AllThingsD » privacy

FCC to Public: Is Your Cellphone Carrier Adequately Protecting Your Information?

Ina Fried — Fri, 25 May 2012 20:11:28 +0000

The Federal Communications Commission on Friday asked the public for comment on whether cellphone carriers need to do a better job of protecting the kinds of information being gathered on modern smartphones.

Shutterstock/Péter Gudella

One of the agency’s mandates is to make sure that the carriers are securely protecting the information they collect from their customers. For example, phone companies have to protect the databases that store the information on call records and other data.

The question on what steps they must take when it comes to information on devices is a tricker one. The FCC looked into this question back in 2007. At the time, the carriers contended that information stored on phones wasn’t information they were collecting, but rather data being voluntarily entered by consumers.

However, the FCC thinks it might be time to revisit this given revelations last year that there is software, such as that from Carrier IQ, that is preinstalled and collecting information that users are largely unaware of and unable to control.

“Since the Commission last solicited public input on this question five years ago, technologies and business practices have evolved dramatically,” the FCC said in the document seeking comments. “The devices consumers use to access mobile wireless networks have become more sophisticated and powerful, and their expanded capabilities have at times been used by wireless providers to collect information about particular customers’ use of the network — sometimes, it appears, without informing the customer.”

The FCC isn’t taking issue with the collection of such information, but rather is examining what duties the carriers might have to encrypt or protect such information. Carrier IQ doesn’t encrypt the data it collects, but does store it in a binary format not generally accessible to other applications, the company said.

“We haven’t gone to that extent because we haven’t needed to,” Carrier IQ Vice President Andrew Coward told AllThingsD on Friday. “If the industry decided we needed to, then we would take that step.”

Carrier IQ is also taking steps to allow customers to see the information that is being collected about them by their software.

Following the comment period, the FCC could decide to, among other things, take no action, clarify its existing rules or propose new rules.

[Image via Shutterstock / Péter Gudella]

French Data Regulators to Google: How About Making Your Answers to Our Questions Universally Accessible and Useful?

John Paczkowski — Thu, 24 May 2012 11:02:17 +0000

You" width="380" height="232" class="alignright size-medium wp-image-211872" />The Commission Nationale de l’Informatique et des Libertés (CNIL), the French data-protection authority investigating Google’s new privacy policy on behalf of the European Union’s 27 member states, isn’t getting the kind of cooperation it would like from the search sovereign. And its patience with the company is wearing thin. So much so that it has publicly upbraided Google for its lack of forthrightness in responding to the agency’s questionnaires about the new policy.

In a letter to Google CEO Larry Page, CNIL head Isabelle Falque-Pierrotin said she’s reviewed Google’s response to its questions and found them to be sorely lacking — in clarity and specifics.

Answers, too.

“For a large number of questions, the elements provided do not give a precise, clear and comprehensive response to our questions,” Falque-Pierrotin wrote. “While in some cases the questions themselves may have been misunderstood or not clearly expressed, many answers merely provide illustrative examples without describing the exact [processes], procedures or systems Google actually operates.”

In other words, Google’s answers to CNIL’s questions were often incomplete or approximate. And while Falque-Pierrotin generously offers that this might be the result of poor communication, it’s hard to accept that as a legitimate explanation. At this point, the CNIL has clarified its questions to Google twice — once in writing, and a second time during the in-person meeting with Google executives that evidently preceded her letter. During that same meeting, Google was given a third version of the questionnaire, and a June 8 deadline to answer it.

Are we really to believe that Google — a company that prides itself on hiring PhDs, that once sought out cream-of-the-crop engineers with a “mind-bending” Google Labs Aptitude Test, whose mission “is to organize the world’s information and make it universally accessible and useful” — can’t properly answer a few questions about its privacy practices and handling of consumer data?

Because that’s about as likely as Larry Page faking his Master’s degree in computer science.

A more reasonable explanation: Google not only doesn’t want to answer these questions, it doesn’t even believe it is obligated to do so. Indeed, it essentially said as much back in April, when it specifically questioned the authority of the CNIL and the Article 29 Data Protection Working Party to even investigate it. From Google’s April 5, 2012, response to the CNIL:

1) What is the legal basis for the Working Party to act as a regulatory body, or to mandate the CNIL to conduct a regulatory review on behalf of 26 other independent DPAs?
2) What law is being applied to this review?
3) Could the Working Party explain the process being followed and the ultimate aim of the review?

Questions respectfully asked, certainly. But they clearly reflect an uncooperativeness and, more to the point, an overweening arrogance that’s so prevalent these days that it might as well be one of Google’s hallowed “10 Things We Know To Be True.” As Christian Sandvig, a researcher in communications technology and public policy at the University of Illinois, recently told the New York Times in an article on that very subject, “Google doesn’t seem to think it ever will be held accountable. And to date it hasn’t been.”

Google did not respond to a request for comment.

As Social Discovery Apps Proliferate, Sonar Aims for Greater Relevance

Mike Isaac — Wed, 23 May 2012 18:30:32 +0000

Smartphone-based social discovery is heating up. But after this year’s South by Southwest saw multiple social discovery apps debut, all touting similar features, it’s getting difficult for companies to differentiate within the space.

