Surveillance state vs. freedom of travel / right to privacy

[washparkhorn 9939]

This is disturbing . . . 

https://twitter.com/isaiah_kb/status/1220354646687899650

 

 

[wildcat09 29377]

2 minutes ago, washparkhorn said:

This is disturbing . . . 

https://twitter.com/isaiah_kb/status/1220354646687899650

 

 

Very cool shit. There's no reason whatsoever to be concerned about what the alt-right might do with such a tool, since they're not the government.

[washparkhorn 9939]

The CEO goes by he/him now - and American law enforcement loves his product. 

The software – which is marketed as “technology to help solve the hardest crimes” – has been labelled “creepy” but has found an enthusiastic audience among American police departments that are paying $14,600 ($US10,000) and up for the ability to upload a photograph of a perpetrator to quickly get a list of possible suspects.

Departments have been able to identify perpetrators of crimes from bystander videos, surveillance cameras and cold-case files, and more than 600 different jurisdictions are claimed among the company’s customers.

Supported by successful investor Peter Thiel – known for his successful backing of Facebook and other firms – Clearview AI, which Ton-That started as a passion project after several failed app projects, threatens to turn every publicly-available online photo into a trap that means almost nobody will be able to avoid.

https://ia.acs.org.au/article/2020/an-australian-inventor-just-killed-privacy.html

I don't know how you stop it. Masks?

[bernorange 8363]

So with the primary elections and coronavirus stories dominating the media's attention, I suspect most people have no idea that there is a battle brewing over surveillance reform as parts of FISA are expiring.

Quote

President Donald Trump told top House and Senate Republicans on Tuesday evening that he would not support a clean extension of federal surveillance powers and called for them to work out a deal with Democrats on how to move forward.

GOP leaders are already talking about a potential 30-day extension of provisions in the Foreign Intelligence Surveillance Act while they try to hammer out a deal with Democrats.

Trump’s comments in an hour-plus meeting on Tuesday night came despite a push from Attorney General William Barr to modify the law administratively to appease the president, who has railed in the past against the spying law after authorities used it to monitor an associate of his 2016 campaign.

“The president made it exceedingly clear he will not accept a clean re-authorization ... without real reform," Sen. Rand Paul (R-Ky.), told reporters after the meeting. "He was told by the attorney general, we can massage around the edges and we can fix this through regulation, the president didn't accept that, pushed back very vigorously and said 'we're not doing this.'"

Trump instead told the lawmakers: "You all work out a bipartisan deal and come back to me and I’ll sign it," according to a source in the room.

Aides to Speaker Nancy Pelosi (D-Calif.) and House Minority Leader Kevin McCarthy (R-Calif.) are having staff level discussions on “discrete provisions where there are possible bipartisan compromises," according to a source familiar with the discussions. There is no sense among lawmakers that a deal is imminent at this point, and the provisions are set to expire on March 15.
...

https://www.politico.com/news/2020/03/03/gop-trump-meeting-fisa-surveillance-law-119417?fbclid=IwAR0Tm30gas7-o483NjQV0BQeHHHfIa9DhNiUWO5ndWcr4nuolTh-hhByGq8

[Anastasis 23481]

Related, FISA court issued a new order regarding FBI and DOJ reforms to process.  They are going to start requiring some new checklist work tools, and a new boilerplate attestation.  Also FBI will think about some training. It's a joke.  The only way to fix the system is through aggressive legislative fixes that check both the court and the executive.  Yeah, I will hold my breath.  

https://www.fisc.uscourts.gov/sites/default/files/Misc 19 02 Opinion and Order PJ JEB 200304.pdf

 

[WBT 20655]

22 hours ago, bernorange said:

Trump’s comments in an hour-plus meeting on Tuesday night came despite a push from Attorney General William Barr to modify the law administratively to appease the president, who has railed in the past against the spying law after authorities used it to monitor an associate of his 2016 campaign.

Finally a benefit of a president who associates with criminals.

[bernorange 8363]

On 4/29/2019 at 9:36 AM, bernorange said:

More:  https://www.eff.org/deeplinks/2019/04/googles-sensorvault-can-tell-police-where-youve-been

 

[bernorange 8363]

Quote

The mobile phone industry has explored the creation of a global data-sharing system that could track individuals around the world, as part of an effort to curb the spread of Covid-19.

The Guardian has learned that a senior official at GSMA, an international standard-setting body for the mobile phone industry, held discussions with at least one company that is capable of tracking individuals globally through their mobile devices, and discussed the possible creation of a global data-sharing system.
...

https://www.theguardian.com/world/2020/mar/25/mobile-phone-industry-explores-worldwide-tracking-of-users-coronavirus

Quote

Edward Snowden on Monday warned that high-tech surveillance measures governments use to fight the outbreak of COVID-19, the disease caused by the newly identified coronavirus, could have a long-lasting impact.
...

https://www.cnet.com/news/snowden-warns-government-surveillance-amid-covid-19-could-be-long-lasting/

Quote

...
Of the funding allocated to the CDC, the bill sets aside at least $500 million for public health data surveillance and modernizing the analytics infrastructure. The CDC must report on the development of a "surveillance and data collection system" within the next 30 days. While it's not clear what form that surveillance system will take, the federal government has reportedly expressed interest in aggregating data that can be gleaned from tech platforms and smartphone use to monitor movement patterns.
...

https://www.businessinsider.com/cdc-coronavirus-surveillance-and-data-collection-stimulus-package-2020-3

[bernorange 8363]

Quote

A bipartisan amendment that would have prohibited law enforcement agencies, such as the FBI, from obtaining the web browsing and internet search histories of Americans without a warrant failed to pass in the U.S. Senate on Wednesday by a single vote.

