news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

news

data privacy Archives - Best News https://aitesonics.com/category/data-privacy/ Sat, 13 Apr 2024 11:10:15 +0000 en-US hourly 1 https://wordpress.org/?v=6.4.4 The legal loophole that lets the government search your phone https://aitesonics.com/government-warrant-search-phone-cloud-fourth-amendment-legal-191533735/ https://aitesonics.com/government-warrant-search-phone-cloud-fourth-amendment-legal-191533735/#respond Sat, 13 Apr 2024 11:10:15 +0000 https://aitesonics.com/government-warrant-search-phone-cloud-fourth-amendment-legal-191533735/ Despite the US ethos that you’ll be innocent until proven guilty in a court of law, law enforcement finding an excuse to search your digital devices only requires a presumption of wrongdoing. The tech to do this already exists, and murky legislation lets it happen, speakers from the Legal Aid Society said at DEF CON […]

The post The legal loophole that lets the government search your phone appeared first on Best News.

]]>
Despite the US ethos that you’ll be innocent until proven guilty in a court of law, law enforcement finding an excuse to search your digital devices only requires a presumption of wrongdoing. The tech to do this already exists, and murky legislation lets it happen, speakers from the Legal Aid Society said at DEF CON last Friday.

“Technically and legally there's not much really truly blocking the government from getting the information they want if they want it,” Allison Young, digital forensics analyst at The Legal Aid Society, told Engadget. It’s easy, too. Without picking up any new skills or tools, Young was able to use her existing expertise in the field and access to forensics tools to find sensitive data that could be used to, for example, prosecute someone being targeted for getting an abortion as it becomes increasingly illegal across the country.

The problem isn’t just the state of local law either, but it’s embedded in the Constitution. As Diane Akerman, digital forensics attorney at the Legal Aid Society explained, the Fourth Amendment hasn’t been updated to account for modern problems like digital data. The Fourth Amendment intends to protect people from “unreasonable searches and seizures” by the US government. This is where we get legal protections like warrants, where law enforcement needs court approval to look for evidence in your home, car or elsewhere.

Today, that includes your digital belongings too, from your phone to the cloud and beyond, making way for legal loopholes as tech advancements outpace the law. For example, there’s no way to challenge a search warrant prior to it being executed, Akerman said. For physical evidence that makes some sense because we don’t want someone flushing evidence down a toilet.

That’s not how your social media accounts or data in the cloud work though, because those digital records are much harder to scrub. So, law enforcement can get a warrant to search your device, and there’s no process to litigate in advance whether the warrant is appropriate. Even if there’s reason for the warrant, Akerman and Young showed that officers can use intentionally vague language to search your entire cell phone when they know the evidence may only be in one account.

“You litigate the issues once they already have the data, which means cat is out of the bag a lot of the time and even if it's suppressed in court, there's still other ways it can be used in court,” Akerman said. “There's no oversight for the way the government is executing warrants on digital devices.”

The issue only exacerbates across the third-party apps you use. As of right now, the protections of the Fourth Amendment have not been extended to all cloud data and other digital data, Akerman said. The government can often very easily get information from the cloud because of that, even if it’s not entirely relevant to the case. “You would be furious if police busted down your door and copied five years of texts for you walking out on a parking ticket five years ago, it's just not proportional,” Young said.

There are no easy ways for an individual to better protect themselves from these searches. On a case by case basis, there are ways to lock down your device, but that changes with every update or new feature, Young said. Instead, both speakers pushed to put the onus back on the systems and structures that uphold this law, not the individuals affected by it.

“I live in a world where I have to opt out of modern society to not have other people housing my data in some way,” Akerman said. “The question really should be like, what responsibility do those people have to us, since they have made us into their profit, rather than forcing me to opt out in order to protect myself?”

The post The legal loophole that lets the government search your phone appeared first on Best News.

]]>
https://aitesonics.com/government-warrant-search-phone-cloud-fourth-amendment-legal-191533735/feed/ 0
Crunchyroll will pay you $30 for violating your data privacy rights https://aitesonics.com/crunchyroll-will-pay-you-30-for-violating-your-data-privacy-rights-153050358/ https://aitesonics.com/crunchyroll-will-pay-you-30-for-violating-your-data-privacy-rights-153050358/#respond Fri, 05 Apr 2024 08:40:48 +0000 https://aitesonics.com/crunchyroll-will-pay-you-30-for-violating-your-data-privacy-rights-153050358/ You could be entitled to a small chunk of a $16 million class action settlement against anime streaming service Crunchyroll. The Sony-owned company settled a data privacy lawsuit this week that will result in about $30 settlements for individuals impacted, according to firm behind the class action. The complaint, filed in September 2022, claims that […]

The post Crunchyroll will pay you $30 for violating your data privacy rights appeared first on Best News.

