Hamza Shaban | The Verge

Will the internet of things finally kill privacy?

2015-02-11T09:30:02-05:00

In the internet of things, the Federal Trade Commission sees the possibility of flourishing new markets. But it also sees a prologue to Black Mirror: in a new report that probes the privacy implications of connected devices, the commission surveys a landscape of possible dystopian futures. Get ready for invasive marketing, unending consumer surveillance, invisible nudging, and new potential for government spying and novel forms of hacking.

The report seeks to identify the dangers to consumers presented by the internet of things. How might information gleaned from a car GPS, fitness tracker or smart refrigerator lead to negative effects on your creditworthiness, employability, or insurance premiums? As a prelude to the development of best practices, and perhaps new legislation, the FTC aims to establish industry standards for data gathering and use.

Get ready for invasive marketing

While the FTC does not call for a law specific to networked devices, it does invite Congress to pass broad data-security legislation that would shield consumers, at least in part, from the headline-screeching data breaches like those that recently afflicted Sony, Target, and Home Depot. And it preaches a gospel of data minimization: companies ought to keep as little data as needed, dispose of it when it’s no longer required, and strip identifying information out of it when possible.

As a political document, the FTC’s report has the sterile touch of evenhandedness. In its pursuit to illuminate the social ramifications of car trackers, healthcare wearables, and thinking thermostats, the commission had to simultaneously manage the regulatory anxiety of hardware manufacturers, analytics firms, and insurance providers. And in the Beltway balancing act of public interest on the one hand and capital “I” Innovation on the other, the FTC appears almost too timid to follow through on its own research.

That the pervasive collection of information from within our homes might create automated forms of profiling, discrimination, and exploitation seems, to the commission, merely secondary to reassuring strategic business interests. But the FTC has started a conversation that many privacy experts are eager to continue. Compared to Congress, which has an internet of things hearing scheduled for today — led by Senator John Thune (R-SD) who’s vying to maintain a laissez-faire capitalism approach to data privacy — the FTC will likely remain the stronger advocate for reform.

The growing powers of corporate surveillance

I spoke with David Rose, CEO of Ditto Labs and a researcher at MIT Media Lab, about the challenges posed by connected objects to consumers and society. Rather than focus on insidious government supervision — of the thought-policing Snowden variety — Rose emphasized the growing powers of what we might call corporate surveillance. Connected devices enable corporations to amass evermore granular intelligence about customers to better predict our shopping habits. According to Rose, even as companies like Acxiom and Epsilon have been compiling data address by address on every family in America with thousands of fields for every household, the unexpected uses of consumer data are evolving. And they’re doing so in ways that aren’t clear to the public.

Rose explained the business potential of tailored advertising and marketing inference using his own company’s work. Ditto scans publically available photographs on social media. And based on who’s driving a Jeep, clutching Prada, slugging a Red Bull or sporting Patriots gear he’s able to draw conclusions on what consumers prefer and what purchases they might be “susceptible” to in the near future. “We call it affinity data,” he said.

Beware predictive analytics

Pam Dixon, the executive director of the World Privacy Forum, is concerned less with marketing novelties than with other unsettling uses of data harvesting. “I think we have to be very conscious about focusing on advertising as the horrifying thing here,” she told me. “It’s not the fact that someone sees an ad for a shoe. The problem is the secondary uses by data brokers and in predictive analytics.”

As a broad example, Dixon described a situation where, in exchange for a premium discount, an insurance provider might require customers to wear an activity tracker in their house, perhaps counting their steps, measuring their stress, or recording the things that they eat. For individuals with chronic diseases, who require wheelchairs, have PTSD, or were born with genetic disorders, this paradigm swallows people up and spits out systemic bias. The model assumes that “everyone is young and fit, or can become that way,” she said.

It’s also unclear what boundaries exist for employers, insurance companies and law enforcement to act upon personal data gathered by sensor-based devices. Questions like who owns the data, where it is stored, if it’s encrypted, how it can be used, and whether the data can be repackaged and sold for purposes not expected by consumers remain unanswered.

