In June, the Texas Department of Public Safety (DPS) signed an acquisition plan for a 5-year, nearly $5.3 million contract for a controversial surveillance tool called Tangles from tech firm PenLink, according to records obtained by the Texas Observer through a public information request. The deal is nearly twice as large as the company’s $2.7 million two-year contract with the federal Immigration and Customs Enforcement (ICE).

Tangles is an artificial intelligence-powered web platform that scrapes information from the open, deep, and dark web. Tangles’ premier add-on feature, WebLoc, is controversial among digital privacy advocates. Any client who purchases access to WebLoc can track different mobile devices’ movements in a specific, virtual area selected by the user, through a capability called “geofencing.” Users of software like Tangles can do this without a search warrant or subpoena. (In a high-profile ruling, the Fifth Circuit recently held that police cannot compel companies like Google to hand over data obtained through geofencing.) Device-tracking services rely on location pings and other personal data pulled from smartphones, usually via in-app advertisers. Surveillance tech companies then buy this information from data brokers and sell access to it as part of their products.

WebLoc can even be used to access a device’s mobile ad ID, a string of numbers and letters that acts as a unique identifier for mobile devices in the ad marketing ecosystem, according to a US Office of Naval Intelligence procurement notice.

Wolfie Christl, a public interest researcher and digital rights activist based in Vienna, Austria, argues that data collected for a specific purpose, such as navigation or dating apps, should not be used by different parties for unrelated reasons. “It’s a disaster,” Christl told the Observer. “It’s the largest possible imaginable decontextualization of data. … This cannot be how our future digital society looks like.”

While a device’s mobile ad ID is technically an anonymous piece of information, it is easy to cross reference other data points to determine the owner, according to Beryl Lipton, an investigative researcher at the Electronic Frontier Foundation. “If there is another data point—like the address of the person who lives at the place where your phone seems to be all of the time—it can be very easy to quickly identify and build a profile of people using this supposedly anonymous information,” Lipton said. 

In 2018, the U.S. Supreme Court ruled in Carpenter v. United States that police must have a warrant to obtain cell phone location data from service providers like AT&T and Verizon. But Nate Wessler, the attorney who argued the Carpenter case and the deputy director of the American Civil Liberties Union’s Speech, Privacy, and Technology Project, told the Observer that companies have justified selling phone location information through data brokers by arguing that mobile ad IDs are anonymous. 

“These companies absolutely trot that out as one of their defenses, and it is pure poppycock. … It’s transparently a ridiculous defense, because the entire thing that they’re selling is the ability to track phones and to be able to figure out where particular phones are going,” Wessler said.

The privacy implications of police using services—like Tangles—that provide location data are “identical” to the issues raised in the Carpenter case, Wessler said. That’s because location data harvested from apps, as opposed to that obtained from service providers, can be even more invasive, he said. “You can tell just as much about somebody’s GPS history from their apps as you can from their cell phone location data from their phone provider. And in some cases, you can tell more,” Wessler said.

Tangles is a product offered by the cybersecurity company Cobwebs Technologies, which was founded in Israel in 2014 by three former members of Israeli military special units. The company has said their products, which are marketed as open source intelligence (OSINT) tools, have been used to combat terrorism, drug smuggling, and money laundering, but Meta has accused the company of operating as a surveillance-for-hire outfit. In 2023, Cobwebs Technologies was acquired by the Nebraska-based tech firm PenLink Ltd.

Christl, the Austria-based digital rights researcher, said that companies selling software that incorporates data harvested from mobile phone apps have greatly expanded the definition of OSINT tools. If a company has to buy personal data from third-party brokers to incorporate into a software that they sell to police, he said, then that isn’t really an open source tool.

Lipton, the investigative researcher at the Electronic Frontier Foundation, said that’s troubling for the public. “People don’t realize that some of this stuff comes with a high cost,” she said. “Both price-wise and privacy-wise.”

In a written statement, a PenLink spokesperson told the Observer their “open-source intelligence (OSINT) solutions are used to protect our communities from crime, threats, and cyber-attacks by providing seamless access to data that is publicly available. From a technology perspective, we want to note that we operate only according to the law, adhering to strict standards and regulations.” The spokesperson did not answer other specific questions.