]]>
You could be entitled to a small chunk of a $16 million class action settlement against anime streaming service Crunchyroll. The Sony-owned company settled a data privacy lawsuit this week that will result in about $30 settlements for individuals impacted, according to firm behind the class action.

The complaint, filed in September 2022, claims that Sony shared individual Crunchyroll viewing information with third-party sites without user’s permission. That means Google or Facebook might have seen your anime watch history without your knowledge. It’s a violation of the Video Privacy Protection Act, which makes it illegal to video streaming services to disclose personally identifiable information without the individual’s consent. Crunchyroll denies wrongdoing.

Anyone in the US who used Crunchyroll services between September 8, 2020 and September 20, 2023 could be eligible for the settlement. Claim forms can be submitted online, and must be turned in by December 12 to receive payment. Or, if you don’t agree with the settlement, you can object by November 27 and attend the hearing on December 19. If you do nothing, you forfeit your right to any settlement amount.

The settlement coincided with Crunchyroll news that it would be launching a 24-hour news channel.

This article contains affiliate links; if you click such a link and make a purchase, we may earn a commission.

The post Crunchyroll will pay you $30 for violating your data privacy rights appeared first on Best News.

]]>
https://aitesonics.com/crunchyroll-will-pay-you-30-for-violating-your-data-privacy-rights-153050358/feed/ 0
Researchers posed as foreign actors, and data brokers sold them information on military servicemembers anyway https://aitesonics.com/researchers-posed-as-foreign-actors-and-data-brokers-sold-them-information-on-military-servicemembers-anyway-120038192/ https://aitesonics.com/researchers-posed-as-foreign-actors-and-data-brokers-sold-them-information-on-military-servicemembers-anyway-120038192/#respond Fri, 05 Apr 2024 08:07:58 +0000 https://aitesonics.com/researchers-posed-as-foreign-actors-and-data-brokers-sold-them-information-on-military-servicemembers-anyway-120038192/ Third parties selling our personal data is annoying. But for certain sensitive populations like military service members, the selling of that information could quickly become a national security threat. Researchers at Duke University released a study on Monday tracking what measures data brokers have in place to prevent unidentified or potentially malign actors from buying […]

The post Researchers posed as foreign actors, and data brokers sold them information on military servicemembers anyway appeared first on Best News.

]]>
Third parties selling our personal data is annoying. But for certain sensitive populations like military service members, the selling of that information could quickly become a national security threat. Researchers at Duke University released a study on Monday tracking what measures data brokers have in place to prevent unidentified or potentially malign actors from buying personal data on members of the military. As it turns out, the answer is often few to none — even when the purchaser is actively posing as a foreign agent.

A 2021 Duke study by the same lead researcher revealed that data brokers advertised that they had access to — and were more than happy to sell —information on US military personnel. In this more recent study researchers used wiped computers, VPNs, burner phones bought with cash and other means of identity obfuscation to go undercover. They scraped the websites of data brokers to see which were likely to have available data on servicemembers. Then they attempted to make those purchases, posing as two entities: datamarketresearch.org and dataanalytics.asia. With little-or-no vetting, several of the brokers transferred the requested data not only to the presumptively Chicago-based datamarketresearch, but also to the server of the .asia domain which was located in Singapore. The records only cost between 12 to 32 cents a piece.

The sensitive information included health records and financial information. Location data was also available, although the team at Duke decided not to purchase that — though it’s not clear if this was for financial or ethical reasons. “Access to this data could be used by foreign and malicious actors to target active-duty military personnel, veterans, and their families and acquaintances for profiling, blackmail, targeting with information campaigns, and more,” the report cautions. At an individual level, this could also include identity theft or fraud.

This gaping hole in our national security apparatus is due in large part to the absence of comprehensive federal regulations governing either individual data privacy, or much of the business practices engaged in by data brokers. Senators Elizabeth Warren, Bill Cassidy and Marco Rubio introduced the Protecting Military Service Members’ Data Act in 2022 to give power to the Federal Trade Commission to prevent data brokers from selling military personnel information to adversarial nations. They reintroduced the bill in March 2023 after it stalled out. Despite bipartisan support, it still hasn’t made it past the introduction phase.

The post Researchers posed as foreign actors, and data brokers sold them information on military servicemembers anyway appeared first on Best News.

]]>
https://aitesonics.com/researchers-posed-as-foreign-actors-and-data-brokers-sold-them-information-on-military-servicemembers-anyway-120038192/feed/ 0
Every car is a smart car, and it's a privacy nightmare https://aitesonics.com/every-car-is-a-smart-car-and-its-a-privacy-nightmare-193010478/ https://aitesonics.com/every-car-is-a-smart-car-and-its-a-privacy-nightmare-193010478/#respond Fri, 05 Apr 2024 08:07:17 +0000 https://aitesonics.com/every-car-is-a-smart-car-and-its-a-privacy-nightmare-193010478/ Mozilla recently reported that of the car brands it reviewed, all 25 failed its privacy tests. While all, in Mozilla's estimation, overreached in their policies around data collection and use, some even included caveats about obtaining highly invasive types of information, like your sexual history and genetic information. As it turns out, this isn’t just […]

The post Every car is a smart car, and it's a privacy nightmare appeared first on Best News.

