The Surveillance Economy
Justified by terrorism, surveillance has been exploited by both governments and businesses.
Mass surveillance is the intricate surveillance of an entire or a substantial fraction of a population in order to monitor that group of citizens. The surveillance is often carried out by local and federal governments or governmental organisations…, but it may also be carried out by corporations (either on behalf of governments or at their own initiative).
We're Becoming a Police State
We've seen a series of laws and rules that greatly increase the power of the government and police to gather information on their own citizens. It is secretly obtained without the prerequisite for probable cause or the oversight of a warrant that once protected citizens from unlawful search and seizure.
Whether it is cellphone tracking devices, Ring camera footage or licence plate cameras, data is being constantly collected about where we are and who we are with. Warrantless access to this data “just in case” has become the norm rather than the exception.
Widespread police surveillance is the very definition of a police state.
— Bruce Schneier
Current trends show increased surveillance and a corresponding loss of privacy:
- Allowing U.S. ISPs to collect and sell your surfing data.
- Exclusion of Canadians from privacy protection under US law.
- The unnecessarily broad powers provided by Canada's Bill C-51 and the exclusion of individuals from CRTC tracking in the controversial Bill C-10.
An expanding category of software, apps, and devices is normalizing cradle-to-grave surveillance in more and more aspects of everyday life. At EFF we call them “disciplinary technologies.” They typically show up in the areas of life where surveillance is most accepted and where power imbalances are the norm: in our workplaces, our schools, and in our homes.
Governments allowed corporations unprecedented access to our private data, then demanded access to those same resources based upon the rulings of secret courts.
Our private data is the new currency of business. Increasingly companies collect everything about what we do online, supposedly in exchange for all the free information and products on the Internet.
The press has performed admirably in reporting on privacy violations by the National Security Agency and major internet companies. But news sites often expose users to the same surveillance programs and data-collection companies they criticize.
— The New York Times
Do Not Track Ineffective
Some attempts have been made to allow you to opt-out of this collection process.
The “Do Not Track” law serves as a sterling example of how bad things are. When it was proposed, it was supposed to give users the right to demand that Internet companies not track them. Internet companies fought hard against the law, and when it was passed, they fought to ensure that it didn't have any benefit to users.
— Bruce Schneier
Even if you have Do Not Track turned on, that information will be collected and stored and used to create a profile of you that may or may not be accurate. That profile can be used by credit agencies, big corporations, and health insurance companies to make decisions about you that can literally affect your life and livelihood.
You Are the Product
Any time that you don't pay for a product or a service, your private information is the currency. You become the product.
Corporations like Facebook became wealthy by creating profiles on their users to be sold to advertisers using an open Web that they're now trying to lock down. Facebook makes about $50 per user per month while providing their “free” service.
Microsoft changed their business model from selling operating systems and office suites to one which collects personal information and monetizes features that used to be included free with the purchase of a Windows licence.
Your Personal Privacy at Risk
Your personal privacy is at risk like it has never been before. Too many have bought into the “nothing to hide” mantra.
It's not necessarily that you're doing anything wrong at all, or that you have anything to hide, but we all should have a sphere of our life where we're not on stage or being scrutinized.
And if we get rid of our privacy it's going to have a massive impact on our ability to develop as humans.
— Jenny Afia
Our information is being handled by an increasingly smaller number of powerful companies where your privacy impedes profitability.
Unfortunately, your privacy isn't a priority for social media companies. After all, they make money by selling ads, and by selling information about their members. Proper privacy can interfere with a social media company's ability to monetize the time you spend on their site.
— PC Mag
It feels like every tech giant has been racing to update their privacy policies these days so we wanted to ask. What did we just sign up for? What is this bargain? — Mozilla
Tech companies like Facebook have mastered the art of distorting choice and consent.
More about this brave new world of one-sided transparency:
- The overlapping infrastructure of urban surveillance, and how to fix it.
- Privacy or Profit — Why Not Both?
- The greatest contest ever — privacy versus security.
- Surveillance as a business model.
- Surveillance: The hidden ways you're tracked.
- Behind the one-way mirror: A deep dive into the technology of corporate surveillance.
- Your life, under constant surveillance.