Cobwebs Technologies, now part of PenLink, has scored contracts through its Delaware-based subsidiary Cobwebs America Inc. with various federal agencies, including ICE, the Internal Revenue Service, the Bureau of Indian Affairs and Bureau of Indian Education, and the U.S. Fish and Wildlife Service. ICE holds Cobwebs America’s highest-dollar federal contract so far, according to usaspending.gov.

DPS’ Intelligence and Counterterrorism division has used Tangles since 2021, as first reported by The Intercept. The agency first purchased the software as part of Governor Greg Abbott’s multi-billion dollar Operation Lone Star border crackdown, doling out an initial $200,000 contract as an “emergency award” with no public solicitation. Each year since, DPS has expanded the contract: In 2022, it paid $300,000, and in 2023, more than $400,000, according to contracting records on DPS’ website. The agency’s new plan for a 5-year Tangles license, from 2024 through 2029, will cost about $1 million per year.

“You can tell just as much about somebody’s GPS history from their apps as you can from their cell phone location data from their phone provider. And in some cases, you can tell more.”

In its acquisition plan, DPS states that Intelligence and Counterterrorism division personnel need the tool to “identify and disrupt potential domestic terrorism and other mass casualty threats.” The plan references two Texas mass shootings. In August 2019, a racist white man from Allen killed 23 at a Walmart in El Paso. A few weeks later, a different perpetrator went on a deadly shooting in Midland and Odessa. The plan does not mention the 2022 Uvalde school shooting, when 91 DPS officers formed part of a massive botched law enforcement response. 

“Following the attacks in El Paso and Midland-Odessa Governor Abbott issued several executive orders designed to prevent similar events,” the acquisition plan obtained by the Observer states. “In response to these orders, DPS [Intelligence and Counterterrorism division] dedicated staff to identify potential mass attackers and terrorist threats.”

It is unclear how DPS has used Tangles or whether the software has helped stop any potential mass shootings. DPS did not respond to written questions or an interview request for this story.

Following initial publication of this story, Republican state Representative Brian Harrison said on social media that he would be requesting more information from DPS about its use of the surveillance software. Reached by phone, Harrison told the Observer: “I want to make sure that we don’t have Fourth Amendment violations going on here, whether it’s intentional or not. … Government should be protecting our civil liberties, not violating them.”

After DPS purchased the initial license for Cobwebs’ software in 2021, local Texas law enforcement agencies followed suit. Operation Lone Star spending records from the Goliad County Sheriff’s Office, obtained by the Observer, show that the Goliad sheriff obtained a “cooperative use of [Cobwebs] software” in fall 2023 along with the sheriffs of Refugio and Brooks counties to “identify, link, and track the movements of cartel operatives throughout the region.”

Other Texas clients that have purchased Cobwebs’ software include the Dallas and Houston police departments and the sheriff’s office in Jackson County, which shares access with the Matagorda County Sheriff’s Office, according to local government meeting minutes and DPS emails.

It is unclear how DPS has used Tangles or whether the software has helped stop any potential mass shootings.

Prior to its acquisition by PenLink, Cobwebs Technologies received backlash for how clients used its products. In 2021, Meta banned seven companies—including Cobwebs—that it had identified as participating in an online surveillance-for-hire ecosystem. As part of its sanctions, Meta removed 200 accounts operated by Cobwebs and its customers. In a company report, Meta investigators wrote that they identified Cobwebs customers in Bangladesh, Hong Kong, the United States, New Zealand, Mexico, Saudi Arabia, Poland, and other countries. 

Cobwebs’ customers were not solely focused on public safety activities, Meta’s report said. “We also observed frequent targeting of activists, opposition politicians and government officials in Hong Kong and Mexico,” the report stated.

Agencies across the globe have used Tangles. From at least 2021 to 2022, Salvadoran police used it, according to the investigative outlet El Faro. Police in Mexico have also purchased the software, according to Excelsior, a Mexico City newspaper. 

