it. You can turn it against the very media that uncovered it. Viewed in a certain light, fake news is a suicide bomb at the heart of our information system. Strapped to the live body of us – the mainstream media.

One of the things that concerns Howard most is the hundreds of thousands of “sleeper” bots they’ve found. Twitter accounts that have tweeted only once or twice and are now sitting quietly waiting for a trigger: some sort of crisis where they will rise up and come together to drown out all other sources of information.

Like zombies?

“Like zombies.”

Many of the techniques were refined in Russia, he says, and then exported everywhere else. “You have these incredible propaganda tools developed in an authoritarian regime moving into a free market economy with a complete regulatory vacuum. What you get is a firestorm.”

This is the world we enter every day, on our laptops and our smartphones. It has become a battleground where the ambitions of nation states and ideologues are being fought – using us. We are the bounty: our social media feeds; our conversations; our hearts and minds. Our votes. Bots influence trending topics and trending topics have a powerful effect on algorithms, Woolley, explains, on Twitter, on Google, on Facebook. Know how to manipulate information structure and you can manipulate reality.

We’re not quite in the alternative reality where the actual news has become “FAKE news!!!” But we’re almost there. Out on Twitter, the new transnational battleground for the future, someone I follow tweets a quote by Marshall McLuhan, the great information theorist of the 60s. “World War III will be a guerrilla information war,” it says. “With no divisions between military and civilian participation.”

By that definition we’re already there.

==

==

https://boingboing.net/2017/05/27/provocateurs-and-drones.html

Tigerswan, a secretive private mercenary company, was hired by Energy Transfer Partners to run campaigns against Dakota Access Pipeline protesters in five states, including states in which they were not licensed to operate -- the measures they deployed were developed as counterterrorism tactics, including

Tigerswan prepared reports that called the indigenous-led protests "an ideologically driven insurgency with a strong religious component" and compared them to jihadi fighters. The reports were leaked by a Tigerswan contractor to The Intercept, who supplemented the with thousands of pages of documents secured through public records requests.

Tigerswan appears to have also run an online disinformation campaign, "creating and distributing content critical of the protests on social media."

Tigerswan conducted substantial infiltration and provocateur operations against the water protectors. These infiltrators engaged in "exploitation of ongoing native versus non-native rifts, and tribal rifts between peaceful and violent elements."

Perhaps one of the most striking revelations of the documents is the level of hostility displayed by TigerSwan toward the water protectors. TigerSwan consistently describes the peaceful demonstrators using military and tactical language more appropriate for counterterrorism operations in an armed conflict zone. At times, the military language verges on parody, as when agents write of protesters “stockpiling signs” or when they discuss the “caliber” of paintball pellets. More often, however, the way TigerSwan discusses protesters as “terrorists,” their direct actions as “attacks,” and the camps as a “battlefield,” reveals how the protesters’ dissent was not only criminalized but treated as a national security threat. A March 1 report states that protesters’ “operational weakness allows TS elements to further develop and dictate the battlespace.”

In one internal report dated May 4, a TigerSwan operative describes an effort to amass digital and ground intelligence that would allow the company to “find, fix, and eliminate” threats to the pipeline — an eerie echo of “find, fix, finish,” a military term used by special forces in the U.S. government’s assassination campaign against terrorist targets.

TigerSwan pays particular attention to protesters of Middle Eastern descent. A September 22 situation report argues that “the presence of additional Palestinians in the camp, and the movement’s involvement with Islamic individuals is a dynamic that requires further examination.” The report acknowledges that “currently there is no information to suggest terrorist type tactics or operations,” but nonetheless warns that “with the current limitation on information flow out of the camp, it cannot be ruled out.”

LEAKED DOCUMENTS REVEAL COUNTERTERRORISM TACTICS USED AT STANDING ROCK TO “DEFEAT PIPELINE INSURGENCIES” [Alleen Brown, Will Parrish and Alice Speri/The Intercept]

...

==

no link

https://www.dailydot.com/via/barrett-brown-private-intelligence-industry/

Given the National Security Agency’s surveillance revelations of the last few months, we need to pay even more attention to the private companies who are working hand-in-hand with the state to carry this mass surveillance out. In fact, someone’s already done a lot of that work for us—an American journalist who has been in jail for over a year: Barrett Brown.

In a statement released on Monday, WikiLeaks states that Brown is “being persecuted for critical reporting on the growing surveillance state” and that his prosecution “chills investigative reporting of national security issues and provides cover for the unholy alliance between government agencies and the security industry.” The Dallas, Texas-based writer—who contributed to The Guardian, Huffington Post, and Vanity Fair, among other outlets—now faces up to 105 years in prison on charges that are crucially related to his reporting.

Brown’s status as a journalist will most likely affect how his actions are perceived in a court of law. His investigative journalism, memorialized at the crowdsourced research outfit with an associated wiki, Project PM, brought to light extremely important findings on the issue of private firms and public surveillance. While Brown isn’t due sole credit for all of the information below, he followed these matters very closely. Now, more than ever, it is important for other journalists and researchers to revisit and recognize the importance of his work and if possible, pick up threads where he left off. As such, it’s worth going over a summary review of some critical subjects Brown reported on, and the private firms he investigated allegedly involved in gathering intelligence and surveilling public citizens.

