June 2015

European Officials Push Telecom Regulating for Tech

For regulators in Brussels, the divide between European telecommunication companies and American tech companies is fast eroding. Already, Facebook’s online messaging services now compete with -- and in many cases have overtaken -- traditional text messaging offered by mobile operators. Many European carriers provide similar pay-TV products that rival the likes of Netflix and Youtube. And tech and telecom operators are jockeying to offer smartphone services that are driving a rapid expansion of data use, as people across the European Union increasingly surf the web through their mobile devices. Those blurring lines have moved European officials to argue for regulating many tech companies’ under the same strict rules that govern telecom and cable operators, a decision that could have broad implications for the tech companies. “Similar services should be treated in similar ways,” Roberto Viola, a senior official at the European Commission, said at the ETNO-MLex Regulatory Summit, an industry conference in Brussels. “If you ask customers to pay for a service over the Internet, then it’s perfectly normal that regulation should apply.”

Europe’s efforts to extend the region’s telecom regulation to American tech companies are part of a series of reforms introduced in May aimed at energizing the local digital economy. As part of the proposals, which likely will take years to complete, the European Commission will investigate how so-called online platforms, like Uber, the ride-booking service, and Airbnb, the home rental website, use data provided by their users and whether these companies unfairly promote their own services over those of rivals. European officials also will look specifically at how online messaging services like WhatsApp, which is owned by Facebook, are regulated, so that they compete equally with rival services provided by Europe’s traditional carriers. The regulatory push, which is aimed at policing online platforms in a similar way to traditional carriers, has not been welcomed by American tech companies.

Verizon Clinches AOL Acquisition

Verizon Communications said it has closed its proposed $4.4 billion acquisition of AOL, a move that aims to beef up Verizon’s mobile, over-the-top video and advanced advertising strategies. Verizon, which did receive some backlash from consolidation critics over the deal, said AOL CEO Tim Armstrong will continue to lead AOL operations “in an expanded role,” and report to Marni Walden, Verizon’s EVP and president of product innovation and new businesses. Bob Toohey, president of Verizon Digital Media Services, the company’s cloud video and advertising unit, will report to Armstrong.

In AOL, which will operate independently, Verizon will acquire a portfolio of content brands, including The Huffington Post, TechCrunch, Engadget, MAKERS and AOL.com, as well as a menu of over-the-top (OTT) fare targeted to the coveted millennial audience. Via AOL, which acquired Adapt.TV in 2013, Verizon also gets some key programmatic advertising technologies that could play a part in its coming “mobile-first” offering that will include content from partners such as ACC Digital Network, Campus Insiders, CBS Sports, ESPN, 120 Sports and Awesomeness TV.

FCC Announces Update to PSAP Text-to-911 Readiness and Certification Registry

The Public Safety and Homeland Security Bureau of the Federal Communications Commission announces that it is updating the FCC's Public Safety Answering Point (PSAP) Text-to-911 Readiness and Certification Registry listing PSAPs that are ready to receive text-to-911 messages.

This Public Notice provides notice to Commercial Mobile Radio Service providers and other providers of interconnected text messaging services of the effective readiness date of those PSAPs for which the Bureau has received the updated information. Pursuant to the FCC's text-to-911 rules, covered text providers must begin routing 911 text messages to requesting PSAPs within six months of this notice date. Also, the Bureau reminds covered text providers that they should periodically review the text-readiness of PSAPs in their service areas and reach out to these PSAPs as necessary to coordinate implementation of text-to-911 service.

New bill would support innovative Internet pilots for students

New legislation introduced in the US Senate would support innovative methods to give students access to the Internet and digital tools outside of classrooms. The Digital Learning Equity Act of 2015, introduced by Sen Angus King (I-ME) and Sen Shelley Moore Capito (R-WV), would support pilot initiatives that increase student access to digital resources, increase student, parent, and educator engagement, and improve students’ chances to participate in new learning models. It also provides for a national study of data related to the digital divide, including barriers to students’ home Internet access, how educators confront that reality in their classrooms, and how no at-home Internet access can impact student engagement.

