weaken Privacy Shield?
Fear not, for Privacy Shield is about shielding US corps from having to give a hoot about the privacy of us EU plebs.
238 posts • joined 10 May 2011
Fear not, for Privacy Shield is about shielding US corps from having to give a hoot about the privacy of us EU plebs.
>I'm curious to know how this was argued.
"Now Mr Congressman, about that campaign contribution ..."
I'll have to object to the idea (a tautology, really) that being a spy organization legitimizes spying: in civilized countries this is illegal without a warrant (for a good reason). Moreover, a spy organization operating outside its native country / jurisdiction cannot legitimately have such a warrant.
I don't think any app is safe against local root access, never mind an exploit that allows running code in kernel mode i.e. unfettered access to the hardware: with these the attacker has access to everything the user has (and more).
The only place that mentions "cookie" in 2009/136/EC* is (66):
"Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities."
From this I'd gather that cookies needed for shopping carts and such are ok, as are session cookies in general as they are not (permanently) stored on user equipment. "Analytics cookies", if they mean 3rd party tracking cookies, would seem to fall foul of this as they are stored on user equipment and are a privacy menace amounting to spyware. If anything, the latter should be more clearly and categorically banned (at least without explicit consent and a right to refuse without affecting the service).
Unless they have radically changed their ways recently Apple's claimed "26% tax rate on its worldwide earnings" doesn't seem credible or at least it is very much at odds with the findings of the 2013 US Senate investigation which found that Apple had managed to arrange to be tax resident nowhere for its earnings outside the US.
@Steve Todd: Well, I'd be delighted to be wrong about this if it means that things are better documented or at least better known by now (or always were). Last time what information was around (using an hour or three to look for it with the benefit of a background as a seasoned embedded systems SW engineer) left me with the above impression (admittedly with some of my own speculation having most likely blurred to the info by now). I wouldn't mind seeing a quote from the above link attesting to the secure enclave's nature as a physically separate, tamperproof* subsystem, in particular it having its own persistent, but mutable storage, physically separate from the general purpose flash (without which it is still vulnerable to this sort of attack); this is the main point where I had to rely on speculation (i.e. Apple very likely minding the BOM / extra size / complexity from an extra chip / ... too much to implement a feature the finer points of which the general public would be unlikely to appreciate).
* one aspect of this would be whether the secure enclave's firmware is immutable (failing which makes the kind of hack FBI was demanding of Apple possible)
Um ... as I seem to recall (from the time this was last an issue), the A6 already has the arrangement where a 256-bit constant is baked in the SoC only wired to the internal AES circuits (i.e. no direct software access). This means that cloning the flash and running the firmware in a VM won't work, but cloning the flash and running that with the actual hardware does (assuming that the only mutable storage in the device is the flash): this way at least the retry counter can be defeated by restoring the flash contents.
Unlike the A6, the A7 (and later) has the 'secure enclave'. However, rather than a physically separate processor with a dedicated mutable storage this appears* to be a virtual one sharing the system's flash chips as its only mutable storage. This is primarily geared at keeping someone with remote access (say, an exploit delivered via browser) at bay rather than someone with physical access (i.e. it keeps the iOS user and even kernel space isolated from the key storage, which is a worthy thing to have, of course). It seems Apple has not actually managed the latter; this would take your assumed separate tamperproof security processor with its dedicated mutable storage to keep the keys. This - afaik - Apple don't currently have. Hence, my impression is that there is no fundamental reason the technique (i.e. using a cloned flash with the original HW) wouldn't work on a iPhone 6 (or later).
* Apple seems to rely on obscurity for security here, afaik this is not properly (that is, publicly) documented
I wonder if Apple's lawyers and accountants knew full well that this could happen, but went ahead anyway: it seemed likely to work and the worst that could happen was that they'd have to pay the tax they owed in the first place.
The Commission needs to start somewhere. Actually it started with Amazon, BASF, Fiat and Starbucks. I trust Google. Microsoft, ... will be dealt with as well.
There should be none, really. Instead, corporations pay tax on their profits at the non-negotiable corporate tax rate, same for any and all, where the bookkeeping rules for calculating the profit are likewise non-negotiable, same for any and all. As far as I can see this is what EU Commission is after here so that competition is not distorted due to company specific deals amounting to state aid.
What I'd recall was that von Neumann got involved in the US war time computer programs (most importantly EDVAC as far as the eponymous computer architecture is considered) and put together an excellent memo of what he learned as a result. As the memo got somewhat wide distribution despite being about a secret wartime program and was about the only source of such quality right after the war, von Neumann got pretty much all the credit, much of which should have gone to John Mauchly and J. Presper Eckert, at least. (Actually, for a long time, the Americans got all the credit, despite Konrad Zuse's earlier work and that in the UK on the Colossus. Sadly, these are still rather poorly known.)