1) Team Themis

Team Themis is a consortium of firms, made up of HBGary, Palantir, Berico, and Endgame Systems, that was apparently set up to provide offensive intelligence capabilities against certain enemies on behalf of the law firm Hunton & Williams, who was working at the behest of Bank of America and the U.S. Chamber of Commerce. The plans—discovered in emails pilfered by Anonymous from HBGary, which were drawn up but never acted upon—consisted of disinformation efforts against WikiLeaks and its supporters (including Glenn Greenwald) and other activists involved in criticizing the Chamber of Commerce.

Some of the methods proposed, which could feasibly be described as a dirty-tricks campaign using false documents to sow distrust, border upon the criminal. The affair made the news and resulted in calls for an investigation that never materialized, which is not surprising considering that the Department of Justice (DOJ) set the affair in motion by recommending Hunton & Williams to Bank of America, who were then concerned that WikiLeaks possessed information belonging to them. In the end a single Palantir employee was placed on leave pending a review of his actions, and later allowed to return.

2) Romas/COIN

Romas/COIN was a sophisticated campaign of mass surveillance and data mining targeted at Arab countries, which was unveiled in an exclusive Project PM report during 2011. The report was picked up by Raw Story and one other outlet, and it resulted in an article by Brown in the Guardian and a segment on Russia Today featuring confirmatory comments from Lt. Col. Anthony Shaffer. But otherwise it didn’t get much traction.

Most striking was the revelation that companies like Apple and Google were team partners in this effort. While its exact nature and scope is unknown, mobile phone applications were believed to constitute a major component of the program. The contract for Romas/COIN was set to be replaced by a successor, codenamed Odyssey, which is quite possibly being used today to monitor, deceive, and manipulate whole populations.

3) “Persona Management”

The capability of persona management entails “the use of software by which to facilitate the use of multiple fake online personas, or ‘sockpuppets,’ generally for the use of propaganda, disinformation, or as a surveillance method by which to discover details of a human target via social interactions.” The United States Air Force (USAF) was revealed on the General Services Administration’s Federal Business Opportunities website to have requested bids from contractors for the opportunity to work on this class of software. It’s a high priority for DARPA (Defense Advanced Research Projects Agency), and U.S. Central Command (CENTCOM) has admitted to using similar capabilities—including psychological operations on U.S. senators—abroad, under Operation Earnest Voice, to increase support for wars.

There are two very concerning aspects to this. One: the possibility that fake social media profiles, replete with supporting biographical details, could be deployed against Americans, which is against the law. Second: the possibility of a future in which you never know whether you’re communicating with a live person or a software abstraction, and a world where governments control narratives and wield an intense grip upon trends and topics via whole armies of these things. Let’s just say it’s scary.

4) TrapWire

Brown played a central role in the media coverage of TrapWire, a mass video surveillance system developed by Abraxas Corporation that was revealed last year. TrapWire’s marketing material boasts the ability to predict terrorist attacks.The emails, which came out of Stratfor and were published by WikiLeaks, showed that a network of closed-circuit television (CCTV) cameras had been installed in most major American cities, the feeds of which were fed into a system designed to detect patterns of suspicious behavior.

Brown demonstrated how the New York Times got TrapWire wrong by arguing its fears were overstated (based on the word of an unnamed and unquoted DHS official) and underplayed its significance by dismissing its own marketing claims. He also detailed how articles about TrapWire were scrubbed from Australian newspapers at the behest of Cubic Corporation, who argued they were not connected to TrapWire, even though they had purchased the company that created it, Abraxas, two years earlier.

5) Cubic Corporation

And what about Cubic, a large company primarily serving the defense sector and its other wholly owned subsidiary, Ntrepid? In 2011, Ntrepid won a $2.76 million contract for persona management from CENTCOM mentioned earlier. Ntrepid also has an interesting product called Tartan, an investigation software with the ability to find hidden relationships within groups, analyze and identify ranks of influence, and locate key voices. Tartan’s own brochures suggest its potential for deployment against anarchist and protest groups; Occupy Wall Street is mentioned specifically.

Cubic also sells a product of dubious trustworthiness called Anonymizer, a proxy tool intended to make Internet activity untraceable, while developing other solutions to investigate, track, and analyze groups of people who are communicating over social media websites. In summary, Ntrepid’s software is intended to help one pick apart organizations, allowing you to discover who is most influential within them, and even uncover the identities of people trying to remain anonymous. Its potential value to law enforcement investigations can’t be understated.

6) Endgame Systems

Another focus of Brown’s research was Endgame Systems—a company named on his search warrant. Endgame conducts vulnerability research that gets used in cyber-warfare. Their premiere product, Bonesaw, is an offensive cyber-targeting application with a map displaying the locations and addresses of most Internet-connected computers and devices around the world, providing situational awareness and a platform from which to launch operations against adversaries and threats.

Endgame is also involved in the sale of zero-day exploits—e.g., weaknesses that can be used to attack and infiltrate systems. They were particularly secretive about the company’s involvement in Team Themis and purposely kept a low profile during the discussions. As one employee told another in an internal email according to this WIRED article, “We don’t ever want to see our name in a press release.” Like other companies, such as VUPEN, that sell exploits to governments, Endgame’s vulnerability research and experience with cyber-weapons has secured them a prominent role in the U.S. cyber-security arena.