Twenty-seven Republicans and 10 Democrats voted against the amendment to H.R. 6172, which will reauthorize lapsed surveillance powers under the Foreign Intelligence Surveillance Act (FISA). The amendment offered up by Sen. Ron Wyden, Democrat of Oregon, and Sen. Steve Daines, Republican of Montana, would have forced the government to get a warrant before obtaining the internet search history of Americans.

Under Section 215 of the Act, the government can compel phone companies and internet service providers to turn over such data, if it is deemed vaguely “relevant” to a terrorism or counterespionage case.

In a speech on the Senate floor ahead of the vote, Sen. Wyden questioned whether law-abiding Americans should have to “worry about their government looking over their shoulders” at all times of the day.

“The typical American may think to themselves, I’ve got nothing to worry about. I’ve done nothing wrong. The government has no reason to suspect me of anything. Why should I worry?” Wyden said. “Unfortunately, the question is not whether you did anything wrong. The question is whether a government agent believes they have the right to look at your web searches.”

“The warrantless collection of Americans’ web browsing history,” added Wyden, “offers endless opportunities for abuse.”
...
The final vote on Wyden-Daines Amendment was 59-37. Sixty “ayes” were required for it to pass. Members had to be physically present to vote.

Below is a list of senators, by party, who voted against the reform (and those who didn’t vote at all):

Republicans (27):

Barrasso, John (R-WY)
Blackburn, Marsha (R-TN)
Blunt, Roy (R-MO)
Boozman, John (R-AR)
Burr, Richard (R-NC)
Capito, Shelley Moore (R-WV)
Collins, Susan M. (R-ME)
Cornyn, John (R-TX)
Cotton, Tom (R-AR)
Fischer, Deb (R-NE)
Graham, Lindsey (R-SC)
Hyde-Smith, Cindy (R-MS)
Inhofe, James M. (R-OK)
Johnson, Ron (R-WI)
Lankford, James (R-OK)
McConnell, Mitch (R-KY)
Perdue, David (R-GA)
Portman, Rob (R-OH)
Roberts, Pat (R-KS)
Romney, Mitt (R-UT)
Rubio, Marco (R-FL)
Shelby, Richard C. (R-AL)
Thune, John (R-SD)
Tillis, Thom (R-NC)
Toomey, Patrick J. (R-PA)
Wicker, Roger F. (R-MS)
Young, Todd (R-IN)

Democrats (10):

Carper, Thomas R. (D-DE)
Casey, Robert P., Jr. (D-PA)
Feinstein, Dianne (D-CA)
Hassan, Margaret Wood (D-NH)
Jones, Doug (D-AL)
Kaine, Tim (D-VA)
Manchin, Joe, III (D-WV)
Shaheen, Jeanne (D-NH)
Warner, Mark R. (D-VA)
Whitehouse, Sheldon (D-RI)

Four members did not cast votes: Sen. Bernie Sanders (I-VT), Sen. Ben Sasse (R-NE), Sen. Lamar Alexander (R-TN), and Sen. Patty Murray (D-WA).
...

https://gizmodo.com/heres-who-just-voted-to-let-the-f-b-i-seize-your-searc-1843445032

Fuck you Cornyn.

[bernorange 8363]

Not related to government, just another self inflicted wound society embraces without any real cost analysis...

Quote

...
Maryland-based Rekor Systems Inc. has started offering home video surveillance software through a service called Watchman, starting at $5 a month. In addition to reading a license plate, the system can record a vehicle’s make, color, and body type. In October, Rekor will launch what it says is a “first of its kind” mobile app, which will let users scan license plates with their phone camera. The app could come in handy for schools, to “securely identify valid visitors for student pickup lines” or to manage cars in parking lots, among other uses, the company says.

The rise of more casual and cheap surveillance is putting tools once primarily used by law enforcement into the hands of virtually anyone. Privacy advocates worry about how personal information will be stored, shared, and used in the absence of clear legal protections.
...

https://www.bloomberg.com/news/articles/2020-09-30/license-plate-scanners-for-police-are-becoming-cheaper-more-available?srnd=premium

Concerns about government using mass surveillance to track movements will be deflected the same way phone and internet surveillance was - by outsourcing to private companies.

[bernorange 8363]

So back in posts #38 and 43 (almost two years ago), I highlighted some news about Palantir Technologies building a supercomputer system to analyze financial transactions.  I ran across this report this morning:

Quote

Palantir Technologies Inc.’s business is increasing steadily, helped by more government and corporate contracts in part because of the coronavirus pandemic, it said as it reported earnings Thursday for the first time since going public.