Yes, you're being tracked everywhere and even though many claim they don't sell your data, they do indirectly:
- What does it actually mean when a company says, “We do not sell your data”?
- Google tracks your movements, like it or not (even if you turn off Location History).
- Your phone is listening and it's not paranoia.
Safety of Children a Powerful but Flawed Argument
Children's safety and the prosecution of child-based crimes is a noble action. However, legislation is often flawed and has darker purposes, including outright attacks on encryption and free speech.
While we see this argument used to justify removing rights like the right to privacy or encryption, they are far less aggressive in fighting privacy violations involving children if it profits big business.
Yet More Access is Demanded
Police and intelligence agencies are quick to point out the use of cell phones and encryption in terrorist attacks. They continue to demand new restrictions including special “back door” access.
Criminals and terrorists use many other services. Do we ban everything?
Criminals have used telephones and mobile phones since they were invented. Drug smugglers use airplanes and boats, radios and satellite phones. Bank robbers have long used cars and motorcycles as getaway vehicles, and horses before then. And while terrorism turns society's very infrastructure against itself, we only harm ourselves by dismantling that infrastructure in response — just as we would if we banned cars because bank robbers used them too.
— Bruce Schneier
Back Doors Unsecure
Back doors inevitably are broken and become the tools of criminals. No one wants to share private data and financial information such as credit cards on the Internet without strong encryption (it would be like mailing cash).
It really never comes into play as being a personal issue or a real big factor for you personally until that information is either weaponized, used against you, or it feels personal.
— The Grand Bargain
Everyone is Collecting Information
Everyone is collecting vast amounts of information about you — governments, businesses and the sites you visit on the Internet. “No big deal, right?”
The practice of compiling and selling individuals' personal information by data brokers for marketing or other purposes raises privacy concerns. These concerns result, in part, from a lack of transparency and openness and the challenges individuals face in trying to exert control over their information.
— Privacy Commissioner of Canada
Your Personal Data Valuable
Your personal data has become the currency of the Internet and is worth $130 billion per year!
Digital advertisers are making approximately $250 annually — roughly twice the cost of a Netflix subscription — off you and your browsing data.
— Jeremy Tillman
Right now, our data is worth a lot of coin to a lot of companies. But privacy, it's priceless. It's a necessary part of a healthy functioning society.
— Manoush Zomorodi
“Privacy is often framed as a matter of personal responsibility, but a huge portion of the data in circulation isn't shared willingly — it's collected surreptitiously and with impunity. Most third-party data collection in the US is unregulated,” said Cyphers. “The first step in fixing the problem is to shine a light…on the invasive third-party tracking that, online and offline, has lurked for too long in the shadows.” — EFF
US ISPs Wanted in on the Action
No wonder the US ISPs were pressuring the government to allow them to cull user data like Facebook and Google do. However, their premise is flawed.
Not only have [US lawmakers] voted to repeal a rule that protects your privacy, they are also trying to make it illegal for the Federal Communications Commission to enact other rules to protect your privacy online.
— Bruce Schneier
ISPs are Different
ISPs charge for their services but also have access to all of your surfing.
I wonder how many of these ISPs would be so keen on the idea if they had to provide free unlimited Internet access to users?
ISPs Can Record Everything You Do Online
ISPs see everything you do online (not just when you're logged into Facebook or another service) and can create a much more accurate profile that will be worth much more than Facebook's profile of you (which is so detailed that advertisers can focus their message to a user base more precisely than virtually any other medium).
This isn't just your browsing history or cookies. It's geolocation data, financial info, passwords, health info, even your Social Security Number. Anything you do, any data you enter, any online video you watch, any email you write. Your ISP could store it all and sell it for their own profit if Congress throws out the FCC rulings.
Remember, this is much more than what you're typing into your browser. More and more our applications have moved from our computer to become Software as a Service (SaaS) — software running on the Internet. Even our operating systems (e.g., Windows 10) are moving that direction. If this trend is allowed to continue, we'll soon have even less control (ownership) of our own data in the future.
The Canadian government's current Bill C-11 to enforce Canadian content (i.e., moving the 1990s cable structure onto the Internet) will ensure that the end of the Internet as we know it in Canada.