7) Qorvis Communications

The public relations firm Qorvis has had certain interactions with the Kingdom of Bahrain that begat a few scandals. Qorvis was reportedly hired by the Bahraini regime to engage in “reputation management”—essentially monitoring the media and manipulating the press to promote a specific perception of the Kingdom while silencing critical voices. This is particularly troubling in view of the human rights situation in Bahrain: There have been violent crackdowns by security forces against demonstrators, and activists are frequently targeted with attacks or censorship by the regime. Actions by Qorvis are suspected to include a coordinated barrage of vicious social media attacks against Maryam al-Khawaja, a Bahraini human rights activist, when she gave a speech at the Oslo Freedom Forum in 2011.

8) Booz Allen Hamilton

Let’s not forget Booz Allen Hamilton, another entity Brown was looking into. A major U.S. intelligence contractor with offices in Virginia, Booz Allen Hamilton was found by Project PM to have an unspecified ‘project’ potentially related to disrupting Anonymous and WikiLeaks. No more details about that have been forthcoming, no doubt due to the firm’s intense culture of secrecy.

Booz Allen is best known as the company that whistle-blower Edward Snowden was briefly employed by as a systems administrator, under contract to the NSA, during which he used his broad access to obtain documents revealing secret surveillance programs. The current Director of National Intelligence, James Clapper, who lied to Congress, was a former executive at Booz. It’s been reported that Booz Allen has experienced conflicts of interest and has a history of overbilling, while 99 percent of the company’s revenue comes from the federal government. As the author of that report notes, the firm merits closer scrutiny.

9) Palantir Technologies

Palantir Technologies is a major player in this field who is of great interest to Brown and Project PM. Palantir, known as a “darling of the intelligence and law enforcement communities”, was founded with a boatload of money from In-Q-Tel, the CIA’s venture capital firm, and PayPal cofounder Peter Thiel. It’s led by the eccentric Alex Karp. Palantir was also involved in Team Themis, and even apologized to Greenwald for it—but what we know of its work speaks to the company’s expertise in dealing with large datasets.

Palantir’s self-titled flagship product is able to sift through extremely large amounts of data while providing advanced search and discovery capabilities: think things like telephone calls, bank transaction records, emails, text messages, etc. Of course, it’s wildly profitable and boast many customers, chief among them our nation’s counterterrorism and cyber analysts. Palantir claims to have built-in privacy controls, but that isn’t necessarily very reassuring since abuses and violations do happen.

10) Berico Technologies and HBGary

Berico Technologies, another firm implicated in Team Themis, develops fancy tools and infrastructure that are used in data visualization and analysis to assist signals intelligence (SIGINT) missions. After the Themis scandal broke, the company issued a statement that it does “not condone or support any effort that proactively targets American firms, organizations or individuals” and broke off ties with HBGary. For its part, HBGary does a lot of malware detection and also claims to have offensive cyber capabilities (more zero-day exploits).

HBGary Federal, however, is mostly perceived as a joke today—in no small part due to the foolish efforts of one executive, Aaron Barr, to identify the leadership structure of Anonymous. This attempt backfired in spectacular fashion, with the company’s servers being hacked and email spools leaked. Barr had no choice but to resign, and several firms attempted to distance themselves from him and HBGary after they were compromised.

11) Strategic Forecasting, Inc.

Strategic Forecasting, Inc. was hacked by AntiSec in association with Anonymous at the end of 2011 and had thousands of emails stolen. The emails are now continually being published by WikiLeaks as the Global Intelligence Files. Stratfor’s wide-ranging spying activities were later exposed, “including surveillance of Bhopal activists at the behest of Dow Chemical, of PETA on behalf of Coca-Cola, and of Occupy Wall Street under contract to the U.S. Department of Homeland Security.” Those facts are less surprising and perplexing than the fact that notorious hacker Sabu was working for the FBI when Stratfor was hacked, and indeed provided the servers used to dump the data by Jeremy Hammond; add to that the fact that Sabu tried to sell the data to Julian Assange as part of a failed sting in which the FBI thought an American company was apparently expendable in its effort to nab the founder of WikiLeaks. Don’t even mention that Brown was indicted for identity theft and fraud for pasting a link in a chat room to an archive that contained unencrypted credit card numbers which, by Stratfor CEO George Friedman’s own account, had already been canceled—the FBI, banks and cardholders having been notified weeks beforehand.

12) Leonie Industries

Then there’s Leonie Industries, a federal contracting firm specializing in information operations which it offers to the Department of Defense. In 2012, it was caught in an online smear campaign against a journalist and an editor from USA Today, who were reporting about tax violations and waste at that same company, Leonie Industries. The article basically made the case that the contract between Leonie and the DoD was expensive and ineffective; the Pentagon then launched an investigation into back taxes owed. A calculated disinformation campaign in response to protected press activity is an ominous signal and reminder that journalists and activists are frequently targeted by these contractors. The person responsible apologized and divested themselves of ownership in the company. That shadowy, unseen forces have the ability to launch allegations to discredit perceived enemies at the behest of their clients is no less than absolutely terrifying.

13) Gamma International

Some who are well-versed in this area might recall Gamma International, the proprietor of the FinSpy/FinFisher spyware that is able to remotely take control of a computer, log keystrokes, copy stored information, and intercept communications. The New York Times reported that this software had been deployed against activists in Bahrain and Egypt. The FinFisher case illustrates the problem very well: here U.K./U.S. firms are actively engaged in selling capabilities to oppressive dictatorships with poor human rights records; tools which can be used to surveil, detain, arrest, torture, or do worse to fellow humans.