The data-analytics company posted a quarterly loss of nearly $900 million that was mostly because of stock-based compensation. The tone of its first earnings call was upbeat and the company raised its full-year revenue outlook to a range of $1.07 billion to $1.072 billion, up 44% year over year.

The pandemic has “created enormous opportunities for us,” said Shyam Sankar, Palantir’s chief operating officer, on the company’s earnings call. The company is helping the government track clinical data and has been tapped to help with vaccine distribution, too. Besides the coronavirus, though, Sankar said he foresees a “large, systemic transformation in health care” that could benefit Palantir PLTR, 2.74%.
...

https://www.marketwatch.com/story/palantir-shares-fall-sharply-after-first-earnings-report-as-public-company-11605216662

The way I read between those lines, Palantir is busy building more surveillance tech for Govco - likely over medical data/profiling.

[Mrs Whiggins 13050]

Disturbing....Stephen Miller has bookmarked this.

 

[Anastasis 23481]

On 11/13/2020 at 8:34 AM, bernorange said:

So back in posts #38 and 43 (almost two years ago), I highlighted some news about Palantir Technologies building a supercomputer system to analyze financial transactions.  I ran across this report this morning:

https://www.marketwatch.com/story/palantir-shares-fall-sharply-after-first-earnings-report-as-public-company-11605216662

The way I read between those lines, Palantir is busy building more surveillance tech for Govco - likely over medical data/profiling.

FYI, the C19 vax administration and distribution data are being run through Palantir. 

[Biff Tannen 45712]

38 minutes ago, Anastasis said:

FYI, the C19 vax administration and distribution data are being run through Palantir. 

[Anastasis 23481]

File this one in the "no fucking shit" file. 

https://www.washingtonpost.com/politics/senators-cia-has-secret-program-that-collects-american-data/2022/02/10/017b6932-8ad8-11ec-838f-0cfdf69cce3c_story.html

https://www.wyden.senate.gov/imo/media/doc/HainesBurns_WydenHeinrich_13APR21 -FINAL.pdf

I love that a letter from our senators to the CIA head is redacted. That's awesome.

Also LOL that the gatekeeper here is literally a pop-up box warning to the analyst that leaves limited audit trail.

 

Senators: CIA has secret program that collects American data

WASHINGTON — The CIA has a secret, undisclosed data repository that includes information collected about Americans, two Democrats on the Senate Intelligence Committee said Thursday. While neither the agency nor lawmakers would disclose specifics about the data, the senators alleged the CIA had long hidden details about the program from the public and Congress.

Sens. Ron Wyden of Oregon and Martin Heinrich of New Mexico sent a letter to top intelligence officials calling for more details about the program to be declassified. Large parts of the letter, which was sent in April 2021 and declassified Thursday, and documents released by the CIA were blacked out. Wyden and Heinrich said the program operated “outside the statutory framework that Congress and the public believe govern this collection.”

There have long been concerns about what information the intelligence community collects domestically, driven in part by previous violations of Americans’ civil liberties. The CIA and National Security Agency have a foreign mission and are generally barred from investigating Americans or U.S. businesses. But the spy agencies’ sprawling collection of foreign communications often snares Americans’ messages and data incidentally.

Intelligence agencies are required to take steps to protect U.S. information, including redacting the names of any Americans from reports unless they are deemed relevant to an investigation. The process of removing redactions is known as “unmasking.”

“CIA recognizes and takes very seriously our obligation to respect the privacy and civil liberties of U.S. persons in the conduct of our vital national security mission,” Kristi Scott, the agency’s privacy and civil liberties officer, said in a statement. “CIA is committed to transparency consistent with our obligation to protect intelligence sources and methods.”

The CIA released a series of redacted recommendations about the program issued by an oversight panel known as the Privacy and Civil Liberties Oversight Board. According to the document, a pop-up box warns CIA analysts using the program that seeking any information about U.S. citizens or others covered by privacy laws requires a foreign intelligence purpose.

“However, analysts are not required to memorialize the justification for their queries,” the board said.

Both senators have long pushed for more transparency from the intelligence agencies. Nearly a decade ago, a question Wyden posed to the nation’s spy chief presaged critical revelations about the NSA’s mass-surveillance programs.

In 2013, Wyden asked then-Director of National Intelligence James Clapper if the NSA collected “any type of data at all on millions or hundreds of millions of Americans.” Clapper initially responded, “No.” He later said, “Not wittingly.”

Former systems administrator Edward Snowden later that year revealed the NSA’s access to bulk data through U.S. internet companies and hundreds of millions of call records from telecommunications providers. Those revelations sparked worldwide controversy and new legislation in Congress.

Clapper would later apologize in a letter to the Senate Intelligence Committee, calling his response to Wyden “clearly erroneous.”

According to Wyden and Heinrich’s letter, the CIA’s bulk collection program operates outside of laws passed and reformed by Congress, but under the authority of Executive Order 12333, the document that broadly governs intelligence community activity and was first signed by President Ronald Reagan in 1981.

“It is critical that Congress not legislate without awareness of a ... CIA program, and that the American public not be misled into believe that the reforms in any reauthorization legislation fully cover the IC’s collection of their records,” the senators wrote in their letter. There was a redaction in the letter before “CIA program.”