That’s why Sonar, one of the few apps in the category that has been around for a few years, is trying something new. Up until now, Sonar has acted much like its name would suggest: Walk into a room, and using publicly available data pulled in from Facebook, Twitter and LinkedIn, the app tells you who’s nearby, and what you may have in common with one another.

Sonar’s new tack, then, is honing in on relevance. The company launched an update to its app on Wednesday, focused on putting users in touch with others nearby that they want to see. Setting the new Sonar Status feature, for instance, is like sending a tweet out to your nearby connections, but no further. So if you’re, say, sending status updates about how awful the beer lines are at a music festival, that status will actually show up for others in your proximity — you know, the people who would actually care about that status update — but no further.

To boot, the company is also flipping on the ambient location switch, adding features that aren’t terribly different from recent competitors like Highlight, Banjo and Glancee. Essentially, the app will run in the background, sharing your location and status with those nearby without having to open the application.

Sonar insists, however, that its app will only send you push notifications if you’re near someone you actually know — in other words, a Facebook friend, or someone you follow on Twitter — instead of people you should know, a la Highlight or Banjo. And if you want to chat with someone nearby without broadcasting it to the world via Twitter, Sonar now lets users send private messages.

It’s an attempt to tackle a glaring issue in the social discovery space: How do we connect with relevant people, especially when relevance changes on a contextual basis? While I may not want to talk with someone I don’t know at a coffee shop, it may prove helpful to connect with other, less familiar people in your extended network when you’re both at a tech conference.

The great unknown at this point is Facebook, the behemoth that has its sights set on improving its mobile experience. Facebook just recently acquired Glancee, one of the competing apps in the social discovery space. It’s anyone’s guess as to how — or when — Facebook will use the technology.

Privacy Experts Weigh In on Whether There Is a Cure for "Creepy" (Video)

Tricia Duryee — Tue, 22 May 2012 23:55:43 +0000

Sometimes the Internet is a creepy place.

There are identity thieves, stalkers and people generally trying to take advantage of you.

At least that was one of the things that I took away from a privacy conference last week in Seattle, where the word “creepy” slipped into the conversation as a description of everything from location-based services to more cutting edge Internet businesses.

But advocates argued that the cure for creepy was to make services relevant and useful — not spammy and invasive. In other words, consumers are willing to share their information — age, gender, location — if there’s a benefit to them.

I moderated a panel titled “Building Trust in the Sharing Economy,” which addressed identity issues as people become more comfortable using the Internet to find babysitters, rent out their apartments or lend their car to strangers.

In those cases, honest people typically don’t mind sharing information about themselves in order to be considered a trustworthy consumer or provider. It’s a red flag if they don’t.

Sonny Singh, the VP of sales and business development at Jumio, said it’s not creepy when you show your driver’s license to Hertz when you’re renting a car or to a hotel when you’re checking in. That’s why it shouldn’t be viewed as strange when you use sharing services like Airbnb or RelayRides.

But he said, instead, “they are assuming from your Facebook profile that you are who you say you are.”

Jumio is developing technology that allows users to verify their identity by entering their credit card and driver’s license information using a webcam or camera phone.

Participants in the panel (from left to right in the picture) are: Tricia Duryee, AllThingsD; Drummond Reed, founder, Connect.me; Sam Rosen, co-founder, Scaffold; Xin Chung, CEO and founder, Trustcloud; and Singh.

Here’s a video of the whole discussion, but you can skip to around the 26-minute mark to hear the whole discussion on “creepy.”

FTC Adds Privacy Expert to Help Shape Public Policy

John Paczkowski — Mon, 21 May 2012 19:42:04 +0000

The Federal Trade Commission will soon have a new adviser to shape its thinking on Internet and mobile market issues. Paul Ohm, a University of Colorado law professor and former federal computer-crimes prosecutor, will join the agency in late August, taking over for Columbia University professor Tim Wu. At the FTC, Ohm, who has been at the forefront of a lot of debates about how best to apply Fourth Amendment privacy rights in the 21st century, will advise commissioners and staff on policy and enforcement cases.

SceneTap Interview: San Francisco's Least Welcome Start-Up Explains Itself (Video)

Liz Gannes — Fri, 18 May 2012 17:08:47 +0000

Late yesterday afternoon, I was supposed to meet SceneTap CEO Cole Harper at a bar in San Francisco, so I could get an in-person view of his company’s nightlife monitoring system that was set to debut today at various local venues.

More than an hour after we were scheduled to meet, Harper finally emerged from the bar. We were no longer welcome to do a press interview inside, he said.

The manager had been tearing Harper a new one, after getting hostile phone calls all week about the SceneTap launch, which local paper SF Weekly wrote up under the headline “San Francisco Bars to Install Creepy Facial Detection Cameras Inside Venues.”

Of the 25 San Francisco bars supposed to launch with SceneTap today, about 10 dropped out after the outcry, Harper said. That hasn’t happened in any of the other six cities where SceneTap is live.

As we finally sat down at a nearby Starbucks, Harper insisted that his company was misrepresented. SceneTap doesn’t record video about patrons or, as the article said, “keep tabs on them via facial recognition technology.” Rather, it quickly scans new entrants at each venue to determine aggregate numbers of people, their genders and ages.

The point is to help people decide where to go by getting a sense of who is already there.

The SceneTap system includes a sensor on the ceiling at each venue’s entrance as well as a nearby camera-like sensor for facial detection — a fuzzier version of facial recognition — that describes and time-stamps each person. No photo or video recording takes place, Harper said.

