Tag Archives: data streams

If the United States is a Surveillance State How Does it Differ from China?

Leave a reply

In November 2023, Michael Morell, a former deputy director of the Central Intelligence Agency (CIA), hinted at a big change in how the agency now operates. “The information that is available commercially would kind of knock your socks off…if we collected it using traditional intelligence methods, it would be top secret-sensitive. And you wouldn’t put it in a database, you’d keep it in a safe.”

In recent years, U.S. intelligence agencies, the military and even local police departments have gained access to enormous amounts of data through shadowy arrangements with brokers and aggregators. Everything from basic biographical information to consumer preferences to precise hour-by-hour movements can be obtained by government agencies without a warrant.

Most of this data is first collected by commercial entities as part of doing business. Companies acquire consumer names and addresses to ship goods and sell services. They acquire consumer preference data from loyalty programs, purchase history or online search queries. They get geolocation data when they build mobile apps or install roadside safety systems in cars. But once consumers agree to share information with a corporation, they have no way to monitor what happens to it after it is collected. Many corporations have relationships with data brokers and sell or trade information about their customers. And governments have come to realize that such corporate data not only offers a rich trove of valuable information but is available for sale in bulk.

Earlier generations of data brokers vacuumed up information from public records like driver’s licenses and marriage certificates. But today’s internet-enabled consumer technology makes it possible to acquire previously unimaginable kinds of data. Phone apps scan the signal environment around your phone and report back, hourly, about the cell towers, wireless earbuds, Bluetooth speakers and Wi-Fi routers that it encounters….The National Security Agency recently acknowledged buying internet browsing data from private brokers, and several sources have told me about programs allowing the U.S. to buy access to foreign cell phone networks. Those arrangements are cloaked in secrecy, but the data would allow the U.S. to see who hundreds of millions of people around the world are calling.

Car companies, roadside assistance services and satellite radio companies also collect geolocation data and sell it to brokers, who then resell it to government entities. Even tires can be a vector for surveillance. That little computer readout on your car that tells you the tire pressure is 42 PSI? It operates through a wireless signal from a tiny sensor, and government agencies and private companies have figured out how to use such signals to track people…

It’s legal for the government to use commercial data in intelligence programs because data brokers have either gotten the consent of consumers to collect their information or have stripped the data of any details that could be traced back to an individual. Much commercially available data doesn’t contain explicit personal information. But the truth is that there are ways to identify people in nearly all anonymized data sets. If you can associate a phone, a computer or a car tire with a daily pattern of behavior or a residential address, it can usually be associated with an individual.

And while consumers have technically consented to the acquisition of their personal data by large corporations, most aren’t aware that their data is also flowing to the government, which disguises its purchases of data by working with contractors. One giant defense contractor, Sierra Nevada, set up a marketing company called nContext which is acquiring huge amounts of advertising data from commercial providers. Big data brokers that have reams of consumer information, like LexisNexis and  Thomson Reuters, market products to government entities, as do smaller niche players. Companies like Babel Street, Shadowdragon, Flashpoint and Cobwebs have sprung up to sell insights into what happens on social media or other web forums. Location data brokers like Venntel and Safegraph have provided data on the movement of mobile phones…

A group of U.S. lawmakers is trying to stop the government from buying commercial data without court authorization by inserting a provision to that effect in a spy law, FISA Section 702, that Congress needs to reauthorize by April 19. The proposal would ban U.S. government agencies from buying data on Americans but would allow law-enforcement agencies and the intelligence community to continue buying data on foreigners…But many in the national security establishment think that it makes no sense to ban the government from acquiring data that everyone from the Chinese government to Home Depot can buy on the open market. The data is valuable—in some cases, so valuable that the government won’t even discuss what it’s buying. “Picture getting a suspect’s phone, then in the extraction [of data] being able to see everyplace they’d been in the last 18 months plotted on a map you filter by date ranges,” wrote one Maryland state trooper in an email obtained under public records laws. “The success lies in the secrecy.”

For spies and police officers alike, it is better for people to remain in the dark about what happens to the data generated by their daily activities—because if it were widely known how much data is collected and who buys it, it wouldn’t be such a powerful tool. Criminals might change their behavior. Foreign officials might realize they’re being surveilled. Consumers might be more reluctant to uncritically click “I accept” on the terms of service when downloading free apps. And the American public might finally demand that, after decades of inaction, their lawmakers finally do something about unrestrained data collection.

Excerpts from Byron Tau, US Spy Agencies Know Your Secrets. They Bought Them, WSJ, Mar. 8, 2024

See also Means of Control: How the Hidden Alliance of Tech and Government Is Creating a New American Surveillance State by Byron Tau (published 2024).

What Do You Do When You Are Up for Sale?

Leave a reply

Under an executive order issued on February 28, 2024, specific classes of Americans’ sensitive data, including genomic, biometric, personal health, geolocation, financial and certain types of personal identifiers, will generally be barred from being sold or transferred in vast tranches to “countries of concern” or vendors known to supply data to them. The countries of concern are China, Russia, North Korea, Iran, Cuba and Venezuela, and have a record of misusing data on Americans, an official said.