Additional documents released by the CIA Thursday also revealed limited details about a program to collect financial data against the Islamic State. That program also has incidentally snared some records held by Americans.

Intelligence agencies are subject to guidelines on the handling and destruction of Americans’ data. Those guidelines and laws governing intelligence activity have evolved over time in response to previous revelations about domestic spying.

The FBI spied on the U.S. civil rights movement and secretly recorded the conversations of Dr. Martin Luther King. The CIA, in what was called Operation Chaos, investigated whether the movement opposing the Vietnam War had links to foreign countries.

“These reports raise serious questions about the kinds of information the CIA is vacuuming up in bulk and how the agency exploits that information to spy on Americans,” Patrick Toomey, a lawyer for the American Civil Liberties Union, said in a statement. “The CIA conducts these sweeping surveillance activities without any court approval, and with few, if any, safeguards imposed by Congress.”

[atomheartbevo 89779]

18 minutes ago, Anastasis said:

File this one in the "no fucking shit" file. 

Yep, given how much private companies know about us, there's no way the government wasn't also vacuuming up data that it came across (plus probably purchasing data from private databases).

On an almost related note, had a relative in another state bitching that they were having to do some extra stuff recently to get their driver's license renewed, because of Real ID.   I told them they should have complained back in 2005 when it passed Congress and was signed by the President.  They tried to blame Obama.

[Captainant 27727]

No fucking duh. The patriot act sends its regards.

Any Joe public can buy your real-time location data from your cellular provider. We do not have a general data protection order for the US or any illusion of privacy. In short:

[bernorange 8363]

Quote

HOUSTON - Houstonians have been demanding for something to be done about the recent rising crime. So one Houston City Council member is planning to use technology in his district to help combat crime.
...
So 100 license plate readers will soon be set up in his district. They will take a still photo of every passing vehicle.

"It won’t be an invasion on your privacy rights because the only still photos that will be documented and sent to HPD are only for cars that have been reported to have been involved in a crime. Sometimes people feel like this may be big brother, but sometimes when times are tough and times are hard, you call on your big brother for help and so that’s what we’re doing." says Councilman Pollard.
...

https://www.fox26houston.com/news/using-technology-as-a-tool-to-fight-crime-in-houston

HPD may not have unfettered access to the database, but Flock Safety ( https://www.flocksafety.com/ ) is still recording everything there and the data will be available for surveillance purposes.

[Captainant 27727]

Bump

FTC Sues ‘Massive’ Data Broker for Selling Location Info on Abortion Clinics

Quote

The Federal Trade Commission (FTC) has sued Kochava, a large location data provider, for allegedly selling data that the FTC says can track people at reproductive health clinics and places of worship, according to an announcement from the agency.

The news is a dramatic move from the FTC in a post-Roe United States, and signals that the agency will take steps against what it identifies as privacy violations around reproductive health and location data.

“Defendant’s violations are in connection with acquiring consumers’ precise geolocation data and selling the data in a format that allows entities to track the consumers’ movements to and from sensitive locations, including, among others, locations associated with medical care, reproductive health, religious worship, mental health temporary shelters, such as shelters for the homeless, domestic violence survivors, or other at risk populations, and addiction recovery,” the lawsuit reads.

In its announcement, the FTC says its lawsuit is seeking to stop Kochava’s sale of sensitive location data and “require the company to delete the sensitive geolocation information it has collected.”

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said in a statement published with the announcement. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

As for why the FTC may have targeted Kochava specifically, Zach Edwards, a researcher who has closely followed the data trade, told Motherboard in an online chat “they are huge. Massive. And have more data broker partners than almost anyone in my opinion.”

On its website, Kochava says it delivers “better insights and actionable data in one operational platform.” Kochava sells a spread of products and capabilities based on different datasets, including letting clients gauge the effectiveness of televised adverts.

 

In its lawsuit, the FTC includes a screenshot of Kochava data available for sale via Amazon Web Services data marketplace. That data includes the unique Mobile Advertising ID (MAID) linked to a device—either an IDFA for Apple devices or an ADID for Android—as well as that device’s precise GPS coordinates for a particular point in time. The lawsuit explains Kochava’s process for requesting a sample of the data and it seems very straightforward.

“A purchaser could use an ordinary personal email address and describe the intended use simply as ‘business.’ The request would then be sent to Kochava for approval. Kochava has approved such requests in as little as 24 hours,” the lawsuit says. One day of the sample data included over 327,480,00 rows and 11 columns data regarding over 61 million unique devices, and the sample included precise location data gathered in the seven days prior to the request being approved, the lawsuit adds.

With this data, the FTC says that by taking that data and plotting it with mapping programs “it is possible to identify which consumers’ mobile devices visited reproductive health clinics.”

As Motherboard has reported, armed with a MAID third parties can unmask phone users, by turning to certain companies that provide deanonymization services at scale. These companies offer personal information that they have linked to a specific MAID. Even without that service, it can be possible to identify people based on just the location data itself, such as seeing where a device is usually overnight and determining that is where the person sleeps.