In 2022, a Cobwebs Technologies sales rep asked a DPS employee if the state agency could serve as a customer referral for a police agency in Israel, according to an email obtained by the Observer. In the email, the sales rep stated that DPS had at least 20 Tangles users at the time. DPS’ new acquisition plan allows for 230 named users.

Wessler, the ACLU attorney, said the sale of mobile device data to third-party data brokers and surveillance tech firms remains a legal gray area. “There are some legal frameworks that get at the edges of this, but there’s a whole kind of core of issues that the law just hasn’t caught up to,” Wessler said.

But he said other government agencies already have moved away from purchasing products that use massive amounts of cell phone location data. The services can be expensive, the use of data is invasive, and there isn’t much evidence that these services have substantially helped investigations or solved a lot of cases, he added.

“It’s just like the juice isn’t worth the squeeze,” Wessler said. “We shouldn’t be spending taxpayer money for this kind of haystack of data that they then are trying to pick needles out of, right?”

This story was originally published in The Texas Observer.

The artwork for this piece was developed during a Rhode Island School of Design course taught by Marisa Mazria Katz, in collaboration with the Center for Artistic Inquiry and Reporting.

The post Texas State Police Gear Up for Massive Expansion of Surveillance Tech appeared first on Coda Story.

For this photo essay, Magnum Photos President Thomas Dworzak traveled to Switzerland and documented the lives of Geneva residents along with the digital “footprints” they leave behind every day. Drawing on research by the Edgelands Institute that explored Geneva’s evolving systems of everyday surveillance, Dworzak sought to use photography to tell the story of how the digitalization of our daily lives affects — and diminishes — our security.

He accompanied Geneva citizens in their daily routines while documenting the digital traces of their activities throughout the day. Dworzak researched the places that store our digital data and photographed them as well — an investigation that proved difficult and revealing of the lack of transparency surrounding the handling and storage of personal data.

To conclude the project, Dworzak sent each of his subjects a postcard from places where their digital information is stored: a simple way to demonstrate the randomness of where our digitally collected information ends up.

Thomas writes: 

Do citizens of Geneva understand how surveillance takes place in their daily lives? The relationship between surveillance and power can be understood as a contemporary version of the “social contract,” originally conceptualized by the Genevan philosopher Jean-Jacques Rousseau in his 18th century seminal work on democracies.

As a photographer, I needed to set the place: Geneva. I wanted to play on the dark side of the quaint, cute and affluent image of one of the world’s wealthiest cities and the world of international relations in which the Genevans are so often entangled.

I needed to trace the connection between life in this comfortable European city and the hidden paths of information that form underneath a surveilled daily life. I spent time with a variety of regular Genevan people, all voluntary participants in our project. I photographed their daily routines, marking whenever they would leave a “digital footprint” when using their phones, credit cards, apps or computers. With the help of the Edgelands team, I then identified corresponding data centers around the world where their information was likely to have been stored. I created a set of postcards using open-source applications like Google Earth and Google Street View. These “postcards from your server” were then sent back to the respective volunteers from the countries where these data centers were located, highlighting the far-flung places that our private data goes to when they perform a simple task such as buying groceries or a bus ticket.

The post Digital footprints on the dark side of Geneva appeared first on Coda Story.

“Yes, it’s disturbing,” admitted Tim O’Brien, Microsoft’s general manager of AI programs, when news of the patent hit the headlines. For some, the notion of talking to a loved one from beyond the grave elicited feelings of revulsion and fear, something that philosophy researchers Joel Krueger and Lucy Osler call “the ick factor.” In October 2022, the U.K. researchers, based at Exeter and Cardiff universities respectively, published “Communing with the Dead Online,” a research paper that looks at the role that chatbots could play in the grieving process. Since then, the capabilities of artificial intelligence large language models have snowballed — and their influence on our lives. Krueger and Osler say we should consider how chatbots might help us in our darkest days by continuing our relationship with loved ones after they’ve died. 

This conversation has been edited for length and clarity. 

What role could a chatbot potentially play after a person has died?

