Group items tagged

Vodafone, one of the world's largest mobile phone groups, has revealed the existence of secret wires that allow government agencies to listen to all conversations on its networks, saying they are widely used in some of the 29 countries in which it operates in Europe and beyond.The company has broken its silence on government surveillance in order to push back against the increasingly widespread use of phone and broadband networks to spy on citizens, and will publish its first Law Enforcement Disclosure Report on Friday. At 40,000 words, it is the most comprehensive survey yet of how governments monitor the conversations and whereabouts of their people.The company said wires had been connected directly to its network and those of other telecoms groups, allowing agencies to listen to or record live conversations and, in certain cases, track the whereabouts of a customer. Privacy campaigners said the revelations were a "nightmare scenario" that confirmed their worst fears on the extent of snooping.

Vodafone's group privacy officer, Stephen Deadman, said: "These pipes exist, the direct access model exists."We are making a call to end direct access as a means of government agencies obtaining people's communication data. Without an official warrant, there is no external visibility. If we receive a demand we can push back against the agency. The fact that a government has to issue a piece of paper is an important constraint on how powers are used."Vodafone is calling for all direct-access pipes to be disconnected, and for the laws that make them legal to be amended. It says governments should "discourage agencies and authorities from seeking direct access to an operator's communications infrastructure without a lawful mandate".

In America, Verizon and AT&T have published data, but only on their domestic operations. Deutsche Telekom in Germany and Telstra in Australia have also broken ground at home. Vodafone is the first to produce a global survey.

Verizon says it will soon offer customers a way to opt out from having their smartphone and tablet browsing tracked via a hidden un-killable tracking identifier. The decision came after a ProPublica article revealed that an online advertiser, Turn, was exploiting the Verizon identifier to respawn tracking cookies that users had deleted. Two days after the article appeared, Turn said it would suspend the practice of creating so-called "zombie cookies" that couldn't be deleted. But Verizon couldn't assure users that other companies might not also exploit the number - which was transmitted automatically to any website or app a user visited from a Verizon-enabled device - to build dossiers about people's behavior on their mobile devices. Verizon subsequently updated its website to note Turn's decision and declared that it would "work with other partners to ensure that their use of [the undeletable tracking number] is consistent with the purposes we intended." Previously, its website had stated: "It is unlikely that sites and ad entities will attempt to build customer profiles.

However, policing the hundreds of companies in the online tracking business was likely to be a difficult task for Verizon. And so, on Monday, Verizon followed in the footsteps of AT&T, which had already declared in November that it would stop inserting the hidden undeletable number in its users' Web traffic. In a statement emailed to reporters on Friday, Verizon said, "We have begun working to expand the opt-out to include the identifier referred to as the UIDH, and expect that to be available soon." Previously, users who opted out from Verizon's program were told that information about their demographics and Web browsing behavior would no longer be shared with advertisers, but that the tracking number would still be attached to their traffic. For more coverage, read ProPublica's previous reporting on Verizon's indestructible tracking and how one company used the tool to create zombie cookies.

If we’ve learned one thing from the Snowden revelations, it’s that what can be spied on will be spied on. Since the advent of what used to be known as the World Wide Web, it has been a relatively simple matter for network attackers—whether it’s the NSA, Chinese intelligence, your employer, your university, abusive partners, or teenage hackers on the same public WiFi as you—to spy on almost everything you do online. HTTPS, the technology that encrypts traffic between browsers and websites, fixes this problem—anyone listening in on that stream of data between you and, say, your Gmail window or bank’s web site would get nothing but useless random characters—but is woefully under-used. The ambitious new non-profit Let’s Encrypt aims to make the process of deploying HTTPS not only fast, simple, and free, but completely automatic. If it succeeds, the project will render vast regions of the internet invisible to prying eyes.