The FTC alleges just that. “In fact, in just the data Kochava made available in the Kochava Data Sample, it is possible to identify a mobile device that visited a women’s reproductive health clinic and trace that mobile device to a single family residence. The data set also reveals that the same mobile device was at a particular location at least three evenings in the same week, suggesting the mobile device user’s routine. “The data may also be used to identify medical professionals who perform, or assist in the performance, of abortion services,” the lawsuit adds.

Kochava, in a way, knew this lawsuit was coming. Earlier this month, Kochava filed its own lawsuit against the FTC after reviewing a copy of the FTC’s proposed complaint. At the time of that lawsuit, Kochava defended its data collection practices in a statement to Ars Technica. “Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy. Nonetheless, Kochava has been threatened by the FTC with a lawsuit and a proposed settlement, the merits upon which are not accurate. This is a manipulative attempt by the FTC to give the appearance that it is protecting consumer privacy despite being based on completely false pretenses,” the statement read. After receiving the FTC complaint, Kochava announced a feature called “Privacy Block” which it says “removes health services location data from the Kochava Collective marketplace,” Ars Technica added. 

Kochava did not immediately respond to Motherboard’s request for comment on Monday regarding the FTC filing its lawsuit. The FTC declined to comment on why it targeted Kochava specifically.

Motherboard has reported on multiple companies selling location data products related to abortion clinic visits. In May, Motherboard found SafeGraph was selling location data of people who visited abortion clinics for as little as $160. Motherboard then found another firm called Placer.ai provided heat maps of where abortion clinic visitors live. Both companies removed the data for sale after Motherboard’s findings.

Here's the meat of the issue:

In its lawsuit, the FTC includes a screenshot of Kochava data available for sale via Amazon Web Services data marketplace. That data includes the unique Mobile Advertising ID (MAID) linked to a device—either an IDFA for Apple devices or an ADID for Android—as well as that device’s precise GPS coordinates for a particular point in time. The lawsuit explains Kochava’s process for requesting a sample of the data and it seems very straightforward.

“A purchaser could use an ordinary personal email address and describe the intended use simply as ‘business.’ The request would then be sent to Kochava for approval. Kochava has approved such requests in as little as 24 hours,” the lawsuit says. One day of the sample data included over 327,480,00 rows and 11 columns data regarding over 61 million unique devices, and the sample included precise location data gathered in the seven days prior to the request being approved, the lawsuit adds.

With this data, the FTC says that by taking that data and plotting it with mapping programs “it is possible to identify which consumers’ mobile devices visited reproductive health clinics.”

[elfenix 34331]

doing this right now:

Quote

The ad identifier - aka “IDFA” on iOS, or “AAID” on Android - is the key that enables most third-party tracking on mobile devices. Disabling it will make it substantially harder for advertisers and data brokers to track and profile you, and will limit the amount of your personal information up for sale.

https://www.eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now

[bernorange 8363]

Quote

NCLA Files Class-Action Against Massachusetts for Auto-Installing Covid Spyware on 1 Million Phones

Nov 15, 2022 | Press Releases

Washington, DC (November 15, 2022) – The Massachusetts Department of Public Health (DPH) worked with Google to auto-install spyware on the smartphones of more than one million Commonwealth residents, without their knowledge or consent, in a misguided effort to combat Covid-19. Such brazen disregard for civil liberties violates the United States and Massachusetts Constitutions and cannot stand. The New Civil Liberties Alliance, a nonpartisan, nonprofit civil rights group, has filed a class-action lawsuit, Wright v. Massachusetts Department of Public Health, et al., challenging DPH’s covert installation of a Covid tracing app that tracks and records the movement and personal contacts of Android mobile device users without owners’ permission or awareness.

Plaintiffs Robert Wright and Johnny Kula own and use Android mobile devices and live or work in Massachusetts. Since June 15, 2021, DPH has worked with Google to secretly install the app onto over one million Android mobile devices located in Massachusetts without obtaining any search warrants, in violation of the device owners’ constitutional and common-law rights to privacy and property. Plaintiffs have constitutionally protected liberty interests in not having their whereabouts and contacts surveilled, recorded, and broadcasted, and in preventing unauthorized and unconsented access to their personal smartphones by government agencies.

Once “automatically installed,” DPH’s contact tracing app does not appear alongside other apps on the Android device’s home screen. The app can be found only by opening “settings” and using the “view all apps” feature. Thus, the typical device owner remains unaware of its presence. DPH apparently decided to secretly install the contact tracing app onto over one million Android devices because few Massachusetts citizens were downloading its initial version, which required voluntary adoption. DPH decided to mass-install the app without device owners’ knowledge or consent. When smartphone owners delete the app, DPH simply re-installs it. Plaintiffs’ class-action lawsuit contains nine counts against DPH, including violations of their Fourth and Fifth Amendment rights under the U.S. Constitution, and violations of Articles X and XIV of the Massachusetts Declaration of Rights.

No statutory authority supports DPH’s conduct, which serves no public health purpose, especially since Massachusetts has ended its statewide contact-tracing program. No law or regulation authorizes DPH to secretly install any type of software—let alone what amounts to spyware designed specifically to obtain private location and health information—onto the Android devices of Massachusetts residents. The U.S. District Court for the District of Massachusetts should grant injunctive relief, along with nominal damages, to the class. NCLA is unaware at this time of other states that engaged in a similar surreptitious strategy of auto-installing contact-tracing apps. It appears Massachusetts iPhone users had to consent before a similar app installed on their devices.