“The FTC, I think, would like to see legislation about this,” Dixon said. “There’s just no roadmap that says here’s how we do that in the internet of things. There’s just none,” she said.

“There’s just no roadmap.”

Despite these criticisms, certain consumers stand to gain by allowing remote monitoring of their vehicles, homes, and bodies. Scott Peppet, a professor at the University of Colorado School of Law, has studied the economic incentives that propel the growing trend of voluntary disclosures. It’s a trend the internet of things is likely to accelerate.

Until recently, firms have mined publicly available data to create rough profiles of consumers based on their purchases, credit history, driving record, and other factors. With its ubiquitous data-reaping technology, the internet of things allows firms to simply verify information with our permission. Companies get real-time access to how fast we drive, how often we brake, and how quickly we turn. Good drivers will get cheaper car insurance. Bad drivers will likely pay more.

“Simple self-interest will drive self-disclosure by those with favorable private information,” Peppet writes. The healthiest and wealthiest among us, those with the strongest credit lines and best reputations, will wish to signal their vitality and income to the insurers, banks, and retailers that will trade preferential treatment for verified consumer data.

where consumer choice is a mirage

But this “opt-in model” only looks like consumer choice, Peppet argues. In fact, he says, it’s a mirage. Immense economic pressure could eventually coerce everyone into sharing their information with firms, since not disclosing your data will itself imply that you are undesirable. Or that you carry a high burden of risk. The economic punishment of non-disclosure, Peppet suggests, will be worse than actually sharing your Chipotle fixation. “Eventually, even those with the worst private information may realize that they have little choice but to disclose to avoid the stigma of keeping information secret,” he writes. In Peppet’s future of full disclosure, privacy will become unraveled because opting out will be too costly. In order to compete for work, to become eligible for attractive loans and to qualify for affordable insurance, we’ll have to pay the price of our personal data. To participate, to make our lives fully visible to corporate actors, will be the only real option.

Dixon, Peppet and others advocate the enforcement of data-use restrictions. Privacy scholars cite the FCRA, which regulates consumer reporting agencies, and GINA, a law that keeps genetic information off limits to insurance pricing and employment decisions, as legislative models to draw from.

The FTC has to nod pleasantly to the industries it regulates. But the internet of things has dragged the agency into unfamiliar territory. Deference to industry in the absence of any true data privacy rules represents a judgment that market efficiency is more important than potential social harm. The internet of things may very well generate profound convenience, improved quality of life, and perhaps even wonder! But it may also render old prejudices invisible, sorting and ranking and pricing us not just by who we are but how we behave in our most intimate spaces. What stories will be told by the accumulated whispers of inanimate objects? The benefits of enriched datasets may be obvious. The costs, however, are not.

Here’s how the new Republican Congress plans to undercut net neutrality

2015-01-21T10:30:02-05:00

The widespread national popularity of net neutrality principles have pushed the new Republican Congress, however tentatively, to embrace some of its core concepts. With two congressional net neutrality hearings scheduled for today, Republican lawmakers have released draft legislation that would ban broadband providers from discriminating against certain kinds of web traffic. But even as the draft bill appears to enforce fundamental tenets of net neutrality, it explicitly undermines the legal authority of the FCC. And advocates say that if passed, the bill could create new obstacles to an open internet.

First, the good news: The proposed law would prohibit data throttling, blocking, and internet fast lanes. It would also require providers to share with consumers information about the performance of their internet service. But the Republicans behind the proposal, Senator John Thune (R-SD) and Representative Fred Upton (R-MI), argue that broadband providers should not be reclassified under Title II of the Communications Act, a move that would allow the FCC to regulate ISPs more like public utilities. (This reclassification was recently endorsed by President Obama.) Instead, congressional Republicans believe that broadband should remain an “information service,” a designation that affords less oversight. (The Republicans’ rationale: government interference would hamstring investment and innovation.) The bill also prevents the FCC from relying on a crucial piece of telecommunication law that would allow the agency to regulate broadband providers in the future.