In 2023, the U.S. intelligence community issued a groundbreaking report acknowledging that the vast amount of Americans’ personal data available for sale, which are often bought and repackaged by data brokers and then resold through a labyrinthine ecosystem of vendors and resellers, has provided a valuable stream of intelligence for the U.S. government and adversaries alike. The report, commissioned by Director of National Intelligence Avril Haines, admitted that such streams created significant threats to privacy, and had rapidly grown in scale such that they had begun to replicate the results of intrusive surveillance techniques, such as hacking, that are typically more targeted.

The executive order is notably silent on the purchasing of commercially available data sets by the U.S. government.

Excerpts from Dustin Volz, U.S. Limits Sales of Americans’ Personal Data to China, Other Adversaries, WSJ, Feb. 129, 2024

Your Car Leaks Information about You: Who Benefits?

Leave a reply

The California Privacy Protection Agency—created under a ballot initiative in 2020 and the only regulator in the nation solely dedicated to privacy issues—will examine the growing amalgamation of data collected by smart vehicles and whether the business practices of the companies collecting that data comply with state law. “Modern vehicles are effectively connected computers on wheels. They’re able to collect a wealth of information via built in apps, sensors, and cameras, which can monitor people both inside and near the vehicle,” Ashkan Soltani, the agency’s executive director, said in a statement in July 2023.

Regulators in Europe also have opened investigations into how the auto industry uses personal information from cars such as location data. In February 2023, Tesla agreed to offer a software update in Europe to change camera settings in cars after the Dutch privacy regulator investigated the company. Tesla disabled vehicles’ external security cameras by default until a driver turns on the function to record activity outside a car and changed the camera settings so they only save the last 10 minutes of footage recorded from outside the cars, compared with one hour of footage they previously had saved.  The Dutch regulator also said it was a privacy violation for the cameras to extensively record people outside of cars without their knowledge. The Tesla update also included features to warn people inside and outside of cars that the external cameras are recording. Headlights blink if the cameras are recording and a message is displayed on a touch screen inside the cars.

Automobiles represent the latest frontier for regulators, raising fresh questions about who will control the data generated by vehicles as they move through the world. Numerous companies are in a position to access the data—including the automakers themselves, companies that make or run in-car navigation or infotainment systems, satellite radio companies and in-vehicle security and emergency services providers. Insurance companies have also been encouraging consumers to share information about their driving behavior, sometimes in exchange for a discount.  

All the data has commercial potential. In some cases, it can be used by insurers in determining how to set rates, evaluate risk and gauge safe driving behavior…In some cases, data brokers make vehicle data available for sale—stripping it of personal information such as names. People’s movement patterns are often unique, however, and their real-world identities can be inferred in large-scale location data sets even when the data is stripped of personal information.

Law-enforcement agencies also can now obtain the historical location of suspects, usually with a warrant. The sensors on modern cars have raised national-security concerns as well. China in 2021 banned certain officials from owning or driving Tesla vehicles citing concerns that data the cars gather could be a source of national-security leaks.

Byron Tau, California Opens Privacy Probe Into Who Controls, Shares the Data Your Car Is Collecting, WSJ, July 31, 2023

Who Cares? Clicking Away Privacy Rights

Leave a reply

The latest developments in a high-profile criminal probe by  US special counsel John Durham show the extent to which the world’s internet traffic is being monitored by a coterie of network researchers and security experts inside and outside the US government. The monitoring is made possible by little-scrutinized partnerships, both informal and formal, among cybersecurity companies, telecommunications providers and government agencies.

The U.S. government is obtaining bulk data about network usage, according to federal contracting documents and people familiar with the matter, and has fought disclosure about such activities. Academic and independent researchers are sometimes tapped to look at data and share any findings with the government without warrants or judicial authorization…

Unlike the disclosures by former intelligence contractor Edward Snowden from nearly a decade ago, which revealed U.S. intelligence programs that relied on covert access to private data streams, the sharing of internet records highlighted by Mr. Durham’s probe concerns commercial information that is often being shared with or sold to the government in bulk. Such data sets can possess enormous intelligence value, according to current and former government officials and cybersecurity experts, especially as the power of computers to derive insights from massive data sets has grown in recent years.

Such network data can help governments and companies detect and counter cyberattacks. But that capability also has privacy implications, despite assurances from researchers that most of the data can’t be traced back to individuals or organizations.

At issue are several kinds of internet logs showing the connections between computers, typically collected on networking devices such as switches or routers. They are the rough internet equivalent of logs of phone calls—showing which computers are connecting and when, but not necessarily revealing anything about the content of the transmissions. Modern smartphones and computers generate thousands of such logs a day just by browsing the web or using consumer apps…

“A question worth asking is: Who has access to large pools of telecommunications metadata, such as DNS records, and under what circumstances can those be shared with the government?…Surveillance takes the path of least resistance…,” according to Julian Sanchez, a senior fellow at the Cato Institute.

Excerpts from Byron Tau et al., Probe Reveals Unregulated Access to Data Streams, WSJ, Feb.. 28, 2022