The bill would let states and districts pilot new programs that address the problem head-on. Districts or states might collaborate with libraries or other community partners to beef up Internet access outside school for students. Part of the legislation’s inspiration comes from a public library’s portable Wi-Fi initiative that lets students check out mobile Wi-Fi devices to access the Internet outside of school.

Facial recognition technology is spreading, and so are privacy concerns

[Commentary] Being anonymous in public might be a thing of the past. Facial recognition technology is already being deployed to let brick-and-mortar stores scan the face of every shopper, identify returning customers and offer them individualized pricing -- or find "pre-identified shoplifters" and "known litigious individuals." Microsoft has patented a billboard that identifies you as you walk by and serves ads personalized to your purchase history. An app called NameTag contends it can identify people on the street just by looking at them through Google Glass. There are no federal laws that specifically govern the use of facial recognition technology. But both Illinois and Texas have laws against using such technology to identify people without their informed consent.

The Illinois law is facing the most public test to date of what its protections mean for facial recognition technology. A lawsuit filed in Illinois trial court in April alleges Facebook violates the state's Biometric Information Privacy Act by taking users' faceprints "without even informing its users -- let alone obtaining their informed written consent." This suit, Licata vs. Facebook, could reshape Facebook's practices and may even influence the expansion of facial recognition technology. If the court finds that Facebook can be sued for violating the Illinois biometrics law, and that its opt-out consent framework for Tag Suggestions violated the law, it may upend the practices of one of the world's largest Internet companies, one that is possibly the single largest user of commercial facial recognition technology. And if the lawsuit fails for one reason or another, it would emphasize that regulation of facial recognition needs to take place on a federal level if it is to happen at all. Either way, there's a chance this lawsuit will end up shaping the future of facial recognition technology.

[Ben Sobel is a researcher and incoming Google Policy Fellow at the Center on Privacy and Technology at Georgetown Law]

With Supreme Court Hotel Registry Ruling, Google Bags Privacy Win

In a 5-4 ruling, the Supreme Court overturned an ordinance in Los Angeles (CA) permitting police to seize information from hotel registries on demand, sans warrant. Justice Sonia Sotomayor, who wrote the majority opinion, deemed the ordinance unconstitutional and claimed hotel owners should be able to sign off on these searches first. The city’s law, she went on, was written in such a way to extend to any business. That last rationale came with Google’s help. It was the only private company to file an amicus brief in the case. And here’s the relevant part, which gets at Google’s concern: That a policy such as the one in Los Angeles would allow public entities to access its users’ information (Gmail, search history, etc.) without review or Google’s input or approval. "Under the reasoning advanced by petitioner, the government could rely on a combination of the third-party doctrine and the administrative-search doctrine to compel a business -- including, perhaps, an Internet-based service provider -- to collect and retain information from its customers and then produce it without any opportunity for pre-compliance judicial review or notice to the affected customers."

That has happened to Google before. In January, the company said it had fought government requests to surrender data of WikiLeaks members without notifying them. In May, Google released those documents as proof. Then, over the weekend, evidence came out, as reported in The Intercept, that the Department of Justice had sought intel on one WikiLeaks affiliate in particular — prominent activist Jacob Applebaum — and successfully restricted Google from telling him so. These disclosures, like the Supreme Court case, suggest that Google is pouring in legal resources to distance its data collection architecture from the government’s.

Computer system that detected massive government data breach could itself be at ‘high risk,’ audit finds

The computer upgrade that federal officials tout as having detected -- although not prevented -- a massive breach of information on federal employees is itself at high risk of failure, according to a new internal audit. The independent inspector general’s office within the Office of Personnel Management is conducting a thorough review of the upgrade but issued a “flash audit alert” to top agency leaders “to bring to your immediate attention serious concerns we have” that require “immediate action.” “There is a high risk that this project will fail to meet the objectives of providing a secure operating environment for OPM systems and applications,” the alert says. The release of the IG’s audit comes as Congress is set to hold three more hearings the week of June 22 on the issue and amid growing calls for more disclosure and accountability from OPM.