CanCon rules, upon which this bill is based, are convoluted, esoteric and make no sense in an online streaming world where what you choose to watch doesn't prevent anyone else from watching what they want.
You're vulnerable to Facebook when
- you visit the Facebook site;
- remain logged into your Facebook account while surfing the Web; or
- visit the 30% of sites containing a Facebook “Like” button (an anonymous account is created if you're not already logged into Facebook).
Using common factors, Facebook will attempt to link up the anonymous account with an actual account or combine multiple anonymous accounts into one profile.
Facebook wants Apple to change its business model so Facebook doesn't have to. Think about that.
It's like Ford Motor asking Tesla to build gas-powered cars so it can compete. Or Dell asking Apple to go back to Intel so their notebooks can compete.
You're providing data to Google when you use their search facilities directly (instead of an intermediary like StartPage.com) or use a Google product like Gmail, Chrome, YouTube, Google Maps, etc. or when you visit the 86% of sites that use Google Analytics.
You're particularly exposed when you're logged in to your Google account while using Chrome, YouTube or Google Search.
- Facebook's laughable campaign against Apple is really against users and small businesses.
- Google says it doesn't 'sell' your data. Here's how the company shares, monetizes, and exploits it..
Tracking Mobile Device Users
The choices for mobile users is even more distinct based upon the mobile operating system:
- Android users a always being tracked except by following a complex process.
- iOS users can disable tracking by going into the Privacy settings, then Location Services then selecting “While Using” or “Never” for Google apps like Google Maps.
In my opinion, it is unfortunate that a very capable company like Google (Alphabet) did not continue to “do no evil” (their original motto, since replaced with “do the right thing”).
Big Corporations Hijacked the Internet
The Internet was made for everyone but is being hijacked by big corporations that are turning people into products without their knowledge or consent.
— The Hidden Business of the Internet
The data market is massive, how big? Well the going estimate puts it at over 130 billion dollars now and maybe as much as 200 billion in the next three years. Those in the business of buying and selling data, we call them data brokers.
— Veronica Belmont
And it is probably going to get worse. Like sharks smelling blood, corporations are after any data they can cull. They keep it insecurely (remember, it cost them little to obtain) just in case it comes in useful later.
Trade deals like TPP, TISA and TTIP have all been open to input from industry but closed to input from both non-profit groups that look out for the public interest as well as many of our elected government representatives.
It appeared that we'd defeated the TPP then the US negotiation team began making the same demands within NAFTA. One example: they are seeking to invalidate Canadian laws protecting privacy and copyright so that US cloud providers face no restriction on doing business here.
Currently, policies in British Columbia and Nova Scotia require public-sector information — data from universities, hospitals, and government institutions — to be stored in Canada with the intent to prevent public information from being accessed elsewhere. However, that protection no longer applies if that data is stored in the US, and its own protections don't extend to non-citizens.
Canada has bowed to US pressure to approve the new NAFTA agreement which contains many of the worst aspects of the TPP. Expect to pay more for US services and to have fewer protections.
Big Data: Tracking Your Every Move
Big Data is the current mantra of organizations. How to obtain it, store it, process it.
Big data has been promoted as saving you time, personalizing your experience and a number of other positive concepts.
The Dark Side
However, big data has its dark side: the development, buying and selling of profiles (data about individuals).
The modern ad industry isabout the buying and selling of individuals,says Jeff Chester, executive director at the Center for Digital Democracy.All the investments is aggressively pushing toward much more granular personalized targeting.— The Verge
“Personalized” experiences is a euphemism for profiling. Its purpose is to make advertisers more effective in targeting you in their advertising; more likely that an ad will appeal to you.
Our unprecedented ability to collect and store data is revolutionizing the business world and giving companies predictive insight that they have never dreamed of before. Motor companies can now anticipate breakdowns, credit card companies can apply personally tailored rates for their clients, and mega-retailers like Costco and Wal-Mart can track sales with accuracy that almost seems psychic.
— Moran Shimony
Interestingly enough, targeted ads only provide a 4% improvement over contextual ads according to a 2019 study:
We find that when a user’s cookie is available publisher's revenue increases by only about 4%. This corresponds to an average increase of $0.00008 per advertisement.