Humbug. US corps, morelike, from having to give a hoot of the same.
It seems strange that a Belgian court would not have jurisdiction of what physically happens in Belgium: if the user / browser / computer (or other device) is in Belgium the hard disk (flash chip, ...) on which the cookie is written is also in Belgium.
re: "Modern data protection legislation which assumes that metadata is anonymous would need to be rewritten."
Re-writing would be ideal, of course. Then again what there is in the EU already covers this if interpreted with the law's purpose (privacy, self-determination) in mind. In this sense the the Schrems decision is very encouraging: the ECJ actually considers privacy and data protection fundamental rights to be protected as such.
>This goes against the entire reason Android was created. ...
Probably. Google bought Android Inc. in 2005, though.
While I wouldn't (at all) mind the wall around Apple's walled garden to suffer a fate akin to the structure that once circled West Berlin there is a crucial difference between Google and Apple: Google has a dominant market position in the EU (with Android, search, ...) while Apple doesn't (of course, Apple has monopolies within its own ecosystem, but then that isn't the dominant one within the general market(s), so, while I wish this could be acted upon it might not be possible under EU law ?).
... because GMS is. Most importantly Google's stranglehold is cemented by GooglePlay, which at this points enjoys an unsurmountable advantage due to network effect*. (Not that coming up with the other components (browser, maps, ...) would be trivial, never mind something phone manufacturers on razor thin margins were likely to pull off or even try.)
* i.e. the value of a product or service to an user increases as the number of users increase, which in this case happens because of the feedback loop of: more GooglePlay users -> more developers using GooglePlay (exclusively) -> more GooglePlay users -> ...
Indeed. Like its predecessor "Privacy Shield" simply amounts to US firms being exempt from EU data protection. This is plain unacceptable as data protection is a fundamental right. Also, being exempt gives US firms a rather unfair competitive advantage.
Quite. The US to needs to adopt proper data protection legislation like just about any other advanced country. In the meantime I suppose the only realistic solution is to keep EU citizens' data out of the US.
"It is vital that people should realise Google's potential (or actual) power." Quite. I don't think Google is actually under an obligation to be evenhanded and changing this would require something quite drastic. One such thing could be having the only permissible business model for search to be fully paid by its end users by micropayments, the idea being that a straightforward buyer-seller market* with competing vendors would keep search providers honest.
* instead of Google's constellation of interlocking, cross-subsidized markets amounting to the mother of all multi-sided markets (where a viable competitor in the combined market ought somehow to scale multiple barriers of entry at once)
What I find puzzling is that substantial amounts of money can be stolen with fraudulent bank transfers. Or not that so much, actually, but that it can remain missing with the perps uncaught.
>Some might argue...
There is that. At the same time ads are commercial propaganda (i.e. designed not to inform, but to manipulate). At any rate there is a better way on-line: search paid by its users (with, say, micropayments).
>"Google-dominated ad market"
DoubleClick's (=Google) ad servers market share of 69 % * seems dominant to me; this seems the most relevant single figure to the freedom of speech -angle mentioned above - maybe along with a global search market share of 71 % / 95 % (desktop / mobile) **.
* https://www.datanyze.com/market-share/ad-servers (as of 26MAY2016)
** https://www.netmarketshare.com/search-engine-market-share.aspx?qprid=4&qpcustomd=0 / https://www.netmarketshare.com/search-engine-market-share.aspx?qprid=4&qpcustomd=1 (April 2016)
Micropayments or some other scheme amounting roughly to what sites get from adverts would be vastly preferable for a number of reasons:
- the current ad business model is a privacy disaster (for a typical user, at least)
- ads are commercial propaganda designed to manipulate and mislead; they undermine the key premise of an efficient market economy i.e. that of transactions between well-informed parties
- the Google-dominated ad market is a market failure / disaster in its in its own right: this is essentially not a market, but a set of interlocking multi-sided markets (search, Android, Google Analytics, Google Maps, ... and the ad distribution itself) where even some of the component markets are practically uncontestable monopolies due to the network effect
- a single company's de facto control of funding for news and other content is a freedom of speech disaster waiting to happen
- ad funded is not really free: the cost is added to the price of products and services; content providers could actually be paid somewhat more if the admen in the middle were cut out
> ... it does appear to be legal.
