How companies and the government track Internet, cellphone and other technology users is making headlines on several fronts. The Electronic Frontier Foundation targets Google; new cybersecurity bill emerges in Congress; and the IRS says it will stop cellphone tracking without a warrant. Here’s the latest.
Digital rights group alleges Google invades student privacy
Google is being accused of invading the privacy of students using laptop computers powered by the Internet company’s Chrome operating system.
The Electronic Frontier Foundation, a digital rights group, depicts Google as a two-faced opportunist in a complaint filed Tuesday with the Federal Trade Commission.
Google disputes the unflattering portrait and says it isn’t doing anything wrong.
The complaint alleges that Google rigged the “Chromebook” computers in a way that enables the company to collect information about students’ Internet search requests and online video habits. The foundation says Google is dissecting the activities of students in kindergarten through 12th grade so it can improve its digital services.
The complaint contends Google’s storage and analysis of the student profile violates a “Student Privacy Pledge” that the company signed last year. The pledge, which covers more than 200 companies, contains a provision guaranteeing that students’ personal information won’t be exploited for “non-educational” purposes.
The foundation is calling on the FTC to investigate Google, stop it from using information on students’ activities for its own purposes and order it to destroy any information it has collected that’s not related to education.
Chromebooks have become particularly popular in schools because some models sell for less than $300 and can be easily maintained by Google over the Internet.
But the way Google has managed some of its other products have previously gotten the Mountain View, California, company into trouble for violating its users’ privacy.
In 2012, Google paid a $22.5 million fine after the FTC concluded the company had created a technological loophole that enabled its digital advertising network to shadow the online activities of people using Apple’s Safari browser without their consent.
The agency determined Google’s Safari surveillance violated an earlier promise not to mislead consumers about privacy issues. That pledge came after Google set up a social networking service called Buzz in 2010 and exposed people’s email contacts. Googleagreed to period privacy audits as part of that settlement with the FTC.
- Cybersecurity bill would add secrecy to public records laws
A proposed law meant to encourage companies to share information about cyberthreats with the U.S. government includes measures that could significantly limit what details, if any, the public can review about the program through federal and state public records laws.
The legislation — already passed with broad bipartisan support in both houses of Congress but not yet finalized — would keep secret any information a company hands over to the Obama administration under a new cybersecurity agreement, including specifics the firms decide themselves shouldn’t be disclosed. It’s not clear whether thatsecrecy would extend to learning whether particular companies are even participating.
The cyber agreement passed with bipartisan support, despite privacy concerns over Senate language from some lawmakers and technology companies, including Apple Inc. and Dropbox Inc. It’s the culmination of a roughly six-year effort made possible by recent additions of antitrust and consumer-liability protections for the companies’ participation.
Transparency advocates said the new law would provide excessive cover to tech companies through new restrictions to the U.S. Freedom of Information Act, which also supersedes state and tribal open-records laws. That could shield all sorts of information about what the government is — or isn’t — doing to protect Americans who are increasingly victimized by cybercriminals.
“There should be an element of public debate,” said Rick Blum, director of the Washington-based Sunshine in Government Initiative. “Oftentimes, public disclosure and accountability motivates people to be doing more and to be making the right choices.”
Under the federal records law, requesters can obtain government information unless disclosure would hurt national security, violate personal privacy or expose business secrets or certain confidential decision-making. Critical-infrastructure information is also excluded, but the new law explicitly allows additional exemptions for “cyberthreat indicators” and “defensive measures” shared by companies. Those terms aren’t well defined, so there is more leeway to interpret what could be kept secret.
Federal agencies are encouraged to apply discretion in balancing some protections against what can be revealed, but no such discretion would be allowed under the proposed bills. Requesters may have to file a lawsuit in federal court to resolve disputes.
Congress has yet to work out differences between the House and Senate bills before any legislation would ultimately go to President Barack Obama, who early in his administration pledged greater transparency. The White House supports the new exemptions.
The Senate bill passed last month was co-sponsored by Republican Sen. Richard Burr of North Carolina, who chairs the Senate Intelligence Committee, and California Sen. Dianne Feinstein, the top Democrat on the panel.
Burr said in an statement provided by his staff that “it’s important that the bill has this provision (to) keep private entities’ information confidential, enhance the sharing of cyber threat indicators and prevent the disclosure of information that isn’t the government’s to disclose.”
- IRS: Won’t use phone-tracking technology without warrant
Internal Revenue Service criminal investigators will not continue to use cellphone-tracking technology without first seeking a warrant, the IRS commissioner told Congress in a letter made public Tuesday.
Commissioner John Koskinen said his agency is drafting a policy to abide by the Justice Department’s guidance on using the technology, which simulates cellphone towers to trick nearby phones into revealing their locations. The guidance requires a warrant — which requires probable cause and a judge’s signature —except in emergencies or exceptional circumstances.
Koskinen disclosed the new policy in a letter sent Nov. 25 letter to Sen. Ron Wyden, D-Ore.
The IRS said it has used its one cell-site simulator to track 37 cellular devices as part of 11 federal investigations since 2011. The technology was also loaned out on four non-IRS investigations, including a Drug Enforcement Administration case and three state cases. Koskinen said the device is used only by trained law enforcement agents for criminal investigations and won’t be used again until the new policy is in place.
The agency started the process of buying a second cell-site simulator in July but hasn’t yet received it. The letter was sent in response to question Wyden asked during a Finance Committee hearing last month.
Wyden and Rep. Jason Chaffetz, R-Utah, have introduced a bill requiring a warrant for government tracking of Americans’ electronic data, which includes the cell tower simulators. Wyden said in a statement that the IRS efforts were “reasonable steps to protect due process.”
“The IRS has an important role to play in combating money laundering, drug trafficking, and international tax dodging, but tax enforcement and protection of personal privacy must not be mutually exclusive,” he said.