]]>
Mozilla recently reported that of the car brands it reviewed, all 25 failed its privacy tests. While all, in Mozilla's estimation, overreached in their policies around data collection and use, some even included caveats about obtaining highly invasive types of information, like your sexual history and genetic information. As it turns out, this isn’t just hypothetical: The technology in today’s cars has the ability to collect these kinds of personal information, and the fine print of user agreements describes how manufacturers get you to consent every time you put the keys in the ignition.

“These privacy policies are written in a way to ensure that whatever is happening in the car, if there's an inference that can be made, they are still ensuring that there is protection, and that they are compliant with different state laws,” Adonne Washington, policy council at the Future of Privacy Forum, said. The policies also account for technological advances that could happen while you own the car. Tools to do one thing could eventually do more, so manufacturers have to be mindful of that, according to Washington.

So, it makes sense that a car manufacturer would include every type of data imaginable in its privacy policy to cover the company legally if it stumbled into certain data collection territory. Nissan’s privacy policy, for example, covers broad and frankly irrelevant classes of user information, such as “sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information” under types of personal data collected.

Companies claim ownership in advance, so that you can’t sue if they accidentally record you having sex in the backseat, for example. Nissan claimed in a statement that this is more or less why its privacy policy remains so broad. The company says it "does not knowingly collect or disclose customer information on sexual activity or sexual orientation," but its policy retains those clauses because "some U.S. state laws require us to account for inadvertent data we have or could infer but do not request or use." Some companies Engadget reached out to — like Ford, Stellantis and GM — affirmed their commitment, broadly, to consumer data privacy; Toyota, Kia and Tesla did not respond to a request for comment.

Beyond covering all imaginable legal bases, there simply isn't any way to know why these companies would want deeply personal information on their drivers, or what they'd do with it. And even if it's not what you would consider a “smart” car, any vehicle equipped with USB, Bluetooth or recording capabilities can capture a lot of data about the driver. And in much the same way a "dumb" tv is considerably harder to find these days, most consumers would be hard pressed to find a new vehicle option that doesn't include some level of onboard tech with the capacity to record their data. A study commissioned by Senator Ed Markey nearly a decade ago found all modern cars had some form of wireless technology included. Even the ranks of internet listicles claiming to contain low-tech cars for "technophobes" are riddled with dashboard touchscreens and infotainment systems.

“How it works in practice we don’t have as much insight into, as car companies, data companies, and advertising companies tend to hold those secrets more close to the vest,” Jen Caltrider, a researcher behind Mozilla’s car study, said. “We did our research by combing through privacy policies and public documentation where car companies talked about what they *can* do. It is much harder to tell what they are actually doing as they aren’t required to be as public about that.”

The unavailability of disconnected cars combined with the lack of transparency around driver data use means consumers have essentially no choice to trust their information is being used responsibly, or that at least some of the classes of data — like Nissan's decision to include "genetic information" — listed in these worrying privacy policies are purely related to hypothetical liability. The options are essentially: read every one of these policies and find the least draconian, buy a very old, likely fuel-inefficient car with no smart features whatsoever or simply do without a car, period. To that last point, only about eight percent of American households are carless, often not because they live in a walkable city with robust public transit, but because they cannot afford one.

This gets even more complicated when you think about how cars are shared. Rental cars change drivers all the time, or a minor in your household might borrow your car to learn how to drive. Unlike a cell phone, which is typically a single user device, cars don’t work like and vehicle manufacturers struggle to address that in their policies. And cars have the ability to collect information not just on drivers but their passengers.

If simply trusting manufacturers after they ask for the right to collect your genetic characteristics tests credulity, the burden of anyone other than a contract lawyer reading back a software license agreement to the folks in the backseat is beyond absurd. Ford’s privacy policy explicitly states that the owners of its vehicles “must inform others who drive the vehicle, and passengers who connect their mobile devices to the vehicle, about the information in this Notice.” That’s about 60 pages of information to relay, if you’re printing it directly from Ford’s website — just for the company and not even the specific car.

And these contracts tend to compound on one another. If that 60-page privacy policy seems insurmountable, well, there's also a terms of service and a separate policy regarding the use of Sirius XM (on a website with its own 'accept cookies' popover, with its own agreement.) In fairness to Ford, its privacy notice does allow drivers to opt out of certain data sharing and connected services, but that would require drivers to actually comb through the documentation. Mozilla found many other manufacturers offered no such means to avoid being tracked, and a complete opt-out is something which the Alliance for Automotive Innovation — a trade group representing nearly all car and truck makers in the US, including Ford — has actively resisted. To top things off, academics, legal scholars and even one cheeky anti-spyware company have repeatedly shown consumers almost universally do not read these kinds of contracts anyway.