NCLA released the following statements:

“Many states and foreign countries have successfully deployed contact tracing apps by obtaining the consent of their citizens before downloading software onto their smartphones. Persuading the public to voluntarily adopt such apps may be difficult, but it is also necessary in a free society. The government may not secretly install surveillance devices on your personal property without a warrant—even for a laudable purpose. For the same reason, it may not install surveillance software on your smartphone without your awareness and permission.”
— Sheng Li, Litigation Counsel, NCLA 

“The Massachusetts DPH, like any other government actor, is bound by state and federal constitutional and legal constraints on its conduct. This ‘android attack,’ deliberately designed to override the constitutional and legal rights of citizens to be free from government intrusions upon their privacy without their consent, reads like dystopian science fiction—and must be swiftly invalidated by the court.”
— Peggy Little, Senior Litigation Counsel, NCLA  

For more information visit the case page here.

https://nclalegal.org/2022/11/ncla-files-class-action-against-massachusetts-for-auto-installing-covid-spyware-on-1-million-phones/

[Dahobbs 17655]

18 minutes ago, bernorange said:

https://nclalegal.org/2022/11/ncla-files-class-action-against-massachusetts-for-auto-installing-covid-spyware-on-1-million-phones/

I'm going to need a lot more than a press release from the crackpot group founded in 2017 that has attacked the constitutionality of consumer finance protection bureau, administrative law judges generally, and the the EEOC determination that freedom for discrimination on the basis of sex also protects discrimination based on sexual orientation (in other words, this group wanted employers to be free to discriminate against gays). 

[bernorange 8363]

23 hours ago, Dahobbs said:

I'm going to need a lot more than a press release ...

The complaint is available here:  https://nclalegal.org/wp-content/uploads/2022/11/Complaint_Wright-with-Exhibit.pdf

Excerpt (visit link above for citations and images):

Quote

...
20. Massachusetts DPH developed two versions of its contact-tracing apps for use on Android devices using the Google API.

21. The first version, labeled “MassNotify” in the Google Play Store, became available in or around April 2021 and—like other States’ apps—requires an Android user to affirmatively install. It also appeared as an icon on the device’s home screen. According to the Google Play Store, as of November 8, 2022, this version of MassNotify has been installed by only approximately 5,000 Android users and has 50 reviews, several of which complain of the version’s low rate of adoption.16 For example, one reviewer stated in May 2021 that “[i]f adoption were wider, this app might be more useful,” and another complained in June 2021 that “[i]t appears no one else uses the app except my immediate family.”17

22. This initial version of MassNotify is no longer being maintained and is not functional. On January 20, 2022, a reviewer stated that she “tried to enter a positive self test and I had no way to get a verification code.”18 Another April 26, 2022 reviewer stated “When I try to report a positive test it requests a Verification code? However, none is sent to my phone or email address and there seems to be no way to request one be sent.”19

23. The second version was originally labelled “MassNotify v.3” in the Google Play Store,20 but has since been re-branded as “Exposure Notification Settings Feature–MA.” This version is referred to herein as DPH’s Contact Tracing App. Instead of making the Contact Tracing App available for voluntary download, however, starting on or around June 15, 2021, DPH worked with Google to “automatically distribute[]” the App to Android devices “so users don’t have to download a separate app.”21 In other words, the Contact Tracing App was installed onto Android mobile devices without users’ permission or awareness. Upon information and belief, DPH and Google developed the revised App in order to overcome Android users’ low rate of voluntary adoption of the initial App. According to the Google Play Store, DPH’s Contact Tracing App was installed onto over one million Android.22 On information and belief, the overwhelming majority of these installs were surreptitious.

24. The Contact Tracing App is identical to the initial MassNotify app except that it installs without device owners’ permission. As one Google Play review explained on June 19, 2021: there are “2 different entries of this app on the playstore, one autoinstalled on my device without permission overnight. I did some research finding myself on this [initial] one where I am still able to install on my phone at the same time as the other that looks exactly like this, other than
the reviews and downloads. This is highly weird and disrespectful of our privacy. I wouldn’t trust the app at all.”23

25. Once “auto-installed,” DPH’s Contact Tracing App does not appear alongside other apps on the Android device’s home screen. Rather, the App can be found only by opening “settings” and using the “view all apps” feature.24 Thus, by design, the typical device owner would remain unaware of its presence.

26. On information and belief, DPH decided to secretly install the Contact Tracing App onto over one million Android devices because its initial version, which required voluntary download, was not being widely adopted by Massachusetts citizens by June 2021. Rather than implement an awareness campaign to encourage voluntary adoption, like other States did, DPH took a shortcut and mass-installed the App without device owners’ awareness or permission.

27. On information and belief, DPH used cell site location information (“CSLI”) to target all Android devices located in or transported through the Commonwealth of Massachusetts for installation.

28. No law or regulation authorizes DPH to install any type of software—let alone what amounts to spyware designed to obtain location and health information—onto the Android devices of Massachusetts residents without their awareness or permission.