Lucy: Sadly, Joe's dad died while we were researching this, which added a very different texture to the writing experience. It changed a lot of the conversations we were having around it.

Joel: I started thinking more carefully about some of the ways I wanted not just to preserve his memory but to create more active, and maybe dynamic, ways of maintaining his presence in my life. I started thinking about what role chatbots and more sophisticated technologies might play  in maintaining a continuing bond with him. 

For what it's worth, I'm still undecided. I'm not sure I'd want a chatbot of my father. But I started thinking more about this issue in that very real context, as I was negotiating my own grief. 

Tell me about the ‘ick factor’ — this response that I’m even having right now, thinking about talking to a family member via a chatbot from beyond the grave.

Lucy: If someone turns around and says, ‘Did you know that we can now create a chatbot of the dead that impersonates someone's style of voice?’ A very common reaction is: ‘gross,’ ‘ew,’ ‘that's really scary.’ There’s that kind of knee-jerk reaction. But we think that there might be interesting and complicated things to unpack there. People have this instinctive ick factor when it comes to conversing with the dead. There’s an old Chinese ritual, where there would be a paid impersonator of the dead person at a funeral who would play the role of the deceased, and I think lots of Western ears find that kind of startling and a bit strange. Historically, we recognize that. But because something’s unfamiliar is not a reason to say well, that’s got no worth at all. Grieving practices come in all shapes and forms. 

Do you think talking with a chatbot, after someone has died, would interrupt the natural grieving process? Or the stages of grief like denial, bargaining and acceptance?

Lucy: Using a chatbot of the dead isn’t about denying someone has died. It's about readjusting to a world where you're very aware that they have died, without letting go of various habits of intimacy. You don't have to just move on in a very stark sense. We can have a kind of nuanced and ongoing adjustment to someone's death and take time to emotionally adjust to the absence we now feel, as we learn to inhabit the world without them.

Joel: We've always employed various technologies to find ways to maintain a connection with the dead, and this is just one new form of these technologies. There are lots of ways of getting stuck, and certainly, we can get trapped in those patterns of not accepting the loss. For instance, someone could wake up each day, go through the same pictures, watch the same videos, scroll the same Facebook page. It's unclear to me whether there's any greater threat when it comes to chatbots. Chatbots do provide a much richer form of reciprocity, a kind of back-and-forth in which the person may feel more present than if we're just looking at a picture of them. 

Yes — and there are now AI programs that allow you to talk and interact with a video or hologram version of the person that has died. 

Joel: Yes! Since our research came out late last year, the world has already moved on so much. And some of the grief technology now already seems worlds ahead of a chatbot that's confined to some little textbox on a screen or a phone. 

Lucy: If you think about the “Be Right Back” episode of “Black Mirror,” it has some interesting implications for what the near future might look like. But I think we should be able to say that a chatbot and a living robot replica of a dead partner are different things. 

What are things you worry about with tech companies offering these so-called ‘chatbots of the dead’? 

Lucy: I am much more concerned, for instance, about data being sold from these programs. Or about these things being created as to be deliberately addictive. 

Joel: Or targeted advertising used on them, when you’re grieving. Imagine if you had a chatbot of your dead father, let's say, that you could activate anytime you want. You might say, ‘Dad, I’m feeling kind of low today. I really miss you.’ And he says, ‘I'm really sorry to hear that sweetheart. Why don't you go get the new frappuccino at Starbucks for lunch, and that will help elevate your mood?’

Funnily enough, that’s something my dad probably would say. 

Joel: You can imagine those kinds of targeted ads being built into the technology or very subtle, algorithmically calibrated ways to kind of keep you engaged and potentially keeping you stuck in the grief process as a way of driving user engagement. 

I think our concern is more about the people who are designing the chatbots than it is about the individuals who are using them. The real focus needs to be on issues of transparency, privacy and regulation. The motivations that people have for designing this sort of tech should be as a tool, as a continuing bond, instead of something that they want you to come back to again and again and again. And I realize that sounds a bit hopelessly naive when you're talking about companies that are driven first and foremost by driving profit.