The burden of these agreements doesn't end with their presumptive data collection, or the onus to relay them to every person riding in or borrowing your car. The data held in-vehicle and manufacturer's servers becomes yet another hurdle for drivers should they opt to sell the thing down the line. According to Privacy4Cars founder AndreaAmico, be sure to get it in writing from the dealer how they plan to delete your data from the vehicle before reselling it. “There's a lot of things that consumers can do to actually start to protect themselves, and it's not going to be perfect, but it's going to make a meaningful difference in their lives,” Amico said.

Consumers are effectively hamstrung by the state of legal contract interpretation, and manufacturers are incentivized to mitigate risk by continuing to bloat these (often unread) agreements with increasingly invasive classes of data. Many researchers will tell you the only real solution here is federal regulation. There have been some cases of state privacy law being leveraged for consumers' benefit, as in California and Massachusetts, but on the main it's something drivers aren't even aware they should be outraged about, and even if they are, they have no choice but to own a car anyway.

The post Every car is a smart car, and it's a privacy nightmare appeared first on Best News.

]]>
https://aitesonics.com/every-car-is-a-smart-car-and-its-a-privacy-nightmare-193010478/feed/ 0
Smarter public transit comes at the cost of rider anonymity https://aitesonics.com/smarter-public-transit-comes-at-the-cost-of-rider-anonymity-143054155/ https://aitesonics.com/smarter-public-transit-comes-at-the-cost-of-rider-anonymity-143054155/#respond Fri, 05 Apr 2024 07:51:16 +0000 https://aitesonics.com/smarter-public-transit-comes-at-the-cost-of-rider-anonymity-143054155/ Security experts were skeptical about the New York MTA’s switch to an OMNY tap-and-go system when it was first announced years ago. Then, in August, a 404 Media investigation revealed riders were right to be concerned. As it turned out, the ability to check trip history could be used by nearly anyone to follow specific […]

The post Smarter public transit comes at the cost of rider anonymity appeared first on Best News.

]]>
Security experts were skeptical about the New York MTA’s switch to an OMNY tap-and-go system when it was first announced years ago. Then, in August, a 404 Media investigation revealed riders were right to be concerned. As it turned out, the ability to check trip history could be used by nearly anyone to follow specific riders’ location patterns. MTA disabled the feature, but it pointed to a deeper problem that exists across modern public transit systems: they make it harder to opt out of having our sensitive data collected,

“You’re building a better system, but you’re also really stepping into a dangerous cybersecurity minefield,” said Brendan Saltaformaggio, associate professor specializing in cybersecurity at the Georgia Institute of Technology.

Payment information, location data and trip patterns can all be attached to our ridership data. Agencies say they use it to better understand how riders use the services and make improvements. But the flip side is transit agencies selling user data to advertisers like a lot of private companies do, or sharing it with law enforcement. We submitted Freedom of Information Act requests to several large police departments across the country — including in New York City, Baltimore and Chicago — for more information on requests they had made to local transit agencies for data over the past decade.

But even if the data just sits there, it’s increasingly vulnerable to a breach without secure infrastructure in place to protect it. Most ransomware gangs are motivated by money. So while your data could be at risk, the hackers are actually looking to threaten the public transit agencies into paying up to avoid a data leak or being locked out of their systems. It happened to the Washington Metropolitan Area Transit Authority in Washington, DC earlier this year, and in March a ransomware attack disrupted the Washington state bus system. That said, personal data can still be compromised in the process. Hackers leaked personal data after accessing San Francisco’s Bay Area Rapid Transit at the beginning of this year.

“These are organizations that run on shoestring budgets, usually heavily supported by taxpayers, who are probably not going to be very excited to see all of this money being spent purely on cybersecurity with hopes of not having an incident in mind,” Saltaformaggio said.

What exactly each agency does to protect your sensitive information varies widely. The Federal Transit Administration and the American Public Transportation Association both provide guidelines for agencies on how to handle the matter. But experts warn that agencies across the country are still vulnerable to attack, and struggle to keep the data they have access to secure.

Digitizing public transit payments makes sense. But while the public is leaning into going cashless, paper money will always be here to stay. “If an agency tried to get rid of cash payments, they might face some serious backlash because a significant portion of people still use cash to ride transit,” said Joshua Schank, managing principal at transportation and financial advisory firm InfraStrategies. Still, options to pay via an RFID-powered card, an app or even a digital wallet all became popular ways to pay — especially because adoption of these newer methods often comes with perks like allowing riders free transfers between stations or services. Some credit card companies even offer incentives like discounts on rides by partnering with the transit agencies on non-cash payment options.