Presumably the French authorities disagree (hence the raid at dawn).
I quite agree, although instead of mere barriers I would insist on insurmountable bulwarks against any commercial use of personal information* without freely given, informed consent, revocable at any time; business models must be compatible with data protection (i.e. privacy), not the other way around.
* any data about a natural person, unless it is strictly impossible ever, under any circumstances for the holder of the data or a third party to identify the person to whom the data is related
While this is a worthy pursuit in its own right - Google has a dominant market position* which it is busy abusing - the really big deal is Google's business model of, essentially, privacy violation for profit on massive, unprecedented scale. For the latter I wouldn't, at all, mind seeing them driven out of the EU (if not existence) by humongous fines (or whatever means, really)**. It is worth noting that the issues are intertwined: ignoring EU privacy / data protection law has given Google a substantial and rather unfair competitive advantage to EU-based outfits having to abide by the same.
* not only with search, but with Android and web advertising, at least
** sadly, the likely outcome is that current arrogance and foot-dragging is replaced with enthusiastic bootlicking once it dawns to Google that serious monies are at stake and with this they emerge relatively unscathed, just a couple of $ billion poorer
From a privacy point of view the idea of using national id cards for logging on to the likes of Google (=Youtube) or Facebook is remarkably clueless. Instead there ought to be an explicit ban against letting them anywhere near the real identity of their users, or, actually, any information which could possibly be used to deduce the same by them or a third party (possibly with a narrow exception to enable investigation of serious crime by allowing IPs to be kept for a limited time for that sole purpose, only to be disclosed by a court order).
>Sell them all naked, and make a pile of OS disks available.
Or maybe have Windows pre-installed, but have it ask for an activation code on the first run that'd be on a separate scratch card or somesuch, which could be left at the store for a refund in the amount the OEM pays Microsoft. (I don't see any compelling reason to keep OEM prices secret, on the contrary, requiring all Microsoft-OEM contracts to be public in their entirety would help to keep Microsoft - a de facto monopolist - (a bit more) honest and hence be in the public interest (in particular if the price of Win 10 is supposed to be zero)).
> ... ALL information ...
Indeed. While in the US the concern may be only PII in the sense of information sufficient in itself to identify a person (such as name, phone number, ...), the EU data protection regime deals with any and all information about a person even when that information doesn't directly identify a particular person. In practice I'd think it is enough if a such information could be tied to a person by a third party for it to become 'personal information', the collection, distribution or even 'processing' in the most general sense of which is subject to restrictions, a key one among them being that this requires consent of the person about whom the the information is. Hence, e.g. collecting IP addresses so that they can associated with other information such as pages visited is verboten - or at least this is the German data protection authority's stance (with which I quite agree).
The real problem is that the US (govt and companies) ought to take the issue - right to privacy in general and its modern aspect data protection in particular - seriously, but obviously they don't; ultimately the solution is for the US to adopt proper data protection legislation like just about any other advanced country, for US companies operating in the EU the solution is simply making a sincere effort to abide by the law there.
>does Google enforce this in some way?
The beauty of it (from Google's point of view) is that it doesn't need to: at this point the network effect* alone results in a practically unsurmountable competitive disadvantage for other app stores.
* i.e. the value of a product or service (to a user) gets higher the more other users there are (which happens because of the self-amplifying cycle of: more Google Play end users -> more apps distributed via Google Play -> more Google Play end users -> ... )
>The West could make its own alternatives...
In theory yes, but in practice not really. The linchpin is the app store, which affords Google a stranglehold on the mobile market akin to what Microsoft has with PCs*. This is because of the network effect, where the value of a product or service is dependent on the number of others using it; in practice this means that once a player in a market gains some advantage to competition this will snowball into a self-amplifying cycle of increasing advantage resulting in a (de facto) monopoly, which also tends to be persistent because of the massive advantage from the network effect is also results in a practically insurmountable barrier of entry.
* the more people use Windows software [Google Play], the more sense it makes to develop software for Windows instead of other platforms [distribute via Google Play instead of other app stores], which results in more people using Windows software, which results in more Windows software being developed, which results in more people using Windows software, ...
>Okay, who called this off?
A possibility is that both Apple and FBI did i.e. there was an agreement behind the scenes to Apple to continue unlocking its devices as it has until recently and the FBI to back off from the court case with a mealymouthed explanation: stakes were high for both and the outcome was unpredictable (not only from the courts, but potentially from the legislators as well). I suppose this is unlikely and I would like to think better of Apple*, but then they were among the other prominent US tech corps on the PRISM slides courtesy of Ed Snowden. Also, in this case Apple seems to have found its zeal for privacy advocacy only after asking the FBI to issue its application for the unlock tool under seal**.