Related Articles

How Somali workers in the US are fighting Amazon’s surveillance machine

Erica Hellerstein

Italy’s pro-choice gynecologists reel from post-Roe shockwaves

Isobel Cockerell

Can the world’s de facto tech regulator really rein in AI?

Chris Stokel-Walker

The post Chatbots of the dead appeared first on Coda Story.

Now White Castle could be on the hook for upward of $17 billion. 

On February 17, the Illinois Supreme Court made a decision on Cothron’s case that sent the state’s business community reeling. According to the court, every time a company collects an individual’s biometric data without getting informed written consent, it counts as a separate BIPA violation with potential damages from $1,000 to $5,000. In the past, courts interpreted the law to mean one violation per person. Now, if an employee uses their fingerprint to sign into work, or every time they clock in and out for shifts or breaks, the number of infractions rack up quickly, and so does the amount of money to be paid out in damages. 

“So now six times a day, 340 days a year for five years, one person is potentially a $1 million risk,” said Jason Stiehl, an attorney who works on litigation, technology and brand protection for Crowell & Moring LLP in Chicago.

Justices on the Illinois Supreme Court acknowledged that the extent of damages could be “harsh, unjust, absurd or unwise” but said the court is bound to interpret laws as they are written by state legislators.  

This court decision in the White Castle case comes on the heels of another decision in Tims v. Black Horse Carriers. The ruling, announced on February 2, set the statute of limitations for BIPA violations at five years. Previously, that number had been unclear, but the courts had largely interpreted it to be about two years. So now not only are the damages potentially much higher but the number of incidents in violation could be much larger.

BIPA has been held up as the gold standard for consumer privacy acts. But the court’s latest interpretation of the Illinois law shows the pitfalls of some of its key aspects. The rulings underscore the risks of creating vague regulations for evolving technology and illustrate the tension between business interests and privacy. 

When Ted Claypoole, an Atlanta-based data, technology and privacy lawyer, heard the news about the court’s ruling in the White Castle and Black Horse Carriers cases, his first thought was “Oh crap.” 

But as a lawyer who advises clients on compliance with data laws, the court’s decision wasn’t a surprise to Claypoole. BIPA is vaguely written, and issues like the statute of limitations or whether violations are measured per person or per scan aren’t clearly written out.

“It’s not a crazy reading of the statute. It just is a crazy result,” said Claypoole. 

BIPA has been around since 2008, and Claypoole and privacy advocates consider it to be one of the most important privacy laws in the U.S. because it allows individuals to sue companies using their biometric information without written consent. 

But consumers or employees don’t actually need to show that they were harmed by their data being collected, thanks to a 2019 ruling by the Illinois Supreme Court in a case involving the Six Flags theme park. 

After that decision, there was an increase in the number of BIPA complaints filed because anyone whose biometrics had been collected without proper consent could file a lawsuit. 

This led to what Jeff Keicher, a Republican in the Illinois State House of Representatives, called “an obscene shakedown of business communities.” 

Many of these cases have been large class-action lawsuits, resulting in companies like McDonald’s and its franchises across the state paying millions in damages. 

In the first case to go to trial, BNSF Railway had to pay $228 million after truck drivers brought a class-action suit over the company’s policy of scanning their fingerprints when they went to BNSF rail yards. 

But the recent decision in the White Castle case brings the potential damages to another level. Trade associations in Illinois are raising alarms that these large settlements will drive companies out of business and force Illinois residents out of their jobs.

 “Getting a $2 million complaint is one kind of problem. Getting a $10 billion award against you is a whole other kind of problem,” said Claypoole. “It's not just that it's higher. It's that it is existential. It's life threatening to a business.”

Since the rulings, the number of BIPA complaints filed has gone up, according to Anne Mayette, a labor and employment lawyer who advises clients on BIPA compliance at Husch Blackwell, a national law firm. The number of cases expanded after the Six Flags ruling determined that plaintiffs don’t need to prove that harm was inflicted by the use of their biometrics, but the pace slowed down after a while. After the two latest decisions, Mayette estimates she sees 3 to 10 BIPA suits a day, compared to a few per week previously.    