Using exact cash to ride public transit is still possible in many places, but it means you lose out on the aforementioned perks. There are options to purchase a card with cash and still get those perks, but it’s often much less convenient. To get a ConnectCard in Pittsburgh, I have to go to a third-party location in my neighborhood, buy a card for $1 and have cash out to reload it at that third-party location whenever it’s empty. It costs $2.75 to ride the bus, so that card fare only adds up to about one-third of a ride.In New York, a physical OMNY card costs $5, or one ride on the subway plus most of your next trip. (It’s worth noting that OMNY currently has a deal selling cards for $1 at all OMNY vending machines, but that’s for a limited time only.)

Agencies stack on burdens for the consumer, incentivizing them to switch to data-collecting apps and RFID smart cards, almost punishing people trying to stick to cash — either because they value their privacy, or because they’re among those without consistent access to banking. It shouldn’t have to be more annoying, more expensive, or both just to maintain some anonymity while commuting to work.

There’s not much you can do about it, either. Like most data privacy issues, experts say we need federal regulation to put guidelines in place around how public transit agencies collect and use our data. Until then, it’s just another way we’re stuck exchanging our personal information for marginal convenience gains.

The post Smarter public transit comes at the cost of rider anonymity appeared first on Best News.

]]>
https://aitesonics.com/smarter-public-transit-comes-at-the-cost-of-rider-anonymity-143054155/feed/ 0
Police are using pharmacies to secretly access medical information about members of the public https://aitesonics.com/police-are-using-pharmacies-to-secretly-access-medical-information-about-members-of-the-public-182009044/ https://aitesonics.com/police-are-using-pharmacies-to-secretly-access-medical-information-about-members-of-the-public-182009044/#respond Fri, 05 Apr 2024 07:19:49 +0000 https://aitesonics.com/police-are-using-pharmacies-to-secretly-access-medical-information-about-members-of-the-public-182009044/ A Senate Finance Committee inquiry revealed on Tuesday that police departments can get access to private medical information from pharmacies, no warrant needed. While HIPAA may protect some access to personally identifiable health data, it doesn’t stop cops, according to a letter from Senator Ron Wyden, Representative Pramila Jayapal and Representative Sara Jacobs to the […]

The post Police are using pharmacies to secretly access medical information about members of the public appeared first on Best News.

]]>
A Senate Finance Committee inquiry revealed on Tuesday that police departments can get access to private medical information from pharmacies, no warrant needed. While HIPAA may protect some access to personally identifiable health data, it doesn’t stop cops, according to a letter from Senator Ron Wyden, Representative Pramila Jayapal and Representative Sara Jacobs to the Department of Health and Human Services. None of the major US pharmacies are doing anything about it either, the members of Congress say.

“All of the pharmacies surveyed stated that they do not require a warrant prior to sharing pharmacy records with law enforcement agents, unless there is a state law that dictates otherwise,” the letter said. “Those pharmacies will turn medical records over in response to a mere subpoena, which often do not have to be reviewed or signed by a judge prior to being issued.”

The committee reached out to Amazon, Cigna, CVS Health, The Kroger Company, Optum Rx, Rite Aid Corporation, Walgreens Boots Alliance and Walmart about their practices for sharing medical data with police. While Amazon, Cigna, Optum, Walmart and Walgreen said they have law enforcement requests reviewed by legal professionals before complying, CVS Health, The Kroger Company and Rite Aid Corporation said they ask in-store staff to process the request immediately.

Engadget asked the pharmacies mentioned in the letter for comment about the claims. CVS said its pharmacy staff are trained to handle these inquiries and its following all applicable laws around the issue. Walgreens said it has a process in place to assess law enforcement requests compliant with those laws, too, and Amazon said that although law enforcement requests are rare, it does notify patients and comply with court orders when applicable. The others either haven’t responded or refuse to comment.

The pharmacies mostly blamed the current lack of legislative protections for patient data for their willingness to comply with cop requests. Most of them told the committee that current HIPAA law and other policies let them disclose medical records in response to certain legal requests. That’s why the Senate Finance Committee is targeting HHS to strengthen these protections, especially since the 2023 Dobbs decision let states criminalize certain reproductive health decisions.

Under current HIPAA law, patients have the right to know who is accessing their health information. But individuals have to request the medical record disclosure data, instead of health care professionals being required to share it proactively. “Consequently, few people ever request such information, even though many would obviously be concerned to learn about disclosures of their private medical records to law enforcement agencies,” the letter states. The letter also urges pharmacies to change their policies to require a warrant, and publish transparency reports about how data is shared.

The post Police are using pharmacies to secretly access medical information about members of the public appeared first on Best News.

]]>
https://aitesonics.com/police-are-using-pharmacies-to-secretly-access-medical-information-about-members-of-the-public-182009044/feed/ 0
The FTC wants to strengthen COPPA to make it harder for companies to monetize kids’ data https://aitesonics.com/the-ftc-wants-to-strengthen-coppa-to-make-it-harder-for-companies-to-monetize-kids-data-214459097/ https://aitesonics.com/the-ftc-wants-to-strengthen-coppa-to-make-it-harder-for-companies-to-monetize-kids-data-214459097/#respond Fri, 05 Apr 2024 07:08:16 +0000 https://aitesonics.com/the-ftc-wants-to-strengthen-coppa-to-make-it-harder-for-companies-to-monetize-kids-data-214459097/ The Federal Trade Commission (FTC) is proposing changes to the Children’s Online Privacy Protection Rule (COPPA) to make it harder for tech companies to track and monetize children’s data. Some of the proposed changes include placing limits on how long companies can retain data they collect from minors and forcing parents to consent to, or […]

The post The FTC wants to strengthen COPPA to make it harder for companies to monetize kids’ data appeared first on Best News.

]]>
The Federal Trade Commission (FTC) is proposing changes to the Children’s Online Privacy Protection Rule (COPPA) to make it harder for tech companies to track and monetize children’s data. Some of the proposed changes include placing limits on how long companies can retain data they collect from minors and forcing parents to consent to, or opt out of, targeted marketing.

COPPA has been around since April 2000 and currently requires some level of transparency from online services and websites. Before collecting data from minors, providers need to obtain “verifiable parental consent.” In 2013, the FTC tried to narrow the definition of what a provider is to any digital service that weaves an advertising network into its platform and collects personal data — regardless of whether or not a website or online service is particularly directed toward children. At the time, they also expanded the scope of what constitutes ‘personal information’ to include geolocation and any photos or videos that depict a child’s image, among other things.

In its new proposal, the FTC wants to expand the scope of personal information in COPPA again to include biometric data. The proposal will also scrutinize digital service providers for sending push notifications that encourage kids to keep using their service and attempt to close any loopholes for data collection to “support for internal operations.”

“When we consider the harms of online behavioral advertising to children, we cannot forget one of the original reasons COPPA was envisioned and enacted: A desire to ensure that companies cannot build a commercial relationship with children that preys on their immaturity, honesty, and trust,” FTC Commissioner Alvaro Bedoya said in a statement.

The FTC also wants to make it harder to monetize children’s data generated in the classroom in an effort to enhance privacy safeguards for students. If passed, COPPA will allow schools to gain more control over whether or not to allow educational tech providers the option to collect or use students’ personal information.

Lina Khan, the chair of the FTC, took to X to voice support for the proposal, writing: “Our proposed changes to COPPA are much-needed, especially in an era where online tools have become essential for navigating daily life,” adding that companies are deploying increasingly sophisticated ways to collect kids’ data. The FTC will collect public comments on the proposal for 60 days before taking any further regulatory action.

The post The FTC wants to strengthen COPPA to make it harder for companies to monetize kids’ data appeared first on Best News.

]]>
https://aitesonics.com/the-ftc-wants-to-strengthen-coppa-to-make-it-harder-for-companies-to-monetize-kids-data-214459097/feed/ 0
HIPAA protects health data privacy, but not in the ways most people think https://aitesonics.com/hipaa-protects-health-data-privacy-but-not-in-the-ways-most-people-think-184026402/ https://aitesonics.com/hipaa-protects-health-data-privacy-but-not-in-the-ways-most-people-think-184026402/#respond Fri, 05 Apr 2024 06:29:05 +0000 https://aitesonics.com/hipaa-protects-health-data-privacy-but-not-in-the-ways-most-people-think-184026402/ The “P” in HIPAA doesn’t stand for privacy. It’s one of the first things a lot of experts will say when asked to clear up any misconceptions about the health data law. Instead, it stands for portability — it’s called the Health Insurance Portability and Accountability Act —and describes how information can be transferred between […]

The post HIPAA protects health data privacy, but not in the ways most people think appeared first on Best News.

]]>
The “P” in HIPAA doesn’t stand for privacy. It’s one of the first things a lot of experts will say when asked to clear up any misconceptions about the health data law. Instead, it stands for portability — it’s called the Health Insurance Portability and Accountability Act —and describes how information can be transferred between providers. With misinterpretations of HIPAA starting with just its name, misunderstandings of what the law actually does greatly impact our ability to recognize how the kinds of data do and don't fall under its scope. That’s especially true as a growing number of consumer tech devices and services gather troves of information related to our health.

We often consider HIPAA a piece of consumer data privacy legislation because it did direct the Department of Health and Human Services to come up with certain security provisions, like breach notification regulations and a health privacy rule for protecting individually identifiable information. But when HIPAA went into effect in the 1990s, its primary aim was improving how providers worked with insurance companies. Put simply, “people think HIPAA covers more than it actually does,” said Daniel Solove, professor at George Washington University and CEO of privacy training firm TeachPrivacy.

HIPAA has two big restrictions in scope: a limited set of covered entities, and limited set of covered data, according to Cobun Zweifel-Keegan, DC managing director of the International Association of Privacy Professionals. Covered entities include healthcare providers like doctors and health plans like health insurance companies. The covered data refers to medical records and other individually identifiable health information used by those covered entities. Under HIPAA, your general practitioner can't sell data related to your vaccination status to an ad firm, but a fitness app (which wouldn't be a covered entity) that tracks your steps and heart rate (which aren't considered covered data) absolutely can.

“What HIPAA covers, is information that relates to health care or payment for health care, and sort of any piece of identifiable information that’s in that file,” Solove said. It doesn’t cover any health information shared with your employer or school, like if you turn in a sick note, but it does protect your doctor from sharing more details about your diagnosis if they call to verify.

A lot has changed in the nearly 30 years since HIPAA went into effect, though. The legislators behind HIPAA didn’t anticipate how much data we would be sharing about ourselves today, much of which can be considered personally identifiable. So, that information doesn’t fall under its scope. “When HIPAA was designed, nobody really anticipated what the world was going to look like,” Lee Tien, senior staff attorney at the Electronic Frontier Foundation said. It’s not badly designed, HIPAA just can’t keep up with the state we’re in today. “You're sharing data all the time with other people who are not doctors or who are not the insurance company,” said Tien.

Think of all the data collected about us on the daily that could provide insight into our health. Noom tracks your diet. Peloton knows your activity levels. Calm sees you when you’re sleeping. Medisafe knows your pill schedule. Betterhelp knows what mental health conditions you might have, and less than a year ago was banned by the FTC from disclosing that information to advertisers. The list goes on, and much of it can be used to sell dietary supplements or sleep aids or whatever else. “Health data could be almost limitless,” so if HIPAA didn’t have a limited scope of covered entities, the law would be limitless, too, Solove said.

Not to mention the amount of inferences that firms can make about our health based on other data. An infamous 2012 New York Times investigation detailed how just by someone’s online searches and purchases, Target can figure out that they’re pregnant. HIPAA may not protect your medical information from being viewed by law enforcement officers. Even without a warrant, cops can get your records just by saying that you’re a suspect (or victim) of a crime. Police have used pharmacies to gather medical data about suspects, but other types of data like location information can provide sensitive details, too. For example, it can show that you went to a specific clinic to receive care. Because of these inferences, laws like HIPAA won’t necessarily stop law enforcement from prosecuting someone based on their healthcare decision.

Today, state-specific laws crop up across the US to help target some of the health data privacy gaps that HIPAA doesn’t cover. This means going beyond just medical files and healthcare providers to encompass more of people’s health data footprint. It varies between states, like in California which provides options to charge anyone who negligently discloses medical information or some additional breach protections for consumers based in Pennsylvania, but Washington state recently passed a law specifically targeting HIPAA’s gaps.

Washington State’s My Health My Data Act, passed last year, aims to “protect personal health data that falls outside the ambit of the Health Insurance Portability and Accountability Act,” according to a press release from Washington’s Office of the Attorney General. Any entity that conducts business in the state of Washington and deals with personal information that identifies a consumer’s past, present or future physical or mental health status must comply with the act’s privacy protections. Those provisions include the right not to have your health data sold without your permission and having health data deleted via written request. Under this law, unlike HIPAA, an app tracking someone’s drug dosage and schedule or the inferences made by Target about pregnancy would be covered.

My Health My Data is still rolling out, so we’ll have to wait and see how the law impacts national health data privacy protections. Still, it’s already sparking copycat laws in states like Vermont.

The post HIPAA protects health data privacy, but not in the ways most people think appeared first on Best News.

]]>
https://aitesonics.com/hipaa-protects-health-data-privacy-but-not-in-the-ways-most-people-think-184026402/feed/ 0
The case against the TikTok ban bill https://aitesonics.com/the-case-against-the-tiktok-ban-bill-161517973/ https://aitesonics.com/the-case-against-the-tiktok-ban-bill-161517973/#respond Fri, 05 Apr 2024 05:18:59 +0000 https://aitesonics.com/the-case-against-the-tiktok-ban-bill-161517973/ A year ago, I visited TikTok’s US headquarters to preview its new “transparency center,” a central piece of its multibillion-dollar effort to convince the US its meme factory isn’t a national security threat. That effort has failed. The company’s negotiations with the government stalled out and the company is now facing its most serious threat […]

The post The case against the TikTok ban bill appeared first on Best News.