14) Raytheon

Last but far from least, Raytheon was shown earlier this year to have secretly developed a program called Riot that is, according to the Guardian, “capable of tracking people’s movements and predicting future behaviour by mining data from social networking websites.” Here we have a military defense contractor—the fifth largest in the world—working on a product that combines social networking, big data, and analytics in ways that could be extremely invasive to the privacy of average, law-abiding citizens. Like TrapWire, Riot boasts predictive powers that might be dangerously misused or just plain wrong. It recalls the concept of pre-crime from the short story/film The Minority Report. Clients of Raytheon are buying into the promise of predictive analytics: techniques from statistics, modeling, machine learning and data mining are being applied to complex human behavior.

Forecasting unknown events based on current facts, especially when it involves the motives and emotions of individuals, comes with a huge margin of error. That innocent people may one day arrested and convicted based on these predictions suggests a future that is truly Orwellian—straight out of 1984.

…

We are now witnessing the militarization of the Internet. These businesses are all part of a continuous intelligence and law enforcement community with an incestuous, revolving-door relationship between the government and private industry. Those involved allegedly get rich off of contracts that are paid to spy on people, conduct shady cyber-warfare, and disrupt activist movements. There tends to be no moral consideration at stake as part of this market exchange. The ability to investigate and target people is for sale to those who will pay for it.

What Brown’s work teaches us is that technological capabilities such as these—which improve at a rate far greater than populations are able to keep up with or learn about —are inevitably subject to abuse.

Stories about privacy violations like these have a shelf life, and the U.S. media is ill-equipped to cover them. They’re hot for awhile, such as when hackers first leak information; then their appeal fades. The issues at stake are sometimes too complex for the average person with an average attention span to attempt to understand. Brown frequently complained about this.

We do, however, now have the ability to change it—all we need to do is accept that Snowden has opened the door, and to walk through it. There are no doubt numerous revelations of journalistic import in those thousands of emails, just waiting to be found. We need to watch these matters a lot more closely if we hope to preserve basic fundamentals of democracy, privacy, and liberty in the years to come.

Kevin Gallagher is a writer, systems administrator and activist based in western Massachusetts. He’s also the director of Free Barrett Brown. Follow him @ageis.

==

==

http://www.huffingtonpost.com/entry/republicans-are-about-to-kill-rules-banning-internet-providers-from-sharing-your-web-history-without-your-consent_us

House Republicans jammed through a measure on Tuesday overturning the Obama administration’s rules that would have banned telecom and cable companies from sharing customers’ personal information, including web browsing history, without their consent.

The House resolution passed 215-205, mostly on party lines. Its companion passed the Senate last week on a 50-48 vote. If President Donald Trump signs the measure into law, internet service providers will win a regulatory victory. But advocates say consumers can kiss network privacy goodbye.

“ISPs will be able to sell your personal information to the highest bidder ... and they won’t have any real obligation to keep your personal information secure, either,” Gigi Sohn, who previously served as counselor to former Federal Communications Commission Chairman Tom Wheeler, said Monday.

The FCC adopted rules last October that required companies like Comcast and Verizon to get their customers’ explicit permission before they could share “sensitive” data like Social Security numbers, or information pertaining to children or health. Under the rules — which are not yet in effect — companies also had to tell customers and law enforcement if a potentially harmful data breach occurred. (Verizon is the parent company of The Huffington Post.)

In a heated floor debate on Tuesday, House Republicans sought to paint the rules as an example of government overreach. “These broadband privacy rules are unnecessary,” said Rep. Marsha Blackburn (R-Tenn.), who introduced the resolution.

But House Democrats warned that Republicans were scrapping common-sense privacy regulations — and predicted a dim future without them. Rep. Michael Capuano (D-Mass.) pointed to a patent application from an ISP for a cable box that would detect whether people were cuddling on the couch through a thermal camera, then show them TV commercials for a romantic getaway or contraceptives. “That’s what this bill will allow, and you can’t turn it off,” he said, calling it “terrible.”

The measure uses the Congressional Review Act, which allows lawmakers to undo any regulation within 60 days of its finalization, while also barring agencies from writing a “substantially” similar rule after the original one has been overturned. That means the FCC could be banned from regulating ISP privacy issues in the future, said David Segal, executive director of Demand Progress, a grassroots group.

Trump ran a populist campaign, but his vision for the FCC, a government agency that is supposed to protect consumers from predatory telecom and cable companies, is shaping up to be the opposite, consumer advocates say. The current FCC chairman, Ajit Pai, also opposed Obama’s privacy rules when he was the agency commissioner under the prior administration.

Internet service providers say it’s not fair they have to be subject to regulations that tech giants like Facebook and Google, which the Federal Trade Commission oversees, don’t have to follow. In response, Republicans have advocated for a privacy framework modeled on the FTC’s approach. But according to Sohn, the FTC rules come into play after harm occurs ― while the FCC’s regulations have the power to protect consumers before they are harmed.