Bars can pay Austin-based SceneTap a subscription fee to get analytics about their own patrons. Users — currently just under 100,000 of them — can check SceneTap’s iOS, Android and Web apps to see what’s going on locally or elsewhere.

Harper just posted a long open letter addressed (rather broadly!) to the city of San Francisco, assuring them he is not a bad guy with bad intent:

“I realize there are aspects of our technology that could appear to be controversial and raise serious red flags for people, and I assure you I’m not taking it lightly. … Unfortunately, I think I underestimated the controversial aspects of this technology and what the public’s reaction would be,” he wrote.

Harper elaborated in our interview, “Every single bar that we’re working with already had surveillance systems and cameras recording and other things that were extremely intrusive, in the general opinion,” Harper said. “What we’re adding on is really just a layer that helps from a marketing and social element.”

On the one hand, I see his point; the SceneTap set-up is definitely not as bad as it could be. It’s not posting women’s social media profiles on a map like “Girls Around Me.”

On the other hand, it’s not really that hard to decide what bar to go to! And it’s still offputting to think about the system guessing my age and gender and posting it, even in anonymous aggregated form, on the Internet.

Here’s Harper explaining himself and his company, in a video from our interview:

[ See post to watch video ]

$$FB$$ Has Arrived: So Now What?

Mike Isaac — Fri, 18 May 2012 12:01:38 +0000

It’s here.

Facebook, the 900-million-strong social network that knows more about us than even our closest friends, will become a publicly traded company within the next hour.

Private equity dealmakers will celebrate alongside cadres of newly minted millionaire engineers in Menlo Park, Calif., while retail investors the world around will clamor amongst themselves, tooth and claw, for the chance to share in a mere fraction of the riches.

And yet, after a year of watching tech IPOs — Zynga, Groupon, LinkedIn, Yelp — let’s all admit that it kind of borders on anticlimactic.

We know we’ll most likely see a nice pop in the share price after Mark Zuckerberg rings in the Nasdaq bell remotely from Facebook’s spanking-new HQ in Silicon Valley.

From there, like a floating jump ball up for grabs, the social networking giant’s closing stock price is anyone’s guess — and by the looks of my Twitter feed, everyone’s guess. There’s already a site dedicated to tracking what price Facebook’s stock will settle at when the markets close, a page peppered with numbers posited by the digital elite.

Today is about the money. And yet it is also more than just sitting and watching the ticker tape roll by. For the first time, Zuckerberg’s vision of making the world a more open place will finally apply to his own company.

We got our first taste of it when the company filed its S-1. It’s where we saw that more than half of Facebook’s 900 million monthly visitors are visiting the site via mobile devices, a channel in which the company has yet to figure out a coherent or viable monetization strategy.

We saw that Zuckerberg retains a tight grip on the company’s future — tighter than most CEOs, akin to the likes of Google’s co-founders — holding voting rights on 57.1 percent of Facebook’s mighty class-B shares. He is so tied to his company that he is cited as a risk factor in Facebook’s S-1, of course.

And now we’re witnessing the first defectors from Facebook’s nacent advertising strategy, as with General Motors pulling its $10 million dollars in advertising on Facebook earlier this week, citing it as an ineffective use of the company’s massive marketing budget.

What we’ll soon see is Facebook’s less-pretty public profile, so to speak, with Zuckerberg holding court over earnings calls every quarter, taking heat from investors who expect returns. We’ll be given insight into how the company plans to monetize its different products, and how they actually fare.

Just as Facebook knows so very much about each of us, we, too, will begin to learn a lot more about Facebook.

And yet, through all of this, no matter what grim forecast Wall Street projects, no matter what executive decisions or company road maps the media decries, Zuckerberg’s message is clear — so much so that he made it the poster for the pre-IPO all-night hackathon:

“Stay focused and keep hacking.”

Good luck with that.

(Images: (top) Morin Uwole/Facebook; (bottom) Victor Luu/Facebook)

Twitter Tailors Your "Who to Follow List," but Only if You Want It

Mike Isaac — Thu, 17 May 2012 23:18:38 +0000

Twitter began rolling out tailored suggestions for users to follow on Thursday, aiming to give Twitter newcomers better direction in learning how to navigate the somewhat abstruse microblogging platform. The suggestions stem from a tracking cookie Twitter sends to new users, allowing the company to see sites visited within the past 10 days. Twitter then uses that information to recommend who to follow. Users can also opt out of this service.

Twitter Enables "Do Not Track" Feature Across Supporting Browsers

Mike Isaac — Thu, 17 May 2012 16:59:38 +0000

Twitter users on supported browsers can now opt out of being tracked by third-party sites and cookies by enabling the “Do Not Track” feature, Twitter announced on Thursday. Federal Trade Commission CTO Ed Felton championed the feature at a conference in New York on Thursday morning. Since Mozilla first introduced the feature for its Firefox browser last year, the company claims nearly 10 percent desktop-user adoption of DNT, and almost 20 percent on Firefox for mobile.

Klik App Does Mobile Facial Recognition in Real Time

Liz Gannes — Thu, 10 May 2012 13:00:00 +0000

Is taking pictures of your friends on your phone, tagging their names and uploading them just too darn hard? Now there’s a free helper app for that, called Klik, which launches out of testing today on the iPhone.

