Cell carriers are selling your private location data

This article got me thinking about my standing policy of always opt out of every option available on privacy agreements.

https://www.zdnet.com/article/us-cell-carriers-selling-access-to-real-time-location-data/

Fortunately, living in a California, I have that option and the additional option that I must be notified annually about my rights to opt out of company's selling my private data. Of course, there are so many of these agreements, I can never remember if I had accidentally forgotten to send one in, so I make sure that whenever I get one of the privacy notices that I check all the opt out boxes and mail it back.

I know that some people would say "Who cares if some company knows where I go? It's not like I work on a secret military base or for the CIA or something." Well, that's just not the point.

One of the 'obscure' things that I like to point out when people ask me about information security is that in the information age data is money. Pure and simple, it's just that easy. I refuse to simply give away my information for free so that someone else can go and sell it for their own profit, and give me nothing in exchange.  I know that in the marketing departments of these organizations, someone, somewhere says "Look, people are stupid. They'll just give us this info for free and we can make lots of money off of that!"

Two really big things piss me off about that sentiment. One, their assuming that I'm stupid and am incapable of understanding the question if I were openly asked it. Two, when they assume that I wish to automatically opt into giving away my money (private information) for free and hide that fact in some ridiculously long privacy agreement that includes every legal term in the language and stealthily bury my implicit agreement somewhere deep in a document the length of a bible of legal-ese.

The reason this "P.T. Barnum - there's a sucker born every minute" business model works in the US is our nationwide defacto information privacy policy of everyone must opt out or you are automatically assumed to have opted in. In the European Union (EU), they have a different model; citizens are assumed to have automatically opted out, unless they specifically indicate that they wish to opt in. This is the general basis of the whole GDPR thing that everyone is fussing over here in the US when doing business with citizens in the EU; and for that matter 'doing business' can mean that an EU citizen simply visits your web site and reads your blog and doesn't transact any business other than looking at your information.

What happens when every citizen is automatically assumed to wish to opt into the broadest possible interpretation of information sharing is a basic erosion of our personal freedoms. Specifically mentioned in the article is that law enforcement agencies are claiming that they are not performing warrant-less searches because they are simply looking into the data that is provided by a third party and it was that third party that performed the search and the subject of that search specifically opted in to it.

First...really? Law enforcement performing a real time search of my location via a third party application somehow isn't an unconstitutional warrant-less search? So by that logic, if a bank robber steals from a bank, and I mug him as he is leaving the bank with all the stolen money, I can keep the money and have committed no crime, right? Somehow I feel the bank wouldn't see it that way.

Second, I don't recall opting into allowing warrant-less searches of my personal data, and had I been explicitly made aware that I might possibly be doing so, I would never have allowed it. [*update - A hacker strikes back and shows law enforcement weak passwords, that enable would enable others unrestricted access to this resource and the ability to track virtually any cell phone in the US and Canada in real time.]

The whole issue with Facebook and Cambridge Analytica follows this general pattern. Someone that knows me in some capacity opts into a survey or Facebook app and shares their information...fine, it's their right to do so. However, when Facebook and Cambridge Analytica assume that because that person has mentioned me in a post somewhere on their page that I too wish to be opted into their information harvesting is absolutely wrong. I don't know the specific legal term for the concept involved here, but I know that my rights can't be waived without my specific permission. I really hope that the 'shadow profiles' that these companies keep and have come out as a part of this particular controversy are given a thorough consideration by our legislature and rapidly brought under some legal framework. One of the biggest problems with these shadow profiles is that if I don't know such a shadow profile exists and have no direct business relationship with the organization and never been presented with a privacy policy to agree or disagree with; I have no knowledge or warning that I should request to opt out.

So the lesson today is this...when it comes to privacy agreements, always opt out. [**even though my standing preferences with my cell carrier were saved as opt out of everything, they have added a new option for 'third party sharing.' I had to go in and set this to off or opt out for each phone number on my account because they assumed that I wished to opt in when they added this new choice.] Ultimately, you have no idea what future use of your data someone might come up that may not exist today for them to warn you about even if you could comprehend the tiny printed legal-ese of most privacy agreements. Since they are not willing to be clear about what they may do with your data, the safest policy is to say no; you can't have it, you can't share it, and you certainly can't sell it without paying me for it.

Implications of Quantum Capabilities, TAO, and other nasty tricks

From the just in case you weren't paying attention file...I know I haven't been keeping up on my reading for quite some time.

Original source article here.

A comprehensive internal presentation titled "QUANTUM CAPABILITIES," which SPIEGEL has viewed, lists virtually every popular Internet service provider as a target, including Facebook, Yahoo, Twitter and YouTube. "NSA QUANTUM has the greatest success against Yahoo, Facebook and static IP addresses," it states. The presentation also notes that the NSA has been unable to employ this method to target users of Google services. Apparently, that can only be done by Britain's GCHQ intelligence service, which has acquired QUANTUM tools from the NSA.

 ...and, of course, Bruce Schneier clued me in that I missed it.  And because the article that led me to that one is hugely important too...here it is.

Now, yesterday I wrote about why 'they' do it, with 'they' being a reference to certain group of bad guys.  The question today is...well, not why the NSA does it, we know the answer there, but rather how certain are you that they (the NSA) are only doing this stuff to the bad guys?  Because, to be honest, a lot of the monitoring tools sound like there are targeted at normal citizens.  Or at least the widely used internet services that vast segments of the internet citizenry frequent.  The list of sites and the tools to exploit them are not only the domain of bad guys, but regular people all over the world.  While I'm sure that people with bad intentions use those sites too, I would expect a bit more cloak a dagger than just hiding in all the noise in plain sight (or site?) on Facebook, Yahoo, Twitter and YouTube.  However, I suppose, it is easier to poison the waterhole rather than track the 'critters' as they move through the woods.

I think that one of the most worrying aspects of this type of information is that when my peers and colleagues talk about this vulnerability or that vulnerability, that there exists a whole host of exploits and things that we DON'T know about.  In fact, even the vendors don't know about; as opposed to quietly know about and are working on a fix, but haven't mentioned publicly yet.  It is not just the governments that are keeping these things a secret, but to a certainty the bad guys have their own bag of tricks they are not keen to share (but are very willing to sell).

Other people making choices for me...

Now this list of compromises has caused me to think and notice on Facebook that videos that people share of cute and funny things have started playing automatically.  I used to have to click on something to make it play, which I was happy with.  I really hate the fact that someone else at some point in time decided that I automatically want to play and see every video of a cat or dog doing something odd, strange, cute, or funny.  I did learn that you can turn this functionality off, by the way.  Again, the assumption that you want to opt-in unless you specifically opt-out is maddening.

There can be a myriad of reasons why I may not want to drink at the massive bandwidth firehose that characterizes many popular sites these days; first among them is that I don't trust every bit of eye-candy left out there.  This list of government tools and capabilities is foremost among them.  An old trick by bad guys is to leave something out in the open that lures you to interact with it and suddenly the trap is sprung.  Greek story of the Trojan horse, anyone?  Variations of this trick come in all forms.  Think vendor conferences and a vendor booth with fish bowl of free USB memory sticks...complete with a chunk of stealth malware to infect your system when you plug it in.  Old trick, by today's timeline measured in internet speed, almost certainly a derivation of Ludicrous Speed.

Internet warning labels anyone?

I really like the trend in various state's legislation that requires the caloric content of restaurant menu items to be posted with the item itself.  It allows me to make a choice.  Now, obviously, like most people, I may choose to have that high calorie dessert once in a while, but at least I know the implications of my choice.

We really need some legislation to require the choices be left to the individual when it comes to internet content...maybe some warning language like on cigarette cartons.  "This link cannot be guaranteed to be safe.  Clicking it may have dire consequences, including allowing your government or a foreign government or an evil hacker organization to follow your every move."  I would have no problem with any elective setting to turn off such warnings and allow all content to flow automatically based upon user choices.  User choice being a key concept here.

Of course, all these government tools and compromises could be a major part of the reason of why we don't have such legislation...heck, they could even rig the polls that might sample public opinion as to whether we feel it would be a good idea or not.

The things we don't intend to share

Well, it's been quite a while since I have felt inspired to write, however, my local NPR station got me thinking once again.

I've heard NPR call them 'driveway moments' when you are listening to a story and find yourself no longer driving and parked in your driveway with the engine running and still listening because the story is so good.

The story began with a reference to Edward Snowden, which immediately perked my ears up, but it was just an intro line.  I have heard the teasers for this story for a bit now and was interested to hear the results.  Very interesting to say the least.  Here's the story about the things that can be learned from commercial software monitoring of your technology and the data that it sends and receives.  Now, this is distinctly different from what three letter agencies (TLAs) have at their disposal, so keeping that in mind is important when considering the revelations of this story.

As of this writing, the NPR web site shows two parts to the story, but I believe from my listening to the radio that there may be more coming.

Now, I know this subject matter very well, however, it still does occasionally remind me of how much I ignore because of simple convenience, like most other people do.  This, in and of itself, is an interesting aspect of this story that really isn't called out.  That issue is how much of our privacy we give up as a matter of convenience.  This is not a characteristic of European privacy law, but that is an article for another day.  At any rate, the reporter commented on his surprise on this issue during the initial set up of the experiment and the confirmation that everything was working and some back and forth questions as to whether or not he was actively using his cell phone.  He was not, but the monitoring team was seeing substantial traffic from his phone to the internet while it was 'quietly' sitting on his desk and in lock mode.

One of the other things that this story highlights well is the 'side channel way' that adversaries can get your data.  Rarely does a compromise result from a direct frontal assault.  The story mentions that every system has old programs and it can be those programs that leak data.  Add a few more bits and pieces of micro-facts from other programs and you have a significant piece of data or a coherent piece of information or even a story about you and your information.  This results from a couple of different illustrative points from the story.  The first is the way that the 'Steve's iPhone' in the story can lead from just any Steve in the country or world, to a specific Steve at NPR in Menlo park.  Simple google search after that and you have your specific Steve Henn.  The other illustrative point is what I call the famous last words compromise...'well, I didn't expect them to do that!'  This was illustrated by the 'adversaries' in this instance using several other side channels of information that are older programs that are less likely to be considered for patching or even running in a stable fashion and not needing patching...yet leaking data and not secure.

So what is the take away?  Well, certainly we need some monumental legislative change in this country for privacy.  We need to change our legal privacy expectations from 'opt-out' to 'opt-in.'  This means that any provider of hardware or software would only be allowed to your personal information if you specifically grant them access (opt-in).  This is the basic model that European privacy law follows.  By contrast, our legislative structure allows organizations to collect our data with minimal notification in legalese, rather than plain and easy to understand language, UNLESS we specifically say they cannot (opt-out).  That simple fact alone is the foundation of much of what is the basis of our continuing software problems that allow adversaries to perpetrate their craft.

The second take away is a bit more ambitious and far reaching and could have serious economic impacts.  Strap yourself into your chair for this one....  Software and hardware manufacturers need to be held criminally and fiscally responsible for security flaws.  I'll let that thought sit with you for a moment, because it is a big one.

I'll wait.  Go ahead and ponder it.

Yes, that does mean...

Yeah, and that too...

But it also means that security would be mandated by design and become an integral part of the economic product design decisions that every maker of software and hardware goes through at some level.  When security becomes a required feature of our computer landscape and tantamount to holding car makers responsible for the proper functioning of required safety features like seat belts and air bags, you will see some effective security happen.

Until then...we will continue to have 'well, I didn't expect them to do THAT!?!?"