Republicans believe that broadband should remain an “information service,” a designation that affords less oversight

A critical reading of the bill finds the Republicans eager to pay lip service to net neutrality while stripping the open internet of key protections. A law that relegates the telecom’s chief regulatory watchdog into a large stack of three-ring binders isn’t exactly an advocate’s dream. The bill gestures towards addressing the loudest demands surrounding net neutrality. But its rules would also leave the FCC largely inert. And a skeptical interpreter reads the proposal and sees the handwriting of telecom industry lobbyists: it may not be drafted by the colossal internet companies it’s meant to regulate, but all the power squeezed from regulatory ambiguities is channeled in their direction. When Republicans describe this bill as true net neutrality, it might be suitable to tell them: You keep using that word. I don’t think it means what you think it means.

I don’t think it means what you think it means

On February 26th, the five commissioners of the FCC plan to vote on their own net neutrality proposal. Their decision would dictate the rules of the road should Congress fail to pass a law beforehand. Thune and Upton’s legislative push can be seen as a way to subvert the FCC’s vote, wresting control of the issue away from the federal agency and into the hands of the newly Republican-controlled Congress. While many obstacles stand in the way of the bill becoming law — the president’s likely veto chief among them — the proposal nonetheless represents a turning point in the debate.

Simply put, the popularity of net neutrality poses a problem for Republicans. While the GOP maintains a general opposition to government rules in economic life, the principle of treating all web traffic equally enjoys wide, cross-partisan support. As it has become clearer that only new regulation can ensure net neutrality, Republicans risk not only appearing as obstructionists, but worse, obstructionists that side with the likes of Comcast. And so, elements of the draft bill contain concessions that, at least on the surface, should please net neutrality advocates. If nothing else, the language suggests that Republicans want to be seen as earnest stakeholders.

The popularity of net neutrality poses a problem for Republicans

“This bill signals what we’ve been saying for a while,” Corynne McSherry, intellectual property director at the Electronic Frontier Foundation, told me over email. “The tide has turned on net neutrality, and the folks in DC are realizing that it’s time to take meaningful and legally sustainable steps to protect the open internet.”

Matt Wood, Policy Director at Free Press, expressed a similar sentiment. “The conversation has shifted,” Wood said. “Republicans making statements like this is not something we are used to over the last few years, and that is a shame, because this is not a partisan issue. I think there is a real shift in tone and we have to account for that, even celebrate it.”

But both McSherry and Wood, after remarking on the novelty of GOP-backed net neutrality, expressed skepticism about its likely effects. “The reason this bill is dangerous,” Wood said, “is that it tries to take some of the president’s principles and restate them and put them in the bill. And the problem with that is by banning only a few kinds of harmful discrimination, what it is essentially doing is legalizing every other kind of discrimination.”

“The conversation has shifted.”

Wood told me that while the rules in the bill offer some protections, they fail to provide the FCC with flexibility and foresight to account for unfolding developments on the internet. “In addition to listing out the things that are prohibited, it says the FCC has no rule-making authority; it has no ability to expand these obligations,” he said. “It’s basically trying to say: ‘Here are some protections, FCC, but you are now handcuffed and unable to adapt or adjust to the facts or circumstances of future practices.’”

Thankfully, the political language from all sides around net neutrality has shifted toward consumer protection and fairness in competition. But we should question the motivations behind the Republicans’ proposal, in which net neutrality’s latest converts present themselves as sincere allies. Is the draft bill a cynical effort to frustrate and stall the FCC, or is it closer to a real change in Republican policy thinking?

Republicans don’t really want net neutrality. They just want to look like they do

In a statement on the proposed legislation, Thune said: “By turning the FCC away from a heavy-handed and messy approach to regulating the Internet, this draft protects both consumers who rely on Internet services and innovators who create jobs.”