— Veronica Marotta, Vibhanshu Abhishek, and Alessandro Acquisti
The concept of “personally tailored rates” may sound appealing until you realize that means that you'll pay more if you live in the wrong neighbourhood, view the wrong sites (or your friends do).
There is only one word that can be used to describe this practice: sleazy.
If you're using privacy software like Ghostery on your web browser, you've probably noticed that most sites now use invisible web beacons, analytics services, page widgets and other third-party page elements that are secretly tracking your every move.
[W]eb tracking has become so pervasive that approximately ten percent of websites send the data they've collected to ten or more different companies, and 15 percent of all page loads on the internet are monitored by ten or more trackers.
— Jeremy Tillman
These sleazy practices are very profitable — but at the expense of your privacy. Corporations would sue you if you were to return the favour (they'd call it hacking).
Videos and Comments as Marketing Tools
Videos on many sites serve as more than information. Comments on the bottom of an article or post also have a hidden purpose.
Both are marketing tools.
If you use ad blockers and other privacy software, you quickly learn that if you block tracking elements, you can no longer view embedded videos nor see the comments left by other site visitors.
Creepy Recording of Your Surfing
Many of today's largest websites are not only storing generic analytics data, but individualized recordings of visits to their site, including keystrokes, mouse movements, clicks and the pages visited. These scripts even record keystrokes that aren't submitted (including your typed passwords).
They claim that they are only collecting anonymous meta data, but are doing everything they can to identify users.
"Session replay scripts" can be used to log (and then playback) everything you typed or clicked on a website.
The information shared on some sites is much more personal and should be protected. It isn't.
Dating sites collect sensitive personal information like drug usage habits and sexual preferences. They also have dozens of trackers that can collect profile information, as well as information on where a user clicks or looks.
- How dating sites spy on you.
- Over 400 of the world's most popular websites record your every keystroke, Princeton researchers find.
- Data release: list of websites that have third-party "session replay" scripts.
- No boundaries: Exfiltration of personal data by session-replay scripts.
Why Tracking is a Privacy Issue
While these sites claim the purpose is to improve their website, much more information is obtained which allows sites to create a precise profile about you.
Collection of page content by third-party replay scripts may cause sensitive information such as medical conditions, credit card details and other personal information displayed on a page to leak to the third-party as part of the recording. This may expose users to identity theft, online scams, and other unwanted behavior. The same is true for the collection of user inputs during checkout and registration processes.
— Freedom to Tinker
This data has tremendous economic value and may be shared without your permission (or be revealed in a data breach) and this could have significant repercussions for your privacy in the future.
PayPal Shares Your Data
While much of this may have to do with ensuring your identity, that is a lot of sharing.
More About Big Data
There's more about Big Data on these pages:
- What is big data and what is its influence on the world.
- What information is being collected about you?
- Big Data: The eye-opening facts everyone should know.
- Behind the one-way mirror: A deep dive into the technology of corporate surveillance.
- How is Big Data used in practice? 10 use cases everyone must read.
“We're Only Collecting Metadata”
Many organizations indicate that they are “only collecting metadata” yet are very vague about what they do with our data and who they share it with.
[M]etadata is characterized as data used to describe other data.In the aftermath of the Snowden revelations, however, the courts struggled to characterize metadata in light of precedent. As a result, an assessment of whether bulk collection of telephony metadata violates a reasonable expectation of privacy seems to have been rooted in three constitutionally relevant dichotomies, namely content vs. non-content data, private records vs. business records held by third parties, and hard-to-obtain information vs. information “in plain view.” — Kift & Nissenbaum
Significant is our inability to determine how those collecting our information will
aggregate, store, combine and analyze that data, and the extent to which we, the data subjects, assume the risk of metadata being shared beyond the purpose for which it was provided.
The number and size of data breaches demonstrates how little regard these organizations have for the consequences of their failure to protect our data. The implication is that we allowed them this information so they are no longer responsible.
That's like blaming you for how your credit card was used following its theft including its use in the commission of a crime after you've reported it stolen.
Why Metadata Matters
Research has shown that using only call metadata, the government can determine what your religion is, if you purchased a gun or got an abortion, and other incredibly private details of your life. Former director of the NSA and CIA, Michael Hayden, recently admitted:We kill people based on metadata.And former NSA General Counsel Stu Baker said:metadata absolutely tells you everything about somebody's life. If you have enough metadata, you don't really need content.