29. As of September 22, 2022, there are approximately 1,900 reviews of DPH’s Contact Tracing App on the Google Play Store, the vast majority of which are lowest-possible one-star ratings.25 A screenshot of the distribution of reviews taken on November 8, 2022, shows the following:

30. Reviewers complain that, without permission, the App downloaded onto their mobile devices, turning on the Bluetooth—likewise without permission—and hiding itself in “settings” instead of appearing as an icon alongside all other apps on the device. Some illustrative examples are listed below:

a. “I absolute did not install this on my phone. It was silently installed without notification. It doesn’t have an app icon—you have to go through settings and view all apps. This is a huge privacy and security overstep.”

b. “As with other people, this was downloaded without my knowledge or permission, but on my Samsung tablet, which has not traveled to Massachusetts. Only saw it
because my internet protection program is set up to ask to scan new apps.”

c. “SPYWARE?! Automatically installed without consent. It has no icon, no way to open this and see what it even does, which is a huge red flag. Per the notifications
it runs on Bluetooth which is a major battery drain, and seems to want to track my location.”

d. “I always turn off data, location and Bluetooth on this phone because I have VERY limited data, by my own CHOICE, but those settings kept getting turned on in the
past few days, so i went into ‘my apps’ to check why and TADAAA!! Whaddayaknow, this app is the culprit! And it installed SILENTLY!? This could have cost me a LOT of $$ had I not figured it out, like most people probably won’t!?”

e. “I hate this app. This downloaded onto my device without me noticing and now I am getting notifications everyday from it telling me to turn it’s [sic] service on. I
can’t even open it with an icon!”

f. “I never installed this and never saw it until I went in to update apps. It definitely installed on its own and I believe I caught the tail end of it installing one day when I saw something saying finish installing and I could never find out what that was.”

g. “I can’t believe I just found this app on my phone. This app downloaded itself onto my phone. I did NOT give Google or any authority permission to do so. I also never
opted into the Android Covid-19 notification program. This is ridiculous and utterly unacceptable.”

h. “Did not install - Appeared on my phone without my consent and I didn't download. This is not acceptable. I understand the premise and well meaning behind the app -
but again - my cell phone is MY personal property and the thought of someone (or the government) to think their app is so important to just auto-install it on my phone
hit every level of audacity. Shame on you.”

i. “Omg!!!! This app somehow installed itself on my phone. I uninstalled it and went to free up some space by getting rid of apps i dont really use, and it had already
reinstalled itself. After i post this, I[] bet it will have reinstalled again. This app is harder to get rid of than Covid.”26

31. DPH began secretly installing its Contact Tracing App onto Android mobile devices owned by individuals who reside in or travel to or through Massachusetts on or around June 15, 2021. On information and belief, DPH continues to secretly install the App onto Android devices without obtaining owners’ permission or awareness. For example, on September 18, 2022, a one-star review on Google Play stated that he or she “[d]idnt even install it” and that DPH’s Contact Tracing App “[j]ust showed up.”27 Another complained on September 14, 2022: “Every time something COVID related has come up on my phone, I have denied permission and opted out. I went to update a different app and found this had been installed and had an update as well. I promptly uninstalled it. I wonder where the legality lies.”28

32. On information and belief, DPH periodically installs the App onto all Android devices located in or being transported through Massachusetts. To accomplish the stealth installations of the Contact Tracing App, DPH uses an Android device’s location data to target individuals who happen to be in Massachusetts. As a result, individuals who reside in other States but travel to or through Massachusetts, such as Plaintiffs, will have the App installed on their Android devices. For instance, one Google Play reviewer stated: “I am not a Massachusetts resident and this spyware was surreptitiously installed on my phone without my consent or notification. It keeps reinstalling itself after removal. Words cannot describe how violated this makes me feel both from MA and Google.”29

33. Even after a device owner uninstalls the App, the App “keeps reinstalling itself after removal.”

34. Because the App does not appear as an icon on the Android devices’ home screen, several reviewers expressed confusion regarding how to uninstall the App even after they discovered its presence. For example, multiple reviewers stated they do not know how to uninstall the app even after they learned of the App’s existence.33 On information and belief, a significant portion of the over one million individuals on whose devices the App was secretly installed remains ignorant of the App’s presence or unaware of how to uninstall the App. This is by deliberate design.

35. While other States have also used Google’s API to develop contact tracing applications for Android Devices, those other States do not secretly install their apps without device owners’ permission or awareness. Reviews of Virginia Department of Health’s app, COVIDWISE, for instance, do not complain of secret and non-consensual installations.34 Nor do reviewers of New York’s COVID Alert NY app, even though there may be as many downloads of COVID Alert NY as DPH’s Contact Tracing App.35

III. DPH’S CONTACT TRACING APP EXPOSES MOVEMENT AND PERSONAL CONTACT INFORMATION

36. DPH’s Contact Tracing Apps generates for each mobile device a random “Rolling Proximity Identifier” every 15 to 20 minutes.36 The App causes the mobile device to broadcast the Identifier via Bluetooth to other Bluetooth-enabled devices within range.

37. The App also causes the mobile device to broadcast a MAC address via Bluetooth, which is a sequence of characters that identifies a device on a network.37 Each mobile device has a MAC address that can be used to identify the owner.