Using facial recognition, Klik can identify people even before a photo is taken — if you hold up your phone to take a picture of someone, Klik will guess who it is by hovering that person’s first name over the person’s head. If the app doesn’t get it right, it will give you its top choices and you can teach it to improve. Then Klik helps users share the tagged photos on Facebook, Twitter, email and its own public social network.

The app is made by Tel Aviv-based Face.com, which already offers a facial-recognition API to 45,000 developers to enable them to do things like unlock users’ computers by recognizing their faces.

Even if it’s not realistically that huge of a time-saver, Klik is a pretty nifty parlor trick. That goes for other facial-recognition apps, too.

But at the same time, facial recognition is right on the edge of many people’s Internet creepiness comfort level.

Facebook touched off a privacy backlash last year, especially in Europe, when it enabled automatic photo tag suggestions. And Google has sworn it won’t do mobile facial recognition. Google built such technology, but decided never to release it because of the potential for abuse, Google chairman Eric Schmidt said at D9 last year.

Since then, Google+ did introduce a photo recognition feature — but it’s only enabled for the faces of people who have opted into it.

Klik does limit its facial recognition to people you already know. Once you submit your Facebook credentials, the company crunches all of your photos, your friends’ photos and the photos in which you and your friends are tagged. That is often a ton of pictures of faces — and it can take up to a full day to import and analyze them.

Face.com, which raised $4.3 million led by Yandex in 2010, told me it is near profitability, based on charging a sliver of top developers for API usage.

Hackers Post Mostly Inconsequential Twitter Account Data Online

Mike Isaac — Wed, 09 May 2012 00:59:51 +0000

Someone claiming to be affiliated with the “Anonymous” hacker movement posted thousands of Twitter usernames and passwords to Pastebin on Monday evening. A Twitter spokesperson told AllThingsD that the company was looking into the matter, and pointed out that nearly half of the 55,000 accounts listed are duplicates and spam accounts. The company is pushing out new password requests to affected accounts.

Remember Carrier IQ? Well, It's Still Around and Kicking.

Ina Fried — Tue, 08 May 2012 20:47:33 +0000

After being at the center of a privacy storm last year, Carrier IQ is aiming to rebuild its business.

For those who don’t remember, Carrier IQ is a start-up that sells software that tracks various goings-on inside a cellphone to help cellular carriers and device makers better understand problems on the device.

An uproar occurred last November after a report suggested that the company might be logging all of a user’s activities. Even as Carrier IQ clarified what it was and wasn’t doing, concerns over the product remained.

The Mountain View, Calif., start-up didn’t lose any of its major customers entirely, but its software is definitely installed on fewer phones now than it was before the controversy.

But its executives insist that software that resides on the device, like its own, is critical to understanding connection issues, battery drain and other problems that plague today’s smartphones.

“Having us there is really the only way the industry is going to make improvements that are necessary,” VP Andrew Coward said in an interview at the CTIA trade show in Orlando. “Our technology can take 10 minutes off a customer support call.”

Carrier IQ has taken a couple key steps in its effort to change its image.

Earlier this year, Carrier IQ announced plans to create a way for customers to see firsthand some of the data that is being captured on their phones. That process is still ongoing as Carrier IQ works with the cellular firms to suss out which data they want to share and in what forms.

On Tuesday, the company announced it has hired former Verizon lawyer Magnolia Mansourkia Mobley as its new general counsel and chief privacy officer.

Mansourkia Mobley said that the company is looking to be a strong voice in a broader industry discussion around privacy.

“I don’t think this is something that is limited to Carrier IQ,” she said, saying it is an issue affecting the whole online world. “We plan to be an active member of those discussions.”

The solution, she said, isn’t for Carrier IQ and other small companies to do a lot of work creating their own customer Bill of Rights.

“I don’t think that’s an effective way of delivering something that is meaningful to a consumer,” she said.

The company has also shifted some of its attention more globally. For example, while the company had a booth at Mobile World Congress in Barcelona, it opted not to do the same here in New Orleans.

Although it would always love more U.S. business, Coward said the company is already well known here and counts three of the big four U.S. carriers (not Verizon) as its customers, along with Leap Wireless.

“We’re spending a lot of time in Europe right now,” Coward said. “The same issues with handsets exist globally. It’s not just a U.S. issue.”

RELATED POSTS:

With No Apple or Amazon at CTIA, iPad Rivals Free to Sling Arrows

Sprint, Verizon, AT&T and T-Mobile CEOs Square Off in New Orleans

Remember Carrier IQ? Well, It’s Still Around and Kicking.

Sprint Product Exec: Launching LTE Devices Before Network Just Makes Sense

FCC Chairman: Rejection of AT&T’s T-Mobile Deal Isn’t Causing Higher Prices

Boingo Adds VPN and Crowdsource Hotspot Data to Its Wi-Fi Software

T-Mobile CTO: Network Should be Ready for iPhone Users by Q4

Interview: AT&T’s Glenn Lurie on Being the New Sheriff in Town

Another Day, Another PayPal-esque Digital Wallet: Here’s MasterCard’s High-Tech Billfold

CTIA Gets Down to Business in the Big Easy

AT&T Aims to Break Into the Home-Security Business

Interview: CTIA Boss Steve Largent Aims To Keep Conference From Being Lost in the Shuffle

Myspace in Privacy-Policy Settlement With FTC

Ben Fox Rubin — Tue, 08 May 2012 19:45:33 +0000

Social-networking service Myspace settled allegations by the Federal Trade Commission that it misled millions of users about its sharing of personal information with advertisers, the FTC said.