— Electronic Frontier Foundation
How revealing metadata can be is demonstrated in these three (rather obvious) examples presented by Kurt Opsahl at CCC on December 30, 2013:
- They know you rang a phone sex service at 2:24 a.m. and spoke for 18 minutes. But they don't know what you talked about.
- They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret.
- They know you spoke with an HIV testing service, then your doctor, then your health insurance company in the same hour. But they don't know what was discussed.
Why metadata matters further expands this concept and helps you to better understand what metadata is and how it affects us.
Metadata Can Be “De-anonymized”
We're continually assured that all data is anonymized before sharing, but that process can be reversed by using associated data to re-identify the person associated with that “anonymized” data.
A more intensive look at telephone metadata reveals that your privacy could be compromised by linking the timing of anonymous data to data that directly identifies you via credit card, hotel stays and more.
While there might be a lot of people who are in their thirties, male, and living in New York City, far fewer of them were also born on 5 January, are driving a red sports car, and live with two kids (both girls) and one dog.
— Dr. Luc Rocher
One investigation of "anonymized" user credit card data by MIT found that users could be correctly "de-anonymized" 90 percent of the time using just four relatively vague points of information. Another study looking at vehicle data found that 15 minutes' worth of data from just brake pedal use could lead them to choose the right driver, out of 15 options, 90% of the time.
All this can be used to build a profile of you that may make judgement calls which are then processed as “facts” by other parties. Metadata IS surveillance.
Even something like Alfred Kinsey's sex research data from the 1930s and 1940s isn't safe. Kinsey took great pains to preserve the anonymity of his subjects, but in 2013, researcher Raquel Hill was able to identify 97% of them.
— Data and Goliath: The Hidden Battles to Capture Your Data and Control Your World by Bruce Schneier
Much more data is collected today. We can no longer blindly provide access to all our personal data assuming it is truly anonymous.
Governments Collecting More
[K]now that every border that you cross, every purchase you make, every call you dial, every cellphone tower you pass, friend you keep, site you visit, and subject line you type, is in the hands of a system whose reach is unlimited but whose safeguards are not.
— CITIZENFOUR documentary
Everything We Know About NSA Spying is an excellent YouTube video about NSA spying. It shows just how extensive the reach of this program is and how easy it is to become a target.
- Fighting for privacy, two years after Snowden.
- Mikko Hypponen: How the NSA betrayed the world's trust.
- What can government security agencies tell from your phone's metadata?
In the “new propaganda era” we are entering, where the frontier between information, communication and propaganda becomes blurry, the world needs independent journalists, who engage in the pursuit of the truth, who respect standards of ethics, and whose mission is to give citizens of this world tools to understand what surrounds them. That is to say, in a word, free journalists.
— Defence Handbook For Journalists and Bloggers
More About Personal Activities
Governments are collecting more about you and your Internet activities.
Never in history has a surveillance state and a representative form of government existed side by side. A free society and a surveillance society cannot be reconciled. Biometrics is the linchpin to a surveillance society.
— Constitutional Alliance
Never give a government a power you would not want a despot to have.
— John Gilmore
Canadian Government Double Standard
The Canadian government will not allow its data to be stored on servers outside Canada. However, the government is much less concerned about your privacy.
They continue to share data about their own citizens with the U.S. and other Five Eyes partners — even unconfirmed data that has cost innocent individuals their freedom.
Overseas Privacy Threatened
Microsoft successfully fought a December 2013 federal search warrant demanding that the company release emails stored in Ireland. Governments seeking access to data stored on overseas servers should concern everyone. The U.S. is not the only country doing this.
The revelations of NSA searches on U.S. servers has cost American tech companies, forcing them to build servers overseas rather than hosting them all in the United States. This case clearly had implications for these companies being abandoned if foreign customers felt their privacy was threatened even with servers hosted in their own country.
You can find out more about governments collection of personal information at:
- Privacy Rights Clearinghouse.
- Electronic Frontier Foundation defending your rights in the digital world.
- Privacy International is committed to fighting for the right to privacy across the world.
- Surveillance Self-Defense is a guide to protecting yourself from electronic surveillance.