November 2013

US officials offer few concessions on NSA spying to privacy board

The US government is open to some changes to how it conducts its phone and Internet surveillance programs as long as they do not undermine the programs' effectiveness, US officials told a privacy oversight board.

How exactly the US phone and online data-gathering programs could strike such a balance -- helping thwart terrorist plots while also protecting Americans' privacy -- is under review by the Privacy and Civil Liberties Oversight Board. No timeline has been set for the board's work, but ultimately it will issue a report to President Barack Obama and Congress on the legal standards now used for online and phone spying by US intelligence agencies and what reforms may best ensure Americans' privacy is protected. "I think we've learned a lot about some potential reforms that the government was amenable to," the board's Chairman David Medine said after a public hearing with officials from the National Security Agency, FBI, Office of the Director of National Intelligence and Justice Department. Chairman Medine said he saw some openness from government officials about updating some privacy protections for foreigners and changing how long the government keeps the records it collects. Privacy advocates worry that the programs aimed at tracking down foreign terrorists also scoop up private data about Americans, and US allies like German Chancellor Angela Merkel have complained about surveillance of their communications. "We are open to consideration of a variety of possible reforms to the program so long as they don't eliminate its utility," said DNI General Counsel Robert Litt.

Your iPad Is Now Your Kid's TV

Nielsen estimates put potential kids’ tablet viewership at 16.5 million, and while television deliveries via smartphones and tablets won’t be added to its national TV ratings until September 2014, networks are diving headfirst into this emerging market.

By and large, the kids-targeted cable networks are developing apps with the tacit understanding that distribution and measurement will eventually catch up with them. Of course, targeting kids brings with it a host of specific regulatory issues, regardless of the device, said Albert Lai, chief technology officer, media and broadcast solutions, Brightcove. “Any provider of content for kids needs to be wary of legal and federal regulation,” Lai said. “There’s opportunity, but everyone has to be very careful about the monetization.”

Lawmakers to FDA: Regulate E-Cigarettes

In its heyday, cigarettes were one of the biggest advertising categories. That's just what a growing number of policymakers fear will happen with electronic cigarettes.

Hoping to convince the Food and Drug Administration to regulate e- cigarettes, Reps. Henry Waxman (D-CA), Diana DeGette (D-CO), and Frank Pallone, Jr. (D-NJ) put together a presentation to make the case that e-cigarette companies are targeting young smokers the same way traditional cigarette companies did before they were banned from the airwaves in 1971. The FDA could make a decision about classifying e-cigarettes soon. Some states have already gone ahead and passed regulations. Utah, ND, Arkansas, NJ, and Washington, DC banned e-cigarettes indoors, and many other states are considering regulations. California bans e-cigarette ads online. Because e-cigarettes are not defined as a tobacco product, they are exempt from the regulations established under the Family Smoking Prevention and Tobacco Act.

Supreme Court notes “disconcerting” Facebook settlement, will eye future charity deals

When Facebook is sued over privacy, it has a novel way to make the issue go away: the company hands over a sum of money to lawyers and “non-profit” groups to reach a legal settlement while paying nothing to consumers.

The trick worked when the social network got into trouble over Beacon, a program which publicly displayed users’ shopping purchases, and it worked again for “Sponsored Stories,” which turned users into product pitchmen without their consent. This so-called “cy-pres” model, described in a New York Times piece this summer, has been copied by other companies, including Google and Adobe. Now, the Supreme Court is hinting that it’s had enough of companies using charity payouts to end lawsuits. Chief Justice John Roberts expressed skepticism about the Beacon settlement, which paid $3 million to class action lawyers and $6.5 million to a new privacy group called the “Digital Trust Foundation.” In a written opinion, he noted the potential for abuse and conflict-of-interest: “[The] challenge focused on a number of disconcerting features of the new Foundation: the facts that a senior Facebook employee would serve on its board, that the board would enjoy nearly unfettered discretion in selecting fund recipients, and that the Foundation -- as a new entity -- necessarily lacked a proven track record of promoting the objectives behind the lawsuit.”

New FCC chair shakes things up with first appointment

[Commentary] A number of folks here in Washington were surprised by just how supportive Public Knowledge President Gigi Sohn was of Tom Wheeler’s nomination to head the Federal Communications Commission.

Wheeler is a former head of the National Cable & Telecommunications Association, and what’s now known as CTIA – The Wireless Association, to telecommunications interest groups that Sohn often clashed with as head of one of the leading industry watchdogs. But Sohn had nothing but nice things to say about Wheeler’s appointment. Wheeler returned the favor by naming Sohn as special counsel for external affairs for the agency, a new and presumably bespoke position created just for her. The appointment of Sohn should soothe, at least for now, the concerns of those in telecommunications policy circles who were worried about having a former telecommunications lobbyist at the head of the agency in charge of policing the industry. But among those unlikely to be thrilled with the idea that Sohn has the ear of the new chairman are the Motion Picture Association of America, Recording Industry Association of America, and other media industry groups who take a very dim view of Public Knowledge’s pro-consumer views on copyright.

Are Internet-Enabled Medical Devices Safe from Hackers?