38. MAC addresses are also readily associated with specific locations. For example, an open-source project called “Wigle” maintains a publicly searchable database associating MAC addresses with specific locations.38 Thus, knowing when an individual’s device connected with a MAC address associated with a specific location—such as a store—would provide knowledge of the device owner’s location at a particular time. And a series of such data points would provide a reasonably precise timeline of the device owner’s movement.

39. The App also causes the user’s mobile device to receive RPIs and MAC addresses that are broadcast by other devices within Bluetooth range.

40. The App records all RPIs and MAC addresses that it broadcasts and receives, along with the precise time and estimated distance from the source based on the Bluetooth signal strength.

...

 

[Dahobbs 17655]

Great, you've now given me two statements by the same questionable group. I'm assuming it's all bullshit until there is any independent verification. 

[bernorange 8363]

I suppose the truth might get discerned as the case runs it's course in court, but that's a pretty lazy ad hominem when the complaint is citing evidence from 3rd parties.

[bernorange 8363]

Best I can tell, Wright et al v. Massachusetts Department of Public Health et al is still in progress:

https://dockets.justia.com/docket/massachusetts/madce/3:2022cv11936/250462

~~~

Quote

A newly released government audit revealed details about the Federal Bureau of Investigation’s (FBI) abuse its access to foreign intelligence information collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA). Section 702, which is due to expire at the end of 2023, authorizes the government to target foreigners for surveillance and acquire their internet communications with the compelled cooperation of U.S. service providers. According to the audit, highlighted in a Wired report today, FBI personnel conducted unlawful searches of Section 702 databases on numerous occasions, including searches relating to a member of Congress, a local political party, and a tip based on racial profiling.

For years, EPIC has advocated for a ban on warrantless backdoor searches, arguing that the FBI’s query and use Section 702 data in routine criminal investigations entirely unrelated to national security without a warrant—or even an individualized court order—raises Fourth Amendment concerns. Most recently, EPIC urged the Privacy and Civil Liberties Oversight Board to recommend prohibiting warrantless backdoor searches and has joined a coalition of civil liberties groups proposing broader reform to Section 702. EPIC is also committed to increasing transparency around the FBI’s Section 702 activities. In EPIC v. NSD, EPIC obtained a report containing important information about the FBI’s use of Section 702 authority.

EPIC recently published an overview of Section 702 as part of a new blog series focused on explaining Section 702 and the need to reform it.
...

More (including reference links):

https://epic.org/epic-renews-call-for-fisa-section-702-reform-following-new-disclosures-of-unlawful-fbi-backdoor-searches/

~~~

Quote

The Supreme Court declined to hear Wikimedia v. NSA, Wikimedia’s challenge to the NSA’s mass surveillance of Internet communications under Section 702 of the Foreign Intelligence Surveillance Act (FISA), which expires at the end of 2023. The district court and Fourth Circuit Court of Appeals both ruled that the case must be dismissed under the “state secrets privilege” because the NSA said it would have to reveal national security secrets to defend its actions in court.
...

https://epic.org/supreme-court-refuses-to-hear-case-challenging-nsa-surveillance/

Another take on the SCOTUS (non-)decision:

Quote

... With "state secrets privilege" barring litigation, that leaves upcoming congressional debates over renewal of the law authorizing the program as the only recourse for civil liberties advocates.
...

https://reason.com/2023/02/27/scotus-says-domestic-spying-is-too-secret-to-be-challenged-in-court/

~~~

POTUS announced a National Cybersecurity Strategy that says (bold emphasis is mine):

Quote

PILLAR TWO | DISRUPT AND DISMANTLE THREAT ACTORS

The United States will use all instruments of national power to disrupt and dismantle threat actors whose actions threaten our interests. These efforts may integrate diplomatic, information, military (both kinetic and cyber), financial, intelligence, and law enforcement capabilities. Our goal is to make malicious actors incapable of mounting sustained cyber-enabled campaigns that would threaten the national security or public safety of the United States.

Coordinated efforts by Federal and non-Federal entities have proven effective in frustrating the malicious cyber activity of foreign government, criminal, and other threat actors. ...

We will build upon these successes to enable more sustained and effective disruption of adversaries. Our efforts will require greater collaboration by public and private sector partners to improve intelligence sharing, execute disruption campaigns at scale, deny adversaries use of U.S.-based infrastructure, and thwart global ransomware campaigns.
...

https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf

What does that mean in practice?

Edited March 3, 2023 by bernorange

[bernorange 8363]

Quote

The Department of Homeland Security’s Inspector General has released a troubling new report detailing how federal agencies like Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI), and the Secret Service have conducted surveillance using cell-site simulators (CSS) without proper authorization and in violation of the law. Specifically, the office of the Inspector General found that these agencies did not adhere to federal privacy policy governing the use of CSS and failed to obtain special orders required before using these types of surveillance devices.
...

https://www.eff.org/deeplinks/2023/03/report-ice-and-secret-service-conducted-illegal-surveillance-cell-phones

[washparkhorn 9939]

You want to see something scary? Welcome to AI reading your mind. We need guardrails, but the global competing in this area assures the our machine overlords are past the point of conception.