It’s not all panic for businesses though. Many of the companies who were vulnerable to lawsuits have already built policies to be compliant with BIPA. 

Stiehl, the attorney, also sees a “silver lining.” The amount in damages is discretionary, not mandatory, meaning a jury can decide to order a smaller payment. Stiehl thinks the White Castle case will go on to trial court, and the company will not be hit with the full $17 billion in damages. “It sends a larger message,” he said, “saying this is not your pot of gold.” 

The typical pattern is for regulation to lag behind technology. BIPA is the opposite. In the years since the law passed in 2008, biometrics have changed significantly. That’s why Keicher, the house representative, thinks that it’s time to make some changes to the Illinois law. 

“We're dealing with a statute that's 15 years old that didn't even foresee any of the technological advances that we have today,” he said. “To say that it doesn't need any attention, I think, is naive to the way our society is progressing.”

Keicher has brought forward two bills regarding BIPA this year that decrease a company’s liability to BIPA lawsuits. One clarifies that a company only needs to get consent to collect a person’s biometrics once and makes it clear that BIPA doesn’t apply to biometrics that are stored as mathematical representations. The other says that if a company fixes the problem within 15 days of receiving notice of a violation of BIPA, it can’t be subject to legal action in pursuit of damages. 

In particular, attorneys like Claypoole and Stiehl want to get rid of the ability for individuals to directly sue companies through a legal mechanism known as the right to private action. It’s what makes Illinois law unique and allows for these types of suits with statutory damages in the millions. 

“Frankly, the easiest way is to take it out of the plaintiffs’ counsels’ hands,” said Stiehl. “ There are paths to still enforce these things in a reasonable way.”

A reckoning over BIPA could have an impact on potential legislation in states like New York, which is considering a similar law that includes the right to private action.

But BIPA isn’t the only model. Texas and Washington have similar biometric privacy laws, but they are enforced by the states’ attorney general, rather than individuals taking direct legal action against companies. 

Keicher, for one, thinks handing the enforcement power to the attorney general, particularly in cases involving the employees of a company using biometrics, is a good idea.

Keicher is hopeful that there will be some amendments to BIPA made by the time the legislative session wraps up in May. 

“I can't imagine we walk away at the end of the day without having some sort of accomplished guidepost of where this needs to go,” he said. 

But not everyone shares that optimism. Bills amending BIPA historically haven’t gotten very far.

“I'm fully convinced a company will have to be bankrupted by this for a change to be made,” said Mayette, the lawyer at Husch Blackwell. 

Keicher thinks that the current way BIPA is working in practice has gone beyond what the lawmakers who wrote the bill intended.

“I certainly don't think that the framers of the original bill would have wanted a $17 billion judgment against White Castle,” he said. “You can’t sell enough sliders to make that make sense.”

The artwork for this piece was developed during a Rhode Island School of Design course taught by Marisa Mazria Katz, in collaboration with the Center for Artistic Inquiry and Reporting.

Related Articles

Be real or be stalked? Privacy pitfalls of Gen-Z’s favorite app 

Isobel Cockerell

UK supermarket uses facial recognition tech to track shoppers

Frankie Vetch

The machine is inside you

Caitlin Thompson

The post Fingerprinting employees could cost Illinois businesses billions appeared first on Coda Story.

The premise of one of GenZ’s favorite new social apps is simple. BeReal sends a notification to your phone once a day, at a different time each day. “⚠️Time to BeReal ⚠️,” says the prompt, caution triangles included. You then have two minutes to share a picture of whatever you’re doing at that very moment, using both the front and back cameras on your smartphone. If your room is messy, too bad. It is only after you snap and post your picture that you can see what other users — whether they’re friends or random strangers — are doing that day.

When you select the “Discovery” tab, you can see exactly where complete strangers are at any given time. As I wrote this story, I could see a student studying for an exam in a village in southern Spain, a girl eating lunch in the Mariana islands in the South Pacific and the inside of a high school classroom in a French town on the Belgian border.