Advocates, as well as Democrats, say that it doesn’t make sense to regulate an ISP, which has access to everything a person does online, like Google, which only sees some of a person’s internet traffic. As a consumer, “if I don’t like the practices of Google, I can go to Bing; if I don’t like the practices of Bing, I can go to Firefox,” Wheeler told HuffPost on Monday. “But if I don’t like the practice of my network provider, I’m out of luck.”

“Consumers have entered into a business relationship with ISPs that ISPs are now seeking to change ... [but] it’s not their information, it’s the consumers’ information,” he said.

Overturning the rules is a win for the 21st Century Privacy Coalition, a group led by former Federal Trade Commission Chairman Jon Leibowitz. The coalition is backed by telecom companies and has spent millions of dollars on lobbying in the past few years.

“I can’t tell you [the House-approved bill] is not repealing privacy regulations,” Leibowitz told HuffPost on Monday. But, he said, “in a very partisan Washington, where often the only choices are binary, the FCC passed a very flawed regulation.”

He argued that if the bill is enacted, the FCC can still continue to protect privacy. To do that, it could write another rule ― “if that rule takes a different approach.”

When asked whether he thought a repeal would improve privacy for consumers, he said only that the Obama administration’s rule would “increase costs to consumers and reduce choices, and reduce competition for privacy.”

But consumer advocates aren’t buying it. “It’s special interest lobbying as usual,” said Jeff Chester, executive director of the Center for Digital Democracy.

“These companies are just trying to exploit consumers’ data towards ends of private profit,” said Segal of Demand Progress.

As of Monday, the Congressional Progressive Caucus said it was opposed to the measure and would be pushing for legislators to vote against it. The office ofRep. Mark Pocan (D-Wis.), first vice chair of that caucus, also noted that they had received a fair amount of calls and emails in favor of the Obama administration rule.

“Considering how much access providers already have to highly sensitive data, it is absolutely unacceptable for them to monetize personal information,” Pocan said.

But that wasn’t enough to stop most House Republicans from approving the resolution. House Minority Leader Nancy Pelosi (D-Calif.) on Tuesday asked ISPs to weigh in on the measure. “This is about profit,” she told her House colleagues in the House. “From America’s most intimate, personal information.”

==

omg:

see pt 1&2

https://medium.com/@d1gi/data-is-the-real-post-truth-so-heres-the-truth-about-post-election2016-propaganda

==

uhoh

https://www.democracynow.org/2017/1/13/headlines/nsa_to_share_vast_data_trove_with_all_us_intelligence_agencies

---

OMG

SCL Group calls itself a "global election management agency"^[5] known for involvement "in military disinformation campaigns to social media branding and voter targeting".^[3] SLC’s involvement in the political world has been primarily in the developing world where it has been used by the military and politicians to study and manipulate public opinion and political will. SCL claims to have been successful to help foment coups.^[3]

When SCL Elections formed Cambridge Analytica in 2013 it hired researchers from Cambridge University, hence the name.^[6] CA collects data on voters using sources such as demographics, consumer behavior, internet activity, and other public and private sources.According to The Guardian, CA is using psychological data derived from millions of Facebook users, largely without users' permission or knowledge.^[6] Another source of information is the "Cruz Crew" mobile app that tracks physical movements and contacts and invades personal data more than any other app of presidential candidates.^[7]

"Today in the United States we have somewhere close to four or five thousand data points on every individual. ... So we model the personality of every adult across the United States, some 230 million people."

— Alexander Nix (Chief Executive, Cambridge Analytica), October 2016.^[8]

==

https://www.propublica.org/article/google-has-quietly-dropped-ban-on-personally-identifiable-web-tracking

==

https://thinkprogress.org/drones-law-enforcements-secret-eye-in-the-sky-9eda68fb8bc#.b9fz10xqp

==

new investigation by Bloomberg Businessweek has revealed police in Baltimore have been secretly testing an aerial surveillance system that records the movements and actions of Baltimore residents in real time from a low-flying plane. The technology has been adapted from the U.S. military’s surveillance programs aimed at detecting roadside bombs in Iraq. The plane is equipped with multiple cameras that can record 30-square-mile swaths of the city at a time. The plane is the creation of the private company Persistent Surveillance Systems. The project is bankrolled by John Arnold, a former Enron trader and hedge funder. The plane has been circling above Baltimore since January, without the public ever being notified.

==

http://www.alternet.org/civil-liberties/nefarious-surveillance-state-dangerously-inhibits-self-expression-and-healthy

==

Verizon agreed to pay $1.35 million to settle Federal Communications Commission charges that it violated customers’ privacy when it used a hidden undeletable number to track cellphone users.

In the settlement, Verizon also agreed to make its unkillable “zombie” cookie opt-in, meaning that users are not tracked by default. Previously, users had been tracked by default unless they opted out.

However, the settlement does not apply to Verizon’s tracking of its customers who visit the 40 percent of websites that use AOL’s ad network. That is because Verizon owns AOL, and therefore it is not considered a third party that requires opt-in.

That means that unless Verizon users opt out, they can still be identified when they use their smartphone or tablet to browse Web pages containing AOL’s tracking code.

The Verizon controversy dates back to the fall of 2014, when a flurry of news outlets, including Wired and ProPublica, reported that Verizon and AT&T were attaching tracking numbers to their subscribers’ Internet activity, even when users opted out.

The tracking numbers could be used by websites to build a dossier about a person’s behavior on mobile devices — including which apps they use, what sites they visit and for how long.