Former Vice President Dick Cheney recently reported that he had his heart defibrillator's wireless functionality disabled for fear of a hacker killing him via computer -- an unlikely but possible demise for a man with plenty of enemies. Researchers have hacked into home electricity meters wirelessly, and modern cars can now be remotely overtaken by hackers. Medical devices like pacemakers and insulin pumps also have wireless functionality, yet virtually no security measures in place. Murphy’s Law dictates that it’s only a matter of time before someone with a wireless medical device is killed by a hacker, and there’s now an effort underway to create security standards that would increase the safety of such medical devices. The Center for Internet Security (CIS) has joined with the National Health Information Sharing and Analysis Center and the Medical Device Innovation, Safety and Security Consortium (MDISS) to develop guidelines to make wireless medical devices as secure as possible, as quickly as possible.

Time Warner Cable Makes a Case for More Unlicensed Spectrum

With more and more mobile data usage moving to Wi-Fi networks, policy makers should free up additional spectrum for unlicensed use, Time Warner Cable argues in a new report. The Wi-Fi offload trend will be driven in part by consumers’ desire to save on the cost of using cellular networks for data communications, but also as a result of network operator initiatives to conserve scarce spectrum holdings, the report argues. Accordingly, policy-makers should ensure that when new spectrum does become available a portion is set aside for unlicensed use, the cable company argues.

The report makes three specific policy recommendations, including:

  1. When the FCC conducts the voluntary auction of TV broadcast spectrum, at least 30 to 40 MHz of the freed up spectrum should be reserved for unlicensed use. The unlicensed spectrum should be made available in every market nationwide.
  2. The FCC should expand unlicensed spectrum access in the 5 GHz band. Noting that most of the 5 GHz band is already shared with military and radar on an unlicensed basis using spectrum sensing technology, the FCC has proposed a 195 MHz expansion of that spectrum band. The Time Warner Cable report supports that proposal, noting that this move “will permit channels several times wider than today’s Wi-Fi at 2.4 GHz. “These wide channels enable very high-capacity wireless throughput over short distances and will be capable of speeds up to 1 gigabit per second using the newest 802.11ac Wi-Fi standard,” the report states. The authors note that this spectrum is likely to be used initially for video routing and outdoor point-to-point backhaul. But longer term, network operators may offload cellular traffic to this band, just as they are doing with traditional Wi-Fi today.
  3. The commission also should increase open access to shared spectrum. The report supports the FCC’s proposal for a Citizens Broadband Service in the under-utilized 3550-3700 MHz band. That band is currently used by the military for offshore naval radar and satellite earth stations and could potentially be shared with civilian users. Plans for this band specifically reference “small cell” use and should include licensed and unlicensed spectrum, the authors argue.

T-Mobile Finds That Giving Away Free Data Is Harder Than It Sounds

T-Mobile figures that by giving tablet users free data, it might turn a few of them into paying customers. But it turns out that giving away data is sometimes harder than it seems.

T-Mobile’s operations -- both human and computer-based -- were just not set up to have a nonpaying relationship with customers. As a result, some of the company’s new tablet customers were erroneously charged $10 per month for data that was supposed to be free. T-Mobile has since corrected the problem, and plans to issue refunds to affected customers.

Yes, there actually is a huge difference between government and corporate surveillance

[Commentary] When it comes to your online privacy -- or what little is left of it -- businesses and governments act in some pretty similar ways.

They track your credit card purchases. They mine your e-mail for information about you. They may even monitor your movements in the real world. Corporate and government surveillance also diverge in important ways. Companies are looking to make money off of you, while the government aims to prevent attacks that would halt that commercial activity (along with some other things). But the biggest difference between the two has almost no relation to who's doing the surveillance and everything to do with your options in response. Readers were asked whether they had changed their online behavior as a result of the extended national conversation about privacy -- and if so, which form of snooping annoyed you more. Looking through the responses so far, this one caught my eye: “The government because I can't *choose* not to be spied on by them. The government also has the power to kill or imprison me which no private company has.” Putting aside the government's power to capture or kill, your inability to refuse the government is what distinguishes the National Security Agency from even the nosiest companies on Earth.

In a functioning marketplace, boycotting a company that you dislike -- for whatever reason -- is fairly easy. Diners who object to eating fake meat can stop frequenting Taco Bell. Internet users that don't like Google collecting their search terms can try duckduckgo, an anonymous search engine.

How we know the NSA had access to internal Google and Yahoo cloud data

We do not know exactly how the National Security Agency and UK Government Communications Headquarters (GCHQ) intercept Google and Yahoo data, other than it happens on British territory. But we do know they are intercepting it from inside the Yahoo and Google private clouds, because some of what NSA and GCHQ collect is found nowhere else.

The two companies do not entrust their data center communications to the “public internet,” which is comparable to an international highway system that anyone can use. Instead, they link their data centers with thousands of miles of privately owned or privately leased fiber optic cable – in effect, a system of private highways. When Google and Yahoo have to share a stretch of road with the public internet, they take other precautions to keep their traffic secure. We showed some of the NSA’s briefing slides to private sector experts with detailed knowledge of the internal corporate networks of each company. In separate conversations, they agreed that the slides included samples of data structures and formats that never travel unencrypted on the public Internet. “This is not traffic you would encounter outside of Google's internal network,” said one of the experts. The slide shows data in a format that is “only used on and between Google machines. And, also as far as I know, Google doesn't publish their binary RPC protocol, which is what this resembles." An RPC is a “remote procedure call,” and this one is used when one Google data server has to confirm that it is talking to another. Another NSA slide provided by former contractor Edward Snowden showed that the NSA developed Google-specific “protocol handlers" so that it could parse the company’s proprietary formats and pull out the information it wanted to keep.