BeReal also lets you send a friend request to anyone who’s in your phone contacts — including people you may not want to see online or in real life. When my younger sister first showed me the app, it immediately reminded me of a jealous ex-partner who would demand to know where I was and who I was with at any given moment. How easy BeReal would make life for him, I thought. Gradually, if he was paying attention, he’d be able to build up a pattern. The city park where I take my solitary morning run, my favorite daily coffee spot, my bus route and my after-work wine bar — all could now be revealed on BeReal.

A viral tweet in October by the pop culture writer Engwari sparked a discussion of the same issue. “Am I crazy or does the BeReal app not seem like a stalker's wet dream to anyone else?” she wrote. “When I first found out how it works, it reminded me of those abusive partners who angrily/jealously text you ‘take a picture of where you are and who you're with RIGHT THIS SECOND,’” one person replied. 

Like many chat apps, BeReal strongly encourages users to sync their phone contacts with the app upon download. And while the default is private, BeReal encourages you to switch on the location settings when you post. What it doesn’t tell you is that this means your precise location, down to the square meter and even your longitude and latitude coordinates. Other apps like TikTok, Instagram and Facebook harvest and collect precise location data, but they don’t do it to this degree. On BeReal, unless you turn off the location settings, anyone following you can see exactly where you are and potentially find you. I spoke to a handful of people who had run-ins with stalkers due to these features.

Jem, a 22-year-old recent college graduate from North Carolina, kept her BeReal account private, but a stalker still found her profile through the contacts import feature. “I don’t have his number saved, in fact, it’s blocked. So it was shocking to see it would still recommend me as a friend,” Jem said. When she didn’t accept his request, he made a BeReal profile posing as one of her friends. “Because BeReal doesn’t show you friends’ lists or posts, I just assumed it was actually her and added her back. He then had access to my BeReal,” she said, describing how strange she felt once she realized he had been seeing her daily activity — and her precise location, which she had switched on. “Luckily he doesn’t live near me,” Jem said.

Until very recently, it was impossible to block someone on BeReal — which presented a serious problem for people facing harassment. You could report an abusive user, but this provided no guarantees. The other option was to unfriend them, but this wouldn't make you invisible, in the way that blocking might.

When Shomil Jain, a student at the University of California, Berkeley, noticed the app snowballing in popularity on his campus, he “did a little reverse engineering” and found something that scared him. On the app’s “Add Friends” page, BeReal gives suggestions for friends of your friends to add, similar to Facebook’s much-maligned “People You May Know” algorithm. Jain, who studies software engineering, was easily able to scrape the site and see an entire network of someone’s friends — and their friends’ friends. 

Without too much trouble, Jain found that it was technically possible to see the friends of pretty much every single user on the platform, including those who believed they were protecting themselves by keeping their posts private.

“The sheer amount of data that was exposed was pretty stunning,” Jain told me. “Facebook probably spent years building security around their friend graph, and these folks just casually made the whole thing available for the world to see.”

A BeReal spokesperson named Bryan told me he recommends people only add their close friends and family on the app. Bryan also said the company would soon be launching new settings that allow users to choose whether they prefer sharing an approximate or precise location with their followers.

“Unfortunately, all things of a social nature may attract ill-intended people,” he said. Indeed. In 2022, the app attracted all kinds of people — it topped 53 million downloads by the end of the year. The company, based in France, also raised $60 million in investment funding.

Founded by French tech entrepreneurs Alexis Barreyat and Kevin Perreau, BeReal first gained traction in French universities during lockdown in 2020. It then began snowballing on college campuses in Europe and the U.S. before breaking out into the world at large.

Silicon Valley venture capital firm Andreesen Horowitz staked $30 million on BeReal in 2022. Anne Lee Stakes, a partner at the firm, wrote a LinkedIn post last week hailing the campus strategy as an “experimental” and “iconic” technique combining “brute force,” word-of-mouth marketing with the student ambassador program. The company paid student ambassadors on campuses across the world “to spread the BeReal mission and support our growth.” At Harvard, students were invited to party at a burger joint and allowed entry and free food, provided they downloaded the app and added five friends.