Even if the bill represents an earnest compromise, it still doesn’t come close to what internet activists and Democrats are asking for. By avoiding a reclassification of broadband and working to render the FCC impotent, the new Republican Congress suggests it doesn’t really want net neutrality. It just wants to look like it does.

A controversial YouTube video could create a crazy new form of copyright

2014-12-23T13:17:35-05:00

Last week, inside a federal courthouse in Pasadena, California, Google tried to stop a ruling that could upend the entertainment industry. The case of Garcia v. Google Inc. was considered in an appeals court, in front of a panel of 11 judges. At issue: Innocence of Muslims, the controversial video uploaded to YouTube in 2012. The plaintiff, an actress in the film, argues that she holds a copyright to her performance, and has demanded that Google take the movie down. But Google says that if her lawsuit is taken seriously, then frivolous copyright claims will be used to constrain free speech and debilitate the internet companies that host it. With the court’s decision expected some time next year, both sides are girding for a ruling that could have significant consequences.

Cindy Lee Garcia’s role in the 2012 film Desert Warrior was supposed to be minor. After answering a casting call the previous summer, Garcia was paid $500 for what turned out to be five seconds of screen time. But it was hardly a bargain: She was cast for a movie that never materialized.

A video that spurred violent protests in almost 20 countries

Instead of acting in a “historical Arabian desert adventure film,” as she had been promised, Garcia and the Desert Warrior cast had their dialogue redubbed by a producer. The result was a 14-minute, Islamophobic film trailer that came to be known as Innocence of Muslims, which portrayed the Prophet Muhammad as a belligerent, pedophilic dupe. (Garcia was originally cast to play a role as a mother; in the finished film, however, she appears to insinuate that Prophet Muhammad is a child molester.) In September 2012, the video was translated into Arabic and shared on YouTube. The clip’s antagonistic message spurred violent protests in almost 20 countries, including Egypt, Libya, and Tunisia. The uproar over Innocence of Muslims was even initially linked to the killing of US Ambassador J. Christopher Stevens, and has served as a crucial talking point for the Republican Party’s irrational fixation on an Obama-led Benghazi conspiracy. An Egyptian cleric issued a fatwa against every person involved with the film. Fearing for her life, Garcia sought protection in, of all things, copyright law.

Garcia sued the film’s producer, Nakoula Basseley Nakoula, as well as YouTube and its parent company, Google, in an attempt to have Innocence of Muslims taken down. While service providers like YouTube aren’t held responsible for the kind of deception that Nakoula engaged in, they are on the hook for misappropriating intellectual property. This helps explain Garcia’s curious legal strategy.

A novel interpretation of copyright law

To compel YouTube to get rid of the video, and to protect her from the death threats, Garcia had to fashion her possible allegations of libel and fraud into a copyright claim. She argued that her performance amounted to an independent work of authorship, a copyright upon which Google was infringing. The court denied her request. But the Ninth Circuit Court of Appeals sided with Garcia, in a 2–1 decision, and ordered Google to take the video down. Concerned with the court’s interpretation of copyright law and the demands it might impose on internet companies, Google asked the Ninth Circuit — whose jurisdiction includes both Hollywood and Silicon Valley — to rehear the case with a full panel of judges.

In oral arguments on Monday, Google’s counsel stressed the ramifications of upholding this expansive understanding of copyright. Under the DMCA, copyright holders can urge internet companies to remove illegal content by submitting takedown requests. If, as Garcia argues, one’s performance merits its own copyright claim, a slew of newly legitimate takedown requests might inundate the web’s media platforms. Not only would this jeopardize the viability of smaller film studios and content hosts, it would also restrict free speech. It could invite other claims of copyright that exist solely to suppress information, rather than to protect creative work.

Several judges seemed skeptical of Garcia’s copyright claim. “Take the battle scenes, for example, in The Lord of the Rings. In your view does every single person who made a cameo in the battle scenes have a copyright interest in their performance as fixed in the film?” Judge M. Margaret McKeown asked the plaintiff.