The settlement, which comes amid social-networking heavyweight Facebook Inc.’s plans to go public, requires Myspace to implement a comprehensive privacy program, calls for regular and independent privacy assessments for the next 20 years, and bars the company from future privacy misrepresentations.

Read the rest of this post on the original site »

New From Google Labs: Orwellian Surveillance Apparatus

John Paczkowski — Tue, 08 May 2012 10:33:42 +0000

Google may have put its Street View data-collection debacle to rest in the U.S. with the payment of a $25,000 fine to the Federal Communications Commission, but in Europe it may not get off quite so easily.

There, lawmakers are calling for a stronger response to Google’s collection of personal data from the Wi-Fi routers of unsuspecting households. And the rhetoric of condemnation for the company’s actions is ramping up.

To wit, European Union Justice Commissioner Viviane Reding’s recent comments to Der Spiegel, decrying Google as an “Orwellschem Überwachungsapparat.”

That’s German for “Orwellian surveillance apparatus.”

Which is a pointed and nasty criticism of Google’s practices, particularly coming from an EU justice commissioner. Evidently, Reding was not at all happy to discover that Google’s harvesting of sensitive personal information from unsuspecting households was neither a mistake nor the work of a rogue engineer, as the company had long maintained. Said Reding, “My impression is that Google has trampled European data protection legislation.”

Google’s Street View debacle is still being reviewed by regulators in Germany and France.

Apple Ordered to Produce Documents in Suit Over iPhone Location Data

John Paczkowski — Sat, 05 May 2012 13:18:26 +0000

Another legal headache for Apple. A California judge has greenlighted a class action lawsuit accusing the company of collecting users’ iPhone location data without their express permission.

U.S. District Judge Lucy Koh ruled this week that the discovery phase of the class-action lawsuit will proceed and ordered Apple to turn over relevant documents to the plaintiffs’ legal team by May 17, without any “game play.”

An unfortunate turn of events for Apple, which fought to have the case tossed, arguing that the plaintiffs have so far failed to prove that they suffered any injury at Apple’s hands.

Apple did not respond to a request for comment on the ruling.

Stateside Facebook Users Still Leaving the Curtains Open on Profiles

Mike Isaac — Thu, 03 May 2012 16:31:31 +0000

For the amount of discussion about our online identities in the digital era, you’d think we’d all be careful to keep our social network profiles in check. And yet a significant number of users aren’t as buttoned-up as they probably should be.

More specifically, I’m speaking of the 13 million U.S. Facebook users who don’t seem to care about using the site’s privacy controls, by Consumer Reports’ count. According to a study recently conducted by the magazine, nearly one-tenth of Facebook’s 169 million monthly active Stateside users haven’t touched the controls at all.

Part of that may be indifference, the report says, but a significant portion can also be chalked up to plain ignorance of exactly how those Facebook privacy controls work. Which, to some degree, even Facebook has seemed to acknowledge. After Google+ premiered last summer, complete with “Circles” — its excellent granular control system that allows users to easily compartmentalize exactly what info they’re sharing and with whom — Facebook tweaked its privacy controls to make it easier on its user base.

To be fair, 13 million is essentially a drop in the social bucket when compared to the 900-million-plus Facebook users from around the world that visit the site every month.

Still, it’s a signal that Facebook’s privacy settings aren’t as upfront and accessible as they could be.

(Image courtesy of Isabisa/Flickr)

WTF Is CISPA?

Beth Callaghan — Tue, 01 May 2012 23:45:28 +0000

With SOPA and PIPA out of the picture, it seemed like digital privacy was less threatened by cybersecurity interests. Then along came the new bill on the block, CISPA. The Cyber Information and Security Protection Act passed the House Thursday and has some far-reaching implications, as well as some interesting supporters. Greg Voakes of Paralegal.net lays out the broad strokes below.

Created by: Paralegal.net

Facebook's New "Life-Saving" Tool? It Could Be for Fighting Cyberbullies.

Mike Isaac — Tue, 01 May 2012 00:25:30 +0000

Facebook isn’t doing many public appearances these days in the lead-up to its IPO. But that’s not stopping the company from teasing a new Facebook feature on live television.

Slated to air Tuesday evening, ABC News has snagged interviews with Mark Zuckerberg and COO Sheryl Sandberg, in which the two will debut a mystery tool “which has the power to save lives,” according to the company.

I doubt it’s a Facebook-branded Life Alert bracelet — “I’ve been poked and I can’t get up!” — and Facebook is keeping mum on details until the interviews air.

My best guess? It’s most likely another project involving Facebook’s efforts to fight cyberbullying, that online scourge that has kids harassing one another across social networks.

It’s a logical move, especially after increased attention following the spate of suicides spurred by cyberbullying over the past few years. Not to mention the 20 million users under the age of 18 that regularly use Facebook. There’s also increased attention of late related to the documentary “Bully.”