OPM Database Storing 4 Billion Employee Health Records Needs Security Upgrades

About an hour and a half into a combative House hearing on the massive breach of federal personnel and security-clearance files, lawmakers got around to asking officials at the Office of Personnel Management whether the agency also collects federal workers' health data. "No," OPM Director Katherine Archuleta said. The agency only collects information about employees’ selection of insurance providers, she said. But the Office of Personnel Management is preparing to go live with a database of health claims to aid agency planners in conducting cost analyses that will contain just that type of detailed health information on federal workers.

Meanwhile, the OPM Office of the Inspector General, which operates under separate statutory authority from the agency writ large, does, in fact, maintain a massive database of employees’ health information. The OIG’s “data warehouse” of federal employees’ health and prescription drug claims is used by auditors to detect fraud in the Federal Employees Health Benefits Program. It contains 4 billion records, and is a treasure trove of sensitive data, including personally identifiable information and protected health information, such as diagnoses and conditions. And the system needs security upgrades, according to a little-noticed OPM budget document from earlier in 2015. To be clear, officials say employee health information was not compromised in the two recent OPM hacks. The OIG’s database is maintained at OPM headquarters -- not the Interior Department shared data center, where hacked personnel files were stored -- and employs different security measures. But the recent breaches, called the worst exposure of government data in history, have led to scrutiny of other data assets maintained by the agency.

Signs of OPM Hack Turn Up at Another Federal Agency

The National Archives and Records Administration recently detected unauthorized activity on three desktops indicative of the same hack that extracted sensitive details on millions of current and former federal employees, government officials said June 22. The revelation suggests the breadth of one of the most damaging cyberassaults known is wider than officials have disclosed. The National Archives' own intrusion-prevention technology successfully spotted the so-called indicators of compromise during a scan this spring, said a source involved in the investigation, who was not authorized to speak publicly about the incident.

The discovery was made soon after the Department of Homeland Security's US Computer Emergency Readiness Team published signs of the wider attack -- which targeted the Office of Personnel Management -- to look for at agencies, according to NARA. It is unclear when NARA computers were breached. Suspected Chinese-sponsored cyberspies reportedly had been inside OPM's networks for a year before the agency discovered what happened in April. Subsequently, the government uncovered a related attack against OPM that mined biographical information on individuals who have filed background investigation forms to access classified secrets. The National Archives has found no evidence intruders obtained "administrative access," or took control, of systems, but files were found in places they did not belong, the investigator said.

Why the Federal Government Sucks at Cybersecurity

[Commentary] A new report from the software security firm Veracode found that civilian federal agencies -- those largely unconnected to the military or intelligence communities -- rank dead last in fixing security problems in the software they build and buy. That’s particularly relevant given that the massive hacking attack on the US federal government’s Office of Personnel Management has exposed the personal information of at least four million people, and that number is likely to grow as the criminal investigation proceeds and more information comes to light.

The attack on the OPM, likely carried out by a group based in China, was significant for the damage caused, but it’s only the latest in a long string of computer security incidents at federal government agencies, the numbers of which have increased by more than 1,100 percent since 2006. Why aren’t government agencies fixing their flaws? Because no one is requiring them to do so, says Veracode CTO Chris Wysopal. “They don’t fix them because there’s no regulation or compliance rules that require it,” he said. Additionally, government agencies often work with outside contractors to build their software or to deploy commercial software, Wysopal said. Often when security problems are discovered, government contracts don’t specifically require that the contractor fix the problem. Government agencies tend to follow what IT pros call a policy-based approach to computer security, where agencies check off a list of requirements set by lawmakers and regulators that they have to follow. Private companies typically do the same thing, but they also add to their mix a risk-based approach. “With a risk-based approach, you look at what you have that attackers might want and what’s in place to stop them,” Wysopal said. “Both approaches are valid, but everyone should do both.”

Benton

Search