Encryption also prevents attackers from tampering with or impersonating legitimate websites. For example, the Chinese government censors specific pages on Wikipedia, the FBI impersonated The Seattle Times to get a suspect to click on a malicious link, and Verizon and AT&T injected tracking tokens into mobile traffic without user consent. HTTPS goes a long way in preventing these sorts of attacks. And of course there’s the NSA, which relies on the limited adoption of HTTPS to continue to spy on the entire internet with impunity. If companies want to do one thing to meaningfully protect their customers from surveillance, it should be enabling encryption on their websites by default.

Let’s Encrypt, which was announced this week but won’t be ready to use until the second quarter of 2015, describes itself as “a free, automated, and open certificate authority (CA), run for the public’s benefit.” It’s the product of years of work from engineers at Mozilla, Cisco, Akamai, Electronic Frontier Foundation, IdenTrust, and researchers at the University of Michigan. (Disclosure: I used to work for the Electronic Frontier Foundation, and I was aware of Let’s Encrypt while it was being developed.) If Let’s Encrypt works as advertised, deploying HTTPS correctly and using all of the best practices will be one of the simplest parts of running a website. All it will take is running a command. Currently, HTTPS requires jumping through a variety of complicated hoops that certificate authorities insist on in order prove ownership of domain names. Let’s Encrypt automates this task in seconds, without requiring any human intervention, and at no cost.

Vowing to take on the telecom giants that have monopolized the web for private profit, Sen. Bernie Sanders on Friday unveiled a $150 billion plan to make the internet a public utility, break up and tightly regulate corporate behemoths like Verizon and AT&T, and provide high-speed broadband for everyone in the United States.

It is outrageous that across the country millions of Americans and so many of our communities do not have access to affordable high-speed internet," Sanders, a 2020 Democratic presidential candidate, said in a statement. "Access to the internet is a necessity in today's economy, and it should be available for all." Sanders vowed that, if elected president in 2020, he will ensure that every American household has affordable and high-speed internet by the end of his first term.

Sanders' plan, posted on his website, would provide $150 billion in federal funding through the Green New Deal to help states and municipalities "build publicly owned and democratically controlled, co-operative, or open access broadband networks." The proposal also calls for: Reinstating the net neutrality protections that President Donald Trump's telecom-friendly FCC repealed in 2017; Using anti-trust laws to break up internet and cable monopolies; Ensuring that all public housing in the U.S. offers free broadband; Requiring all providers to "offer a Basic Internet Plan that provides quality broadband speeds at an affordable price"; and Guaranteeing that all new broadband infrastructure is "resilient to the effects of climate change" and "capable of managing high amounts of renewable energy."

Google on Wednesday was hit by a lawsuit from a group of state attorneys over alleged violation of antitrust laws by its Android app store.

Attorneys general for 36 states and the District of Columbia sued the Big Tech company in a 144-page complaint filed in a Northern California federal court. The group alleges that Google’s Play store for Android apps violates antitrust laws.The complaint centers on the control Google is able to exert on its Play store, allowing it to collect commissions of up to 30 percent on digital transactions within apps installed on Android-powered smartphones. Those devices represent more than 80 percent of the worldwide smartphone market.Led by Utah, North Carolina, Tennessee, New York, Arizona, Colorado, Iowa, and Nebraska, it marks the fourth major antitrust lawsuit filed by U.S. government agencies against the company since October 2020.Other lawsuits filed against Google include a complaint filed by a bipartisan coalition of states, and one filed by the Department of Justice. It echoes allegations made against the company by mobile game maker Epic Games in August 2020. That case is awaiting trial.The complaint contends that Google has deployed various tactics and set up anticompetitive barriers to ensure it distributes more than 90 percent of the apps on Android devices—a market share that the attorneys general argue represents an illegal monopoly. It also alleges Google has been abusing that power to reap billions of dollars in profit at the expense of consumers, who wind up paying higher prices to subsidize the commissions, and the makers of apps who have less money and incentive to innovate.