]]>
A year ago, I visited TikTok’s US headquarters to preview its new “transparency center,” a central piece of its multibillion-dollar effort to convince the US its meme factory isn’t a national security threat. That effort has failed. The company’s negotiations with the government stalled out and the company is now facing its most serious threat to a future in the United States yet.

Last Wednesday, the House of Representatives overwhelmingly approved a bill that, if passed into law, would force ByteDance to sell TikTok or face an outright ban in the US. That lawmakers view TikTok with suspicion is nothing new. Because TikTok’s parent company, ByteDance, is based in China, they believe the Chinese government could manipulate TikTok’s algorithms or access its users’ data via ByteDance employees. But what has been surprising about the Protecting Americans from Foreign Adversary Controlled Applications Act is that it managed to gather so much support from both sides of the aisle seemingly out of nowhere.

After a surprise introduction, the bipartisan bill cleared committee in two days with a unanimous 50 – 0 vote, and was approved by the full House in a 352 – 65 vote less than a week later. Of the dozens of bills attempting to regulate the tech industry in recent years, including at least two to ban TikTok, none have gained nearly as much momentum.

But the renewed support for banning or forcing a sale of TikTok doesn’t seem to be tied to any newly uncovered information about TikTok, ByteDance or the Chinese Communist Party. Instead, lawmakers have largely been rehashing the same concerns that have been raised about the app for years.

One issue often raised is data access. TikTok, like many of its social media peers, scoops up large amounts of data from its users. The practice has gotten the company into hot water in the past when many of those users were discovered to be minors. Many lawmakers cite its large cache of user data, which they claim could be obtained by Chinese government officials, as one of the most significant risks posed by TikTok.

“Our bipartisan legislation would protect American social media users by driving the divestment of foreign adversary-controlled apps to ensure that Americans are protected from the digital surveillance and influence operations of regimes that could weaponize their personal data against them,” Representative Raja Krishnamoorthi, on the bill’s co-sponsors, said in a statement.

TikTok has repeatedly denied sharing any data with the Chinese government and says it would not comply if they were requested to do so. However, ByteDance has been caught mishandling TikTok user data in the past. In 2022, ByteDance fired four employees, including two based in China, for accessing the data of reporters who had written stories critical of the company. There’s no evidence those actions were directed by the Chinese government.

In fact the Protecting Americans from Foreign Adversary Controlled Applications Act would do little to address the data access issue, experts say. Even if the app was banned or controlled by a different company, Americans’ personal information would remain readily available from the largely unregulated data broker industry.

Data brokers gain access to vast troves of Americans’ personal data via scores of apps, websites, credit card companies and other businesses. Currently, there are few restrictions on what data can be collected or who can buy it. Biden Administration officials have warned that China is already buying up this data, much of it more revealing than anything TikTok collects.

“The data that’s been collected about you will almost certainly live longer than you will, and there’s really nothing you can do to delete it or get rid of it,” Justin Cappos, an NYU computer science professor and member of the NYU Center for Cybersecurity, told Engadget. “If the US really wants to solve this, the way to do it isn’t to blame a social media company in China and make them the face of the problem. It’s really to pass the meaningful data privacy regulations and go after [data] collection and go after these data brokers.”

The House recently passed a bill that would bar data brokers from selling Americans’ personal information to “adversary” countries like China. But, if passed, the law wouldn’t address the sale of that data to other entities or the wholesale collection of it to begin with.

Digital rights and free speech advocates like the Electronic Frontier Foundation (EFF) have also raised the possibility that the US forcing a ban or sale of TikTok could give other countries cover to enact similar bans or restrictions on US-based social media platforms. In a letter to lawmakers opposing the measure, the EFF, American Civil Liberties Union and other groups argued that it would “set an alarming global precedent for excessive government control over social media platforms.”

David Greene, a senior staff attorney at the EFF notes that the United States has forcefully criticized nations that have banned social media apps. “The State Department has been highly critical of countries that have shut down services,” Greene told Engadget, noting that the US condemned the Nigerian government for blocking Twitter in 2021. “Shutting down a whole service is essentially an anti-democratic thing.”

Intelligence officials held a classified briefing with members of Congress about TikTok shortly before the vote on the House floor. That’s led some pundits to believe that there must be new information about TikTok, but some lawmakers have suggested otherwise.“Not a single thing that we heard in today’s classified briefing was unique to TikTok,” Representative Sara Jacobs told the Associated Press. “It was things that happen on every single social media platform.” Likewise, the top Democrat on the House Intelligence Committee, Representative Jim Hines, said that TikTok is “largely a potential threat … if Congress were serious about dealing with this threat, we would start with a federal privacy bill.”

The post The case against the TikTok ban bill appeared first on Best News.

]]>
https://aitesonics.com/the-case-against-the-tiktok-ban-bill-161517973/feed/ 0