* a trivial reason being that I'd like to eventually replace my Blackberry with something decent, privacywise, of course it is great to see a big tech player putting emphasis on privacy, but then doubt towards tech from the US is not without reason
Indeed. As far as I can see a stock market would work perfectly well if the highest bids were matched with the lowest asks (where bid >= ask, of course) at the end of the day and where the price paid would be the mean of the two ((bid+ask)/2) for each match: after all, stock markets are closed overnight and during weekends so the need to have a current price by the nanosecond simply isn't there. (The bids and asks should also either be final (no canceling) and/or only published at the end of the day after the trades are final to further avoid manipulation.)
(re: free market, a bit of an oxymoron, really, as anything free in the sense of lacking enforced rules ceases to be a market in a practically useful sense. A fair market, in the sense of a level playing field, would seem like a more pragmatic goal.)
> How do you come to that conclusion? The SCOTUS ...
While a pragmatic summary of the Citizens United decision might be "money = speech" it is still not "code = speech". Also, Citizens United was in the context of campaign (advertising) financing intimately tied to political speech, whereas Apple's 'speech' here is software i.e. algorithms for computers to carry out, not disseminating and/or discussing facts and opinions between people. (Also, the crux of Citizens United was elsewhere: whether campaign financing may give rise to corruption or the appearance thereof. The implausible finding was that it doesn't )
If the best Apple('s lawyers) can do here is to invoke free speech, the odds of them prevailing don't look very good: this is quite a stretch at best, not made any better by a corporate entity claiming what at its core is an individual right.
Somehow this reminded me of the boast: "In the USSR we have the biggest microchips in the world." (a mock one making fun of their propaganda, of course)
...deeply mystified as to what a terrorist could possibly have against the local building society.
>There is no 'personal data' in search results as personal data is currently defined.
The US definition of PII is rather narrow (~data from which an individual can be directly identified such as a name, SSN, phone number ...), however, the EU data protection directive definition of personal data is much wider (~data about a person, even if it doesn't directly identify a person, but can potentially be connected to a person by a third party). Still, I can't see how a search by a person's name could be carried out and the results displayed in the US without exporting the name from a server in the EU at some point, if that is where the information related to the name originally resides.
>Data collected in Europe should remain exclusively in Europe...
This can be an issue with (Google) search even if the results 'to be forgotten' are not displayed within the EU, but personal information has been exported from the EU to display or otherwise use it elsewhere. Such export is legal only if the receiving jurisdiction has proper data protection in place. Until recently the lack thereof in the US was supposedly covered with 'Safe Harbour', which meant that Google & other US companies taking advantage of it were supposed to honor the EU data protection principles with the exported data, the problem being that they not only don't but can't.
For science to have a change to defy law with the iPhone Apple would need to implement encryption in a way they themselves cannot circumvent. (One way of doing this would be adding a tamper-proof chip akin what is in a SIM to keep the encryption key, which would only spit it out given the correct passcode, and, unlike a SIM, would irrevocably erase its contents after too many misses).
This is a bit of a surprise given the ECJ's Weltimmo* -decision, which would seem to say that even a minimal legal presence in a EU member country means that a company is subject to the data protection law / DPA of that member country.
I suppose Facebook might have been careful not to have any formal legal presence in Germany, in which case (by the Weltimmo decision) the German DPA should request the Irish one to act (and, if not happy with the result, they'd probably need to take the Irish DPA to the ECJ, likely by the way of Irish courts as happened in the Safe Harbour case).
Advertising itself is a protection racket in that it provides only a relative advantage: if you were the only one to advertise there would an advantage to competion, when everyone does there is just a cost (ultimately paid by the costomers, of course).
> ... those in power would understand things like math ...
The Guardian piece linked to would seem to say that WhatsApp has simply ignored the Brazilian requests: "Investigators first contacted WhatsApp, which was bought by Facebook in 2014, about four months ago but have yet to receive a response". If so, the fault lies with WhatsApp / Facebook not the judge's understanding IT issues. Also, the detained executive seems to have gotten out on a legal technicality: "A judge ruled he was wrongly detained because he was not named personally in the legal proceedings".
I suppose it is aptly named in a sense: it shields privacy from us EU plebs.
Methinks directors should be personally liable for ICO fines in case a LLC fails to pay them for any reason (unless, of course, they go to court to argue otherwise and the court finds in their favor).
Biting the hand that feeds IT © 1998–2017