Thus there is increasing pressure from governmental bodies due to the issue. Nearly every state is either working on or has already enacted legislation to combat cyberbullying, cyberharrassment or cyberstalking, according to the National Conference of State Legislatures.

To boot, this isn’t Facebook’s first anti-cyberbullying rodeo. Nearly a year ago today, Facebook introduced a suite of tools to combat cyberbullying on its site. And the company has moved toward strengthening those measures consistently over the past three years.

Facebook isn’t responding to my request for comment.

(Image courtesy of J_O_I_D/Flickr)

PGP Creator Phil Zimmermann Has a New Venture Called Silent Circle

Arik Hesseldahl — Mon, 23 Apr 2012 15:36:10 +0000

It has been a long time since anyone thought seriously about the encryption debate that hung over the discussion around privacy rights in the 1990s. It has also been a long time since Phil Zimmermann — creator of the Pretty Good Privacy software that so many people adopted to encrypt their email — was the target of a federal criminal investigation that derived from his making it widely available for download. The government dropped its case in 1996. Today, PGP is the most widely used encryption program in the world. PGP, the company, is part of Symantec, and encrypting your email is now super easy, though most people don’t go to the trouble of doing it.

PGP is the reason Zimmermann is going to be inducted into the Internet Hall of Fame today, at a dinner in Geneva. Which, of course, raises the question: What is he doing these days?

The answer: Launching a new venture. It’s called Silent Circle, for which Zimmermann has teamed up with two former Navy SEALs and one of his PGP Corp. co-founders. The plan is to offer encrypted email, encrypted mobile calls, encrypted VOIP teleconferencing and encrypted instant messaging, all in one place.

Joining Zimmermann in Silent Circle are Mike Janke, a former Navy SEAL sniper, special operations communications expert and privacy advocate; Vic Hyder, another former Navy SEAL and founder of Maritime Security; and Jon Callas, a cryptographer and Zimmermann’s co-founder of PGP Corp., whose current day job is CTO at Entrust.

Silent Circle will offer services both to consumers and corporations, but also to human-rights groups, dissidents and nongovernmental organizations working in dangerous or sketchy places where governments tend to monitor communications. There’s also a promise of no backdoors offered for any individual, organization or government.

Though Silent Circle is now running a private beta, the plan, as I understand it, is to launch a public beta on July 15. We’ll hear more about it then.

Update: I initially spelled Zimmermann’s name with only one N. Sorry about that.

Markey, EPIC Won't Let Google Wi-Spy Die

John Paczkowski — Wed, 18 Apr 2012 22:03:39 +0000

Rep. Edward Markey, D-Mass., isn’t satisfied with the Federal Communications Commission’s investigation of Google’s surreptitious collecting of Wi-Fi data from residential networks. Nor is he happy with the slap-on-the-wrist fine the FCC imposed on the company, claiming Google “deliberately impeded and delayed” the agency’s investigation. So he’s calling on Congress for a broader probe into Google’s Wi-Spy debacle.

And he’s not the only one. In a letter sent to U.S. Attorney General Eric Holder, the Electronic Privacy Information Center (EPIC) also called for another investigation, this one by the Department of Justice.

“Given the inadequacy of the FCC’s investigation and the law enforcement responsibilities of the attorney general, EPIC urges the Department of Justice to investigate Google’s collection of Wi-Fi data from residential Wi-Fi networks,” EPIC Executive Director Mark Rotenberg wrote. “By the [FCC’s] own admission, the investigation conducted was inadequate and did not address the applicability of federal wiretap law to Google’s interception of emails, usernames, passwords, browsing histories and other personal information.”

Pointed criticism of the FCC’s investigation into Google’s Street View street-mapping service, both. But some would argue well deserved. One would think that a serious inquiry into the issue would have at least included interviews with the employees involved in the data collection. But according to the FCC, Google decided that making those employees available for questioning “would ‘serve no useful purpose.’”

Perhaps the DOJ could persuade Google to be a bit more cooperative.

PREVIOUSLY

France to Google: Your CEO Is a Hamster and Your “Rogue Street View Engineer” Smells of Elderberries

Lawmakers Would Like a Word With Google’s “Rogue” WiSpy Engineer

Connecticut Won’t Press for Google WiSpy Data, Looks to Settle

Well, Hell, If I Knew All I Had to Do Was Seize the Hard Drives…

Look, Sergey, a Christmas Card From the Connecticut AG! Wait…

Google Street View Privacy Debacle Far From Over

FTC Closes Google Street View Probe

Google CEO Apologizes for Street View Schmidtstorm

Google CEO’s Advice to the Street-View Shy: The Video

Schmidt: Don’t Like Google Street View Photographing Your House? Then Move.

Mr. Schmidt, There’s an Inspector Lestrade on Line One

State AGs to Probe Google’s “Deeply Disturbing Invasion” of Wi-Fi Data

No Harm, Big Foul: Google Intercepted Passwords and Email Extracts

Germany Questions Google’s Data “Mistake”

Google Street View Cars Collected Wi-Fi User Data for Three Years

Banjo's Response to Congress on iOS Address Book Privacy (Letter)

Liz Gannes — Wed, 18 Apr 2012 16:23:22 +0000

After it was discovered that Path and other mobile apps accessed and stored users’ address books without necessarily asking for their permission, the U.S. Congress got involved and asked 34 social iOS app makers to describe their privacy practices.

The deadline to respond to that request — sent by ranking members of the Energy and Commerce Committee — was April 12.

The location app Banjo got in touch with us to share its response. Basically, Banjo is willing to draw attention to itself on this issue because it says it didn’t do anything wrong — it never transmitted or stored users’ contacts, and it is designed around adherence to users’ location data privacy settings on various networks.

Banjo CEO Damien Patton says his app was included in the inquiry only because it had been on the list of social networking apps in Apple’s iPhone Essentials category during the week the congresspeople got interested. Banjo is a location aggregation app with one million users.

I’ll forgive a little privacy grandstanding on Banjo’s part, because I think it’s interesting to see the reply. If others of the 34 apps want to share their responses, I would probably publish them as well.

120412 Banjo Response to Waxman_Butterfield

Selling You on Facebook

Julia Angwin and Jeremy Singer-Vine — Sun, 08 Apr 2012 02:41:42 +0000

Not so long ago, there was a familiar product called software. It was sold in stores, in shrink-wrapped boxes. When you bought it, all that you gave away was your credit card number or a stack of bills.

Read the rest of this post on the original site »

So What Exactly Can Location Aggregators Do With Our Foursquare Data?

Liz Gannes — Tue, 03 Apr 2012 13:00:51 +0000

You might have heard about the Girls Around Me scandal this weekend, where an app got taken down that correlated Foursquare check-ins with Facebook profiles to show nearby women on a map.

The widespread analysis of the matter was that Girls Around Me was creepy, but that people should realize that when they publish their locations online, bad things may happen. Technology writers, in our enthusiastically adopted roles as the white knights of online privacy, urged readers to lock down their Foursquare and Facebook profiles.

The situation made me curious about what, exactly, location aggregators are being allowed to do with our location data. It’s one thing to share where you are with your friends, or with what you think is a small audience of early adopters. But what’s more tricky — and can often feel icky — is when that information is exposed in a different context.

According to Foursquare, Girls Around Me broke its platform policy by aggregating information across venues. That got the app’s API access yanked. But Foursquare apparently wasn’t effectively policing API use, because the app launched in December and seems to have gone unnoticed until bad press brought it to light.

In its public rebuttal, Girls Around Me developer i-Free argued that other apps, like Banjo and Sonar, “provide the same or more extended functionality using location data provided by APIs of major social networks.”

Is that true? On Quora, Foursquare platform evangelist Akshay Patil went into detail about what rules i-Free was breaking, and what others are doing that’s okay. (A Foursquare spokeswoman confirmed to me that his answer was legit and accurate).

Patil said the specific problem was a part of the Foursquare API called “herenow,” that shows which users are currently checked in at a location. These are the groups of little user faces that logged-in Foursquare users can see when they look up any place within the system (it’s easiest to look up places nearby, but you can manually check any venue). Outside developers aren’t allowed to aggregate that information across multiple venues.

Plus, Girls Around Me was threatening or invasive of users’ privacy, did not have a privacy policy, and misused Foursquare’s trademarks, Patil said.

Patil said Foursquare planned to make the restrictions around this “herenow” data clearer in the future.

But what about those other people-seeking applications built on top of Foursquare, like Banjo, Sonar and wheretheladies.at?

This is where it gets a little tricky, with each app doing something a bit different. Banjo doesn’t use check-ins that are shared only with other Foursquare users. I believe the app used to do this in its very early days, but currently Banjo only aggregates Foursquare check-ins when they are publicly cross-posted to Twitter.

Meanwhile, Patil said that Sonar does use “herenow,” but only on a venue-by-venue basis, and more tastefully than Girls Around Me. The main interface for Sonar is a list of nearby venues with the number of people at them, but you have to click on each place to see the people there, so that seems to be the distinction. There’s also no map view.

Wheretheladies.at, which was a side project of two guys from Path and Milk that was also built around women’s Foursquare check-ins, now appears to have been taken down as well (update: Scratch that; it’s up now). But Patil said that app’s Foursquare API use was okay because it showed counts of number of women at a venue, not user identities.

I know I’m getting deep into the weeds, and I apologize for that — but I think clarity around these details is important. What’s clear is that Foursquare needs to be more vigilant about policing developers access to its users’ location information. And users obviously need to be aware that it’s possible that their check-ins could be misused, so they should be careful.

But the reason people use Foursquare is not to have more privacy.

The point of sharing our locations is to explore new places, meet new people, and brag about doing cool stuff. I doubt that the majority of the population will be volunteering where they are on Foursquare anytime soon. But those of us who want a little more serendipity in our lives now know a bit more about how our information will be used.

"Girls Around Me" App Maker: We Pulled Out of iTunes, but We Didn't Do Anything Wrong

Peter Kafka — Sun, 01 Apr 2012 12:35:46 +0000

You can’t get “Girls Around Me” from Apple’s iTunes store anymore, and the company behind the app says it took it out voluntarily.

Sort of.

Russian developer i-Free Innovations says it yanked “Girls Around Me,” which was supposed to let users learn about/track down women in their area, because it didn’t work anymore.

The app was supposed to mash up data from Foursquare, Facebook and Google Maps. But Foursquare had cut off access to its data after tech blog Cult of Mac first raised privacy concerns about the app.

But i-Free also insists that it wasn’t doing anything wrong — all of the data it was serving up to its users was publicly available stuff, provided voluntarily by Facebook and Foursquare users.

Whether those users really understood how publicly available this data is debatable, and it’s stories like this that are going to make that debate more urgent.

For now, here’s the full text of i-Free’s statement, via The Wall Street Journal’s Digits blog:

Girls Around Me app was designed to make geo-social exploration of popular venues easy and visual.

We follow the geo-social trend for mobile devices that is supported by numerous location sharing services, networks and apps. Many other mobile apps provide the same or more extended functionality using location data provided by APIs of major social networks, i.e. Ban.jo or Sonar.

Girls Around Me does not allow anonymous usage of the app. It is impossible to search for a particular person in this app, or track his|her location. The app just allows the user to browse the venues nearby, as if you passed by and looked in the window. The Girls Around Me user has to be registered in Foursquare and must be logged in this service to be able to see anything in Girls Around Me. The app Girls Around Me does not have access to user login and password, authentication is carried out on the social network side. Girls Around Me shows to the user only the data that is available to him or her through his or her accounts in Foursquare, and gives the user nothing more than Foursquare app can provide itself (when you browse venues around you in Foursquare, you can see how many people checked in there and you can see their profiles and photos, even contacts and social networks profile). The aim of the app is to make the usage of this data more convenient and more focused on finding popular and crowded venues.

Girls Around Me has no ability to change, limit or expand information that is available to the user through his or her account in social network. Girls Around Me does not use any self-developed or third party services to search for extra information apart from the information the users share with others. Girls Around Me does not put together data from different social networks.

The Facebook accounts shown as available to send a message are the accounts that Foursquare users make public in their profiles. Girls Around Me does not allow anonymous usage of the messaging service. We made it perfectly clear that any personal message can only be sent from the user’s account in Facebook (if he or she has one), and it can be done only if messaging is allowed by privacy settings of the recipient user.

The app was out for several months already and has not been promoted in order to first to receive user feedback and address privacy concerns, if necessary. Girls Around Me was downloaded more than 70 000 times. Since the app’s launch we’ve seen numerous positive comments from users who claimed that the app helped them to discover “hot spots” – venues that are popular among girls or boys. Since the apps launch till last Friday nobody ever raised a privacy concern because, again, it is clearly stated that Girls Around Me cannot show the user more data than social network already does.

We understand that privacy is a serious matter. We were planning to continue developing the app and limit it to showing only public places and venues. We understand that user generated data might not reflect the real public or private user space (a user can indicate his private space as public and vice versa), but we intended to bring our best effort to work on the available APIs to develop filters to limit user access only to public venues shared by other users.

We are absolutely convinced that it is good and important to educate the users to take care of their privacy and what they share publicly. But we believe it is unethical to pick a scapegoat to talk about the privacy concerns. We see this wave of negative as a serious misunderstanding of the apps’ goals, purpose, abilities and restrictions. Girls Around Me does not provide any data that is unavailable to user when he uses his or her social network account, nor does it reveal any data that users did not share with others. The app was intended for facilitating discovering of great public venues nearby. The app was designed to make it easier for a user to step out of door and hang out in the city, find people with common interests and new places to go to.

We have removed the application from the iTunes Store, because the users get repetitive error message, and we feel that until we find a solution and be able to provide full service, we should restrain from acquiring new users. We shall put our best effort to support the apps existing users and address their concerns.

We are working on providing all necessary comments and data to prove our good intentions. We were (and are) making our best efforts to develop an app that fits user expectations without going beyond the restrictions of social networks.

Q&A: FTC Chairman on How Web Start-Ups Should Handle Privacy

Liz Gannes — Mon, 26 Mar 2012 21:43:41 +0000

Following the FTC’s release today of a massive online privacy policy framework, I had a few minutes to chat with FTC Chairman Jon Leibowitz. I asked him about the implications for Web and social media companies that use personal data.

credit: Win McNamee, Getty Images News

For context, the conversation started with me asking about opt-in versus opt-out product releases — which means, do you first ask your customers whether they want to use something new, or do you give it to them and let them decide if it’s useful or not. Opt-out has been the preferred choice of many companies, perhaps most notably Facebook, because it cuts out the friction of requiring additional permission.

Liz Gannes: What do you anticipate being the FTC stance around opt-in going forward? Is it reasonable to interpret the framework as pushing the industry towards opt-in policies?

FTC Chairman Jon Leibowitz: We’ve laid out some areas where we think opt-in is more appropriate. With financial information, in healthcare, when dealing with vulnerable populations like children. And if cable or phone companies want to do something analogous to deep-packet inspection, there should be opt-in.

I think we’re pretty balanced. You want to have better privacy notices, give consumers more choice, and give opt-out on tracking. When you’re talking about more sensitive populations, you might want to flip that and make it an opt-in.

We also think when you engage in best practices, what we hear from companies is consumers trust the Internet more, and they want to do more commerce.

How do you expect newer companies, for instance growing social media players like Tumblr or Pinterest, to interface with the FTC? How can they proactively avoid investigations and settlements like what you had with Google and Facebook?

We think our report strikes the right balance between privacy and innovation. I think if you’re a new company, make sure you’ve seen our cases. A large number are about making privacy commitments and not honoring them. So if you commit to something, follow through.

Leibowitz, by the way, will be appearing at our D10 conference in May.