On the other side, Google’s lawyer was needled incessantly by judge Alex Kozinski, who ruled against Google in the previous appeal. Kozinski challenged Google to show why actors like Garcia shouldn’t hold a copyright in their performances.

I spoke to Corynne McSherry, Intellectual Property Director at the Electronic Frontier Foundation, who filed a brief joined by the ACLU and others in support of Google. McSherry told me that Garcia’s copyright claim is ultimately unpersuasive. “A five-second performance responding to the direction of somebody else in a much larger video does not give you a copyright interest in that work,” McSherry explained. “Copyright law is vague enough, but not that vague.”

“Copy right law is vague, but not that vague.”

McSherry said this issue goes back to the Constitution, which grants Congress power to secure exclusive rights to artists and inventors. Copyright claims have always involved someone doing something creative tied to a tangible work, rather than a minor recital of a line, or something more inchoate. “There can be circumstances where an actor might exercise sufficient creative control and that person might have a copyright interest,” McSherry said. “So it’s not to say that an actor can never have a copyright interest in the work, but this isn’t one of them.”

Michael Page, a partner at the law firm Durie Tangri and counsel for Netflix, told me that even if Garcia did enough creative work to be considered a joint author, she would still share authorship with Nakoula, who would be free to post her performance on YouTube. Using Garcia’s theory, Page said, any actor, no matter the insignificance of their role, might be granted unprecedented power over producers, studios, and distributors in a way we’d consider unfair. “You have a heckler’s veto from anybody in the world who can basically censor the internet by sending a DMCA notice,” Page said.

Garcia might have had an easier way to get the video taken down: Public Citizen filed a brief arguing that she could have sued the producer in state court, arguing fraud and unfair businesses practices. With a court order against Nakoula, she’d be able to petition Google to honor the removal of the wrongful content. Public Citizen believes Google would have complied. (Google temporarily blocked the video in Egypt and Libya out of concerns for violence, and restricted access in other countries including India and Indonesia, where the video violated local laws.)

Where Garcia’s opponents see censorship and a tedious meddling with their business model, her allies see a recognition of their work and worth. “Each actor adds something new to the character she performs … the actor imbues the character with originality,” the Screen Actors Guild and other entertainment groups argued in a brief. And in this originality, however small, lies a copyright claim. The brief goes on to describe the different actorly interpretations of Batman: how Christian Bale’s Bruce Wayne was different from George Clooney’s. (The brief did not mention the nipples on the batsuit.)

Is five seconds on screen enough to deserve a copyright?

While Garcia appears only momentarily in Innocence of Muslims, the entertainment groups point out that her script was over five pages. By industry standards, this amounts to about five minutes of screen time, had her full performance been used. Garcia worked for three and a half days, according to court documents. SAG and others contend that the five seconds of screen time is enough to merit a copyright. “Some of the most memorable film performances are ones that were exceptionally short,” states the brief. The legal document invites us to consider Clint Eastwood’s Dirty Harry line: “So you gotta ask yourself this question: ‘Do I feel lucky?’ Well, do ya, punk?’ It asserts that while this scene was part of Eastwood’s larger performance, this particular line was made memorable by the actor. Thus, even fleeting performances — such as Garcia’s — could be separately copyrightable. (I would like to see a short performance where a lawyer from SAG restates this analogy with a straight face.)

Google’s opponents believe the company could easily sort through any increase in copyright notices using its sophisticated, automated systems. But it’s not clear that other video hosting platforms have the same capabilities, or whether independent filmmakers will be able to comply with the new rules.

It’s hard to imagine the dread that emerges from a flurry of death threats. Or the anxiety of seeing your own image, clumsily edited, mouthing out words you have never spoken. But Garcia wants to use the ownership rights of her performance as a shield. She wishes to harness the power granted to authors as a workaround to coerce Google, to alter a record of history she disputes. The Ninth Circuit shouldn’t use the unfortunate facts of her situation to create a new kind of intellectual property, where extras and bit parts carry the creative status of author. The court may soon cite a dubious copyright to silence protected speech. We should hope they don’t.