Soon after, AT&T stopped using the controversial identifiers. But Verizon said it would keep using them — and assured users on its website that “it is unlikely that sites and ad entities will attempt to build customer profiles” using its identifiers.

In January of 2015, ProPublica reported that an online advertising company was doing just what Verizon had promised wouldn’t happen. A company called Turn was using Verizon’s identifier to respawn tracking cookies that users had deleted. ProPublica dubbed the unkillable identifier a “zombie cookie.”

Two days later, Turn said it would stop using the zombie cookie. And a few weeks later, Verizon also reversed course, and said users could now kill the previously unkillable cookie - but users still had to go in and fiddle with their privacy settings.

Zombie Cookie: The Tracking Cookie That You Can’t Kill

An online ad company called Turn is using tracking cookies that come back to life after Verizon users have deleted them. Turn’s services are used by everyone from Google to Facebook. Read the story.

Verizon’s Zombie Cookie Gets New Life

Verizon is merging its cellphone tracking supercookie with AOL’s ad tracking network to match users’ online habits with their offline details. Read the story.

In October, Verizon said it would give the zombie cookie a new life as a way to boost the tracking abilities of its AOL subsidiary.

https://www.propublica.org/article/verizon-to-pay-1.35-million-to-settle-zombie-cookie-privacy-charges

---

October 21, 2015

BookTV Discussion on Snowden

Ted Rall talked about his book, Snowden, about National Security Agency (NSA) whistleblower Edward Snowden and the documents that Mr. Snowden made public. During this event, Mr. Rall was joined by Chris Hedges.

http://www.c-span.org/video/?402168-1/book-discussion-snowden

==

==

The U.S. Chamber of Commerce’s Institute for Legal Reform just devoted much of an entire day to bemoaning the proliferation of breaches of Americans’ personal data.

The U.S. Chamber of Commerce’s Institute for Legal Reform, established by Tom Donohue, prioritizes stripping rights away…

Posted by Asbestos Nation on Tuesday, October 27, 2015

My colleagues and I at Environmental Working Group Action Fund find it impossible to take these complaints seriously when the chamber and institute are among the most zealous proponents of the so-called FACT Act (H.R. 526 and S. 357), federal legislation that would require public disclosure of asbestos disease victims’ intensely personal information on the Internet. The FACT Act would force them to give their full names and partial Social Security numbers and tell the world about their medical conditions and employment history. They would be prime targets for identity theft.

This year, the chamber and institute have spent more than $63 million combined to lobby for numerous bills, including FACT Act.

Environmental Working Group Action Fund sent a camera and crew to the event (well, outside of the building) to gauge how some of the conference guests felt about violating sick Americans’ privacy. Chamber President Tom Donohue spotted our people and turned down an alley.

Here is what a few other attendees had to say about the implications of the FACT Act for the privacy and financial security of asbestos victims:

==

http://www.propublica.org/article/library-support-anonymous-internet-browsing-effort-stops-after-dhs-email

==

http://www.propublica.org/series/dragnets

==

https://firstlook.org/theintercept/2015/05/05/nsa-speech-recognition-snowden-searchable-text/

==

http://www.alternet.org/news-amp-politics/latest-outrageous-example-pentagon-dea-and-private-companies-conspiring-track

NEWS & POLITICS

The Latest Outrageous Example of the Pentagon, DEA and Private Companies Conspiring to Track Everything You Do

Guess what the malware software is really for?

By Bill Blunden / AlterNet May 8, 2015

Yet another report has surfaced describing how tools created by the companies selling software that can damage and hack into people's computers are being deployed by U.S. security services. While the coverage surrounding this story focuses primarily on federal agencies it’s important to step back for a moment and view the big picture. In particular, looking at who builds, operates, and profits from mass surveillance technology offers insight into the nature of the global panopticon.

A report published by Privacy International as well as an article posted by Vice Motherboard clearly show that both the DEA and the United States Army have long-standing relationships with Hacking Team, an Italian company that’s notorious for selling malware to any number of unsavory characters.

Federal records indicate that the DEA and Army purchased Hacking Team’s Remote Control System (RCS) package. RCS is a rootkit, a software backdoor with lots of bells and whistles. It’s a product that facilitates a covert foothold on infected machines so intruders can quietly make off with sensitive data. The aforementioned sensitive data includes encryption keys. In fact, Hacking Team has an RCS brochure that tells potential customers: “What you need is a way to bypass encryption, collect relevant data out of any device, and keep monitoring your targets wherever they are, even outside your monitoring domain.” Note: Readers interested in nitty-gritty details about RCS can check out the Manuals online.

It’s public knowledge that other federal agencies like the FBI and the CIA have become adept at foiling encryption. Yet this kind of subversion doesn’t necessarily bother high tech luminaries like Bruce Schneier, who believe that spying is “perfectly reasonable” as long as it’s targeted. Ditto that for Ed Snowden. Schneier and Snowden maintain that covert ops, shrouded by layers of official secrecy, are somehow compatible with democracy just so long as they’re narrow in scope.

But here’s the catch: RCS is designed and marketed as a means for mass collection. It violates the targeted surveillance condition. Specifically, a Hacking Team RCS brochure proudly states:

“’Remote Control System’ can monitor from a few and up to hundreds of thousands of targets. The whole system can be managed by a single easy to use interface that simplifies day by day investigation activities.”

Does this sound like a product built for targeted collection?

So there you have it. Subverting encryption en masse compliments of Hacking Team. The fact that there’s an entire industry of companies just like this should give one pause as there are unsettling ramifications regarding the specter of totalitarian control.

Corporate America is Mass Surveillance

Throughout the Snowden affair there’s a theme that recurs. It appeared recently in a foreword written by Glenn Greenwald for Tom Engelhardt’s book Shadow Government:

“I really don’t think there’s any more important battle today than combating the surveillance state [my emphasis]. Ultimately, the thing that matters most is that the rights that we know we have as human beings are rights that we exercise.”

There’s a tendency to frame mass surveillance in terms of the state. As purely a result of government agencies like the CIA and NSA. The narrative preferred by the far right is one which focuses entirely on the government (the so-called "surveillance state") as the sole culprit, completely ignoring the corporate factions that fundamentally shape political decision making.

American philosopher John Dewey once observed that "power today resides in control of the means of production, exchange, publicity, transportation and communication. Whoever owns them rules the life of the country," even under the pretense of democratic structures"

There are some 1300 billionaires in the United States who can testify to this fact. As can anyone following the developments around the secretive Trans-Pacific Partnership.

Dewey’s observation provides a conceptual basis for understanding how business interests drive the global surveillance apparatus. Mass surveillance is a corporate endeavor because the people who inevitably drive decisions are the same ones who control the resources. For example, the backbone of the internet itself consists of infrastructure run by Tier 1 providers like Verizon and Level 3 Communications. These companies are in a perfect position to track users and that’s exactly what they do.

Furthermore when spying is conducted it’s usually executed, in one form or another, by business interests. Approximately 70 percent of the national intelligence budget end up being channeled to defense contractors. Never mind that the private sector’s surveillance machinery dwarfs the NSA’s as spying on users is an integral part of high tech’s business model. Internet companies like Google operate their services by selling user information to the data brokers. The data broker industry, for example, generates almost $200 billion a year in revenue. That’s well over twice the entire 2014 U.S. intelligence budget.

From a historical vantage point it’s imperative to realize that high tech companies are essentially the offspring of the defense industry. This holds true even today as companies like Google are heavily linked with the Pentagon. For decades (going back to the days of Crypto AG) the private sector has collaborated heavily with the NSA’s in its campaign of mass subversion: the drive to insert hidden back doors and weaken encryption protocols across the board. Companies have instituted “design changes” that make computers and network devices “exploitable.” It’s also been revealed that companies like Microsoft have secret agreements with U.S. security services to provide information on unpublished vulnerabilities in exchange for special benefits like access to classified intelligence.

In a nutshell: contrary to talking points that depict hi-tech companies as our saviors, they’re more often accomplices if not outright perpetrators of mass surveillance. And you can bet that CEOs will devote significant resources towards public relations campaigns aimed at obscuring this truth.

A parting observation: the current emphasis on Constitutional freedom neglects the other pillar of the Constitution: equality. Concentrating intently on liberty while eschewing the complementary notion of equality leads to the sort of ugly practices that preceded the Civil War. In fact there are those who would argue that society is currently progressing towards something worse, a reality by the way that the financial elite are well aware of. When the public’s collective misery reaches a tipping point, and people begin to mobilize, the digital panopticon of the ruling class will be leveraged to preserve social control. They’ll do what they’ve always done, tirelessly work to maintain power and impose hierarchy.

NOTES:

i The Later Works of John Dewey, 1925-1953, Volume 9: 1933-1934, Essays, Reviews, Miscellany, and A Common Faith, Southern Illinois University Press, 2008, page 76.

==

If you downloaded the privacy software Tor in 2011, you may have been flagged to be spied on.

More coverage: Surveillance

==

chls Black is currently working with AT&T in its lobbying campaign to be given retroactive immunity against lawsuits for having assisted the administration in its warrantless wiretapping program.

==

For years people have noticed a funny thing about Facebook's ubiquitous Like button. It has been sending data to Facebook tracking the sites you visit. Each time details of the tracking were revealed, Facebook promised that it wasn't using the data for any commercial purposes.

No longer. Last week, Facebook announced it will start using its Like button and similar tools to track people across the Internet for advertising purposes.

Here is the long history of the revelations and Facebook's denials:

Facebook's Mark Zuckerberg introduces the "transformative" Like button…

---

June 28: This story has been corrected.

This story was co-published with Wired.

Jonathan Mayer had a hunch.

A gifted computer scientist, Mayer suspected that online advertisers might be getting around browser settings that are designed to block tracking devices known as cookies. If his instinct was right, advertisers were following people as they moved from one website to another even though their browsers were configured to prevent this sort of digital shadowing. Working long hours at his office, Mayer ran a series of clever tests in which he purchased ads that acted as sniffers for the sort of unauthorized cookies he was looking for. He hit the jackpot, unearthing one of the biggest privacy scandals of the past year: Google was secretly planting cookies on a vast number of iPhone browsers. Mayer thinks millions of iPhones were targeted by Google.

This is precisely the type of privacy violation the Federal Trade Commission aims to protect consumers from, and Google, which claims the cookies were not planted in an unethical way, now reportedly faces a fine of more than $10 million. But the FTC didn't discover the violation. Mayer is a 25-year-old student working on law and computer science degrees at Stanford University. He shoehorned his sleuthing between classes and homework, working from an office he shares in the Gates Computer Science Building with students from New Zealand and Hong Kong. He doesn't get paid for his work and he doesn't get much rest.

If it seems odd that a federal regulator was scooped by a sleep-deprived student, get used to it, because the federal government is often the last to know about digital invasions of your privacy. The largest privacy scandal of the past year, also involving Google, wasn't discovered by federal regulators, either. A privacy official in Germany forced Google to hand over the hard drives of cars equipped with 360-degree digital cameras that were taking pictures for its Street View program. The Germans discovered that Google wasn't just shooting photos: The cars downloaded a panoply of sensitive data, including emails and passwords, from open Wi-Fi networks. Google had secretly done the same in the United States, but the FTC, as well as the Federal Communications Commission, which oversees broadcast issues, had no idea until the Germans figured it out...

http://www.propublica.org/article/how-a-grad-student-scooped-the-ftc-and-what-it-means-for-your-online-privac

see kpfa on big data

---

http://www.commondreams.org/view/2012/03/26-9

Published on Monday, March 26, 2012 by Deeplinks Blog / EFF

New Counterorrism Guidelines Gives Authorities Vast Access to Private Info of Innocent Americans

by Trevor Timm

On Thursday, U.S. Attorney General Eric Holder signed expansive new guidelines for terrorism analysts, allowing the National Counter Terrorism Center (NCTC) to mirror entire federal databases containing personal information and hold onto the information for an extended period of time—even if the person is not suspected of any involvement in terrorism. (Read the guidelines here).

Despite the “terrorism” justification, the new rules affect every single American.  The agency now has free rein to, as the New York Times’ Charlie Savage put it, “retrieve, store and search information about Americans gathered by government agencies for purposes other than national security threats” and expands the amount of time the government can keep private information on innocent individualsby a factor of ten.

From the New York Times:

The guidelines will lengthen to five years — from 180 days — the amount of time the center can retain private information about Americans when there is no suspicion that they are tied to terrorism, intelligence officials said. The guidelines are also expected to result in the center making more copies of entire databases and “data mining them” using complex algorithms to search for patterns that could indicate a threat. (emphasis ours)

Journalist Marcy Wheeler summed the new guidelines up nicely saying, “So…the data the government keeps to track our travel, our taxes, our benefits, our identity? It just got transformed from bureaucratic data into national security intelligence.”

The administration claims that the changes in the rules for the NCTC—as well as for the Office of the Director of National Intelligence (DNI), which oversees the nation’s intelligence agencies—are in response to the government’s failure to connect the dots in the so-called “underwear bomber” case at the end of 2009, yet there was no explanation of how holding onto innocent Americans’ private data for five years would have stopped the bombing attempt.

Disturbingly, “oversight” for these expansive new guidelines is being directed by the DNI’s "Civil Liberties Protection Officer" Joel Alexander, who is so concerned about Americans’ privacy and civil liberties that he, as Marcy Wheeler notes, found no civil liberties concerns with the National Security Agency’s illegal warrantless wiretapping program when he reviewed it during President George W. Bush’s administration.

As other civil liberties organizations have noted, the new guidelines are reminiscent of the Orwellian-sounding “Total Information Awareness” program George Bush tried but failed to get through Congress in 2003—again in the name of defending the nation from terrorists. The program, as the New York Times explained, sparked an “outcry” and partially shut down Congress because it “proposed fusing vast archives of electronic records — like travel records, credit card transactions, phone calls and more — and searching for patterns of a hidden terrorist cell.”

The New York Times reported, the new NCTC guidelines “are silent about the use of commercial data — like credit card and travel records — that may have been acquired by other agencies,” but information first obtained by private corporations has ended up in federal databases before. In one example, Wired Magazine found FBI databases contained “200 million records transferred from private data brokers like ChoicePoint, 55,000 entries on customers of Wyndham hotels, and numerous other travel and commercial records.” The FBI would be one of the agencies sharing intelligence with the NCTC.

Despite Congress’ utter rejection of the “Total Information Awareness” program (TIA) in 2003, this is the second time this month the administration has been accused of instituting the program piecemeal. In his detailed report on the NSA’s new “data center” in Utah, Wired Magazine’s James Bamford remarked that the new data storage complex is “the realization” of the TIA program, as it’s expected to store and catalog “all forms of communication, including the complete contents of private emails, cell phone calls, and Google searches.”

Unfortunately, the new NCTC guidelines are yet another example of the government using the word “terrorism” to infringe on the rights of innocent Americans. Aside from the NSA’s aforementioned warrantless wiretapping program, we have seen the Patriot Act overwhelmingly used in criminal investigations not involving terrorism, despite its original stated purpose. As PBS Frontline’s Azmat Khan noted in response to the new guidelines, investigative journalist Dana Priest has previously reported how “many states have yet to use their vast and growing anti-terror apparatus to capture any terrorists; instead the government has built a massive database that collects, stores and analyzes information on thousands of U.S. citizens and residents, many of whom have not been accused of any wrongdoing.” 

This problem has been well documented for years, yet Congress and both the Bush and Obama administrations have continued to use terrorism as a justification for expansive laws, and Americans’ constitutional rights have become collateral damage.

Trevor Timm is an Activist at the Electronic Frontier Foundation. He specializes in free speech issues and government transparency.