Daily Digest 3/26/2018 (Larry Grossman)

It was October 2010, and two members of Congress were furious with Facebook. In the eyes of then-Rep. Edward J. Markey and Rep. Joe Barton, the company had failed its users in allowing app developers to take personal data from them and their friends — and transmit it to marketers. Fretting that those “series of breaches of consumer privacy” had affected millions on the social site, the bipartisan duo then sought to issue Facebook a subtle warning, touting the “comprehensive privacy legislation [that] is currently pending” on Capitol Hill. Such legislation never passed. Almost eight years later, though, Facebook is once again under fire for a privacy mishap involving millions of users’ personal details landing in the hands of a third party, Cambridge Analytica, a data analysis firm that worked for the Trump campaign. And some members of Congress are once again threatening to act. “I think that this privacy spill is politically the equivalent of the oil spill in the Gulf of Mexico,” said Sen Markey (D-MA). “Because it involves our very democracy, I think [it] is going to draw more attention of the American public to this issue.”

In the twenty-first century, it is impossible to meaningfully participate in society without sharing our personal information with third parties. Those third parties should have commensurate obligations to protect that personal information. Unfortunately, it has become increasingly clear that too many third parties are failing to live up to this responsibility. It is therefore incumbent on Congress to step in to protect consumers.

1. Notice and Consent: consumers should have a right to know a) what information is being collected and retained about them; b) how long that information is being retained; c) for what purposes that information is being retained; d) whether the retained information is identifiable or anonymized; e) whether and how that information is being used; f) with whom that information is being shared; g) for what purposes that information is being shared; and h) under what rubric that information is being shared (for free, in exchange for compensation, subject to a probable cause warrant, etc.). 
2. Security Standards:  Third parties that are stewards of our personal information should be expected to adhere to the latest, state-of-the art security standards.
3. Meaningful Recourse: When there is unauthorized access to personal information, individuals must be made whole to the greatest extent possible.

The political action committee founded by John R. Bolton, President Trump’s incoming national security adviser, was one of the earliest customers of Cambridge Analytica, which it hired specifically to develop psychological profiles of voters with data harvested from tens of millions of Facebook profiles, according to former Cambridge employees and company documents. Bolton’s political committee, known as The John Bolton Super PAC, first hired Cambridge in August 2014, months after the political data firm was founded and while it was still harvesting the Facebook data. In the two years that followed, Bolton’s super PAC spent nearly $1.2 million primarily for “survey research,” which is a term that campaigns use for polling, according to campaign finance records. But the contract between the political action committee and Cambridge offers more detail on just what Bolton was buying. The contract broadly describes the services to be delivered by Cambridge as “behavioral microtargeting with psychographic messaging.” Using the psychographic models, Cambridge helped design concepts for advertisements for candidates supported by Bolton’s PAC, including the 2014 campaign of Thom Tillis, the Republican senator from North Carolina, according to Wylie and another former employee, who spoke on the condition of anonymity to avoid being dragged into the investigations that now appear to be engulfing Cambridge.

The Trump administration announced sanctions and criminal indictments against an Iranian hacker network it said was involved in “one of the largest state-sponsored hacking campaigns” ever prosecuted by the United States, targeting hundreds of US and foreign universities, as well as dozens of US companies and government agencies, and the United Nations. None of the alleged hackers were direct employees of the Iranian government, but all worked at the behest of the Iranian Revolutionary Guard Corps, officials said. While not the first such punishments imposed on Iran for malicious cyber acts, the new measures address more extensive Iranian efforts than previously alleged. Nine of 10 named individuals were connected to the Mabna Institute, a Shiraz-based tech firm that the Justice Department alleged hacks on behalf of Iranian universities and the IRGC. The institute conducted “massive, coordinated intrusions” into the computer systems of at least 144 U.S. universities and 176 foreign universities in 21 countries, including Britain and Canada, officials said. They stole more than 31 terabytes of data and intellectual property — the rough equivalent of three Libraries of Congress — from their victims, prosecutors alleged. Much of it ended up in the hands of the IRGC, which has frequently been accused of stealing information to further its own research and development of weaponry. The Corps is the division of Iran’s security forces charged with overseeing Iranian proxy forces abroad and is under the direct control of the country’s religious leaders.

Apparently, the Federal Communications Commission is considering a new rule to further curb the US business of Huawei Technologies, making it harder for small and rural carriers to purchase gear from Chinese telecom-equipment makers. Such a move would further escalate the government’s recent campaign against the cellular-technology giant and its Chinese peers over what the Trump administration says are national-security concerns. AT&T and other big carriers have long avoided Huawei, the world’s biggest wireless-equipment manufacturer by sales. A 2012 Congressional report labeled it a national-security threat, warning Beijing could use its equipment for state-sponsored spying or cyberattacks.  

Companies like OneWeb and Elon Musk’s Starlink have been moving forward on ambitious plans to make internet available to every person on earth, which is a noble goal considering an estimated 4.3 billion people don’t have internet access. The problem is that there’s a natural incentive for a private satellite company to engage in “spectrum warehousing,” or highballing the amount of satellites it asks the government to allow it to shoot up. The company’s request may get approved on paper, but the companies may drag their feet sending up those satellites, or never send them up at all. Reserving the space then becomes a path to monopoly: If one company has permission to use a specific area, and a specific spectrum range, it prevents competition and ultimately allows companies to jack up the prices on the spectrum they control. This means companies with lots of resources have the potential to take advantage of people for whom internet access, an increasingly necessary resource in the developing world, is not a given.