BeReal doesn’t serve any ads or have a subscription model, so it’s yet to be seen how it will make returns for its investors. Sources close to the company told the Financial Times in September that investors were pushing BeReal to monetize and introduce new features to avoid becoming a flash-in-the-pan app like Clubhouse or House Party. A telltale sign that it’s caught on — and may become a real money-maker — is that other platforms are trying to emulate the premise. Instagram and TikTok have launched copycat plugins of the BeReal format, called “TikTok Now” and “Candid Stories.”

This all hinges on people’s willingness to really use the app every day. Unless you post something yourself, you can’t see what other people have posted that day either. This, the app’s makers say, is to discourage “lurking” — but it also pressures users to post each and every day, making it easier for anyone watching to build a more complete pattern of someone’s life. This could be your stalker. Or it could be a tech company looking to monetize people’s data.

This is a problem, said Jules Polonetsky, a lawyer and privacy expert and the CEO of advocacy group and think tank Future of Privacy Forum. “BeReal’s main legal risk is requiring its huge teenage audience to post a photo, or be blocked from their friends’ photos. This runs smack into privacy standards in Europe and California that require privacy by default for kids and teen services.”

Bryan at BeReal told me: “BeReal’s business model is not based on the monetization of its users’ personal data for the purposes of commercial profiling or targeted advertising.” But that leaves plenty of room for other kinds of data-driven profits.

“Clearly, you have to monetize something,” said Jon Callas, the director of public interest technology at the Electronic Frontier Foundation. While it may seem nice that these services are free of charge, “instead of paying for things in cash, we're paying for them in information.”

The coercive element of BeReal also caught Callas’ attention. 

“I thought it was a joke the first time I heard of it,” he said. What was the funny part, I asked him. “It’s using social coercion to say, ‘you have two minutes to drop what you’re doing and interact with social media.’”

Even the name “BeReal,” Callas said, added to that sense of artificial peer pressure — “because if we’re not doing this thing, we’re not Being Real. And who doesn’t want to be real?”

Related Articles

In South Korea, women are fighting to end digital sex crimes

Kenneth R. Rosen

Meghan never stood a chance against the internet

Isobel Cockerell

Stakes turn deadly as Iran’s government threatens the phone apps aiding protesters

Rayan El Amine

The post Be real or be stalked? Privacy pitfalls of Gen-Z’s favorite app  appeared first on Coda Story.

Globally, nearly three in four mobile SIM cards in use within cell phones are prepaid. They’re the lifelines that let shift workers know when to come into the workplace and when to stay home, enable mobile banking to take place and help people stay connected with friends and family, even if they’re hundreds or thousands of miles from home.

And every year, the GSMA shows the number of these countries rising. As of early 2021, it was 157 countries. They include Mexico, which in 2021 introduced rules that would help connect SIM card registration data with biometric information to create one massive database, and Kenya, which has lately compelled telecommunication providers to message users with threats to disconnect their devices if they don’t register centrally. They join the likes of China, Myanmar, Belarus, and Venezuela in the unenviable list of countries mandating registration — many of whom can commonly be described as authoritarian regimes.

In most of the world, if you use a mobile phone, you have probably handed a good deal of personal information over to whatever company provides your service — your name, address, date of birth, national ID or social security number and maybe a few other details. 

What happens to that data after you fill out the paperwork for your mobile plan, or buy a new SIM card? In more and more countries around the world, it goes to the government.

The latest adopter of this approach is a big one: the Philippines. In early October, president Ferdinand Marcos Jr. signed a new law requiring all mobile users in the country to register their SIM cards with telecommunications companies, using a government-issued ID. The law also requires Filipinos to use their real names when registering for social media accounts and provide a phone number. 

The situation is particularly acute in the Philippines because of its high cell phone penetration, Mong Palatino, a former legislator and Manila-based activist, explained. “The unique situation in the Philippines is that we have a population of 110 million, but we have about 120 million cellphone users,” he said. “The concern is not just about civil liberties, it's about disenfranchisement.”

Palatino worries that the laws, as designed, will penalize those who don’t register their SIM cards more harshly than those who misuse phones for the purpose of committing crimes. While the law isn’t yet implