More on Snowden

There has been another Guardian exclusive – online access to Snowden Q&A that is worth a look if you’re just a little intrigued by all the excitement. Make yourself a cup of coffee first though 😉

What seems to be clear is that when Snowden says NSA has direct access to the 9 main Internet services, he means direct access. When questioned about denials made by Google, Facebook, Apple, etc., his response was that they had no choice. It seems they have some sort of ‘gagging’ order and break the law by admitting to these top-secret operations.

MSIPR, SIPRM, PIRMS, IPMSR? No it’s PRISM!

Yes so in whatever form PRISM does exist. I talked about it… well more rolled over this in previous posts. Now everything that you may want to know about PRISM to date, that is by 12 June can be found here.

Now there are two parts here, or maybe three.

1) collection of communications that happens to be passing over the wires
2) collection of social, other online activities of US citizens
3) collection of a) communications, b) social, other online activities; of non-US citizens.

Now PRISM is about (2) and (3b). PRISM is a system the NSA uses to gain access to the private communications of users of nine popular Internet services including Google, Facebook and Apple. It seems to be that an official request for information of a particular individual can be made to any of these services, and they will comply if the request is legally valid. These Internet service deny strongly that NSA has direct access to their servers.

So apparently NSA does not have direct access to the 9 most popular Internet Services, but what is the breath of their power to collect data on US-citizens?

Well the FISA Amendments Act (Section 702) does not require the government to show probable cause to believe that the target of surveillance has committed a crime. This is only for non-US citizens. Instead of showing probable cause to a judge, Section 702 of FISA allows senior Obama administration officials to “authorize” the “targeting of persons reasonably believed to be located outside the United States.” The surveillance may not “intentionally target” an American, but the NSA can obtain the private communications of Americans as part of a request that officially “targets” a foreigner. There is some use of the Patriots Act for this. I am not sure how the FISA Section 702 and the Patriots Act overlap though.

Ha! So if you as a US-citizen are communicating with an individual that is outside of the US and deemed as a threat to national security, your data is being collected. You could be a supporter of Greenpeace for example, they were targeted for surveillance in the past.

So what is my take on PRISM. It seems perfectly reasonable that in the name of national security requests for data on individuals can be collected by government intelligence. Same as officials upholding the law would request for a search warrant. However, PRISM should not be secret. That this is happening should be transparent to all US citizens and non-citizens. Why keep a secret? The supermarkets are pretty transparent about collecting our personal buying habits, maybe the package the justification in fancy packaging, but the reason is clear, to make money. So why does the government have to go around pretending still that it does not do these things? Has it not yet realized that the Cold War is over, and has been for quite some years now?

Dilemmas concerning privacy

There’s a really fun article written by Daniel Sandström in the Svd Culture section (16 June). SvD is one of the two main Swedish national newspapers. It is in main about the dilemmas we face as 1) a citizen and, 2) consumer. It is about how our selfish choices made in the guise of (2) are in fact contrary to what we demand as (1).

For you non-Swedish speakers – The first paragraph talks about how Amazon dealt with the news that they had illegally allowed an e-book to be on their site. They removed it from all devices. It is quite funny because it was George Orwell’s 1984 😀

He discusses briefly PRISM, this I mention at the end of my previous post. This is an agreement between the main cloud, social networking spaces on logging/tracking. Main companies included are: Google, Facebook, Apple….. yep, all those places you share your personal information, including who is your family, who is your close friends vs. FB friends, maybe who you are drinking, sleeping with… oh my what a gold mine for our governments! And we share this information with pleasure. It really is irrelevant on your privacy settings here because the US government via the Patriot Act can request this personal information about you. He doesn’t mention this last part though.

Daniel talks about the choices he has made, i.e. he purchased a digital reader, after he forgot the ethical implications of what Amazon had done a couple of years ago. He states he placed his personal comfort over his principles.

He then continues to discuss how we as citizens want the cheapest food and share our buying habits for this privilege, but then complain that the government is tracking our communications! He says how we want cheap clothes for our children, but then protest at the atrocities going on in the sweat houses in India, etc., to produce these products. We still continue to purchase cheap clothes

Daniel’s leaving point is potent and true. He says that for himself he needs to think more seriously if he really will live for his comfort, or live as he has learnt, i.e. by principles. Clearly Snowden’s name popped up in this article, as he lived as a citizen and for freedom of the citizen.

Google’s ‘Policy Violation Checker’

OMG, I picked this article up on Janet Steinman’s feed in LinkedIn. So what Google are doing is patenting a technology that basically detects written policy violations, e.g. in email messages, even before it is completed. I am wondering it it could be likened to the Autocomplete function.

The article is stating that it will be like having a ‘big brother’ peeking over your shoulder when you write. But I am thinking that if it is similar to the ‘autocomplete’ or ‘spellcheck’ function, maybe it is just another useful function and maybe this article is making more of this than it really is?

However if an organisation was to implement this, and they controlled the ‘policy violation checker’ from a central place, would this mean they could see if a policy had been violated, could they control what employees write in the workplace context. Is this a bad thing? I’m still scratching my head over this one….

Cloud and conflicting privacy laws

One of the biggest dilemmas with cloud services is that in theory it shouldn’t matter where your data is stored in the public cloud, just that it is secured appropriately, and only you get appropriate access and nobody else gets inappropriate access 😉

But it’s much more complicated. Every country has its own laws about the transparency of data stored and accessibility from nosing government authorities. The real problems occur when there is a conflict of privacy laws between different countries. So you have personal data stored in a Google public cloud, your data could be stored physically anywhere in the world. And the fact that Google is a US company means requirement to comply with US law (e.g. USA Patriot Act) for the organisation worldwide, not forgetting the regional laws where the data is physically stored. This conflicts with EU privacy law whereby the rights of the data subject are preserved.

Google have been quoted as follows “As a law abiding company, we comply with valid legal process, and that – as for any US based company – means the data stored outside of the U.S. may be subject to lawful access by the U.S. government.” Taken from Softpedia.

This could be an interesting time for organisations to set-up clouds but only in a single country in an organisation that is registered in the hosting country. Otherwise, can you really trust the data-holding authority to protect your rights as an EU citizen for example? I know I can’t!

Bloggers used in smear campaign

This is a really interesting development, although not really so surprising in the arena of reputations and using popular bloggers for smear campaigns. Apparently Facebook hired a PR company to further damage the reputation of Google. The PR company contacted a well-known blogger to ask that he take a part in this. He refused and instead published the emails with the request.

However the power of the blogging communities are being used here to damage the reputation of an organisation. I guess this is not the first time this has been done, and it certainly won’t be the last. They are used for example to talk about their favorite products, i.e. they are advocates for a brand. Although this is the first time that I have seen such a public showing of this behaviour.

Your right to opt-out of Google’s Street View service

I love what is going on in Germany during a few months now, in that almost 250,000 Germans have told Google to blur pictures of their homes on the Street View service. Which is quite right. The EU directive on data privacy gives the data subject the right to consent to any personal information being stored. I wonder why it is only happening in Germany and not elsewhere in the EU, after all it is our right as data subjects.

Inspiration for the mobile workforce today, for the future

This is where I see the future in mobile computing. Apple’s iPad that accommodates the mobile workforce, and the apps application that makes it easy to download company approved apps onto your device, and this combined with the Google Chrome approach, everything Internet-based in that cloud.

Take a look at Wired article by Steven Levy on the release of the iPad, and the following promotional video. Be, and feel inspired 🙂

[youtube=http://www.youtube.com/watch?v=LKNNDeLNso8&hl=en_US&fs=1&border=1]

Privacy commissioners vs. Google

Oh dear, Google is in trouble…. they have been -surprise, surprise- criticized by privacy commissioners around the world on their privacy, or lack of privacy practices 😉

Read more at The New York Times. btw. I need to thank Jack for his tweet on this 🙂

Google’s privacy conviction in Italy

I think that this is a bit strong. 3 of Google execs charged concerning the content on their site in Italy even though this content was removed within 24 hours of notification. This brings to mind the question of how third-party providers can be expected to take responsibility for content uploaded by end-users… I believe that so long as the provider acts responsibilly by removing content as soon as notified, that this is the best they can do without creating some manual approval process. After all this content was the bullying of a disabled boy, which is really bad, but how do you identify this as inappropriate content using some sort of filtering technology, just not possible, it is not like pornographic material. I guess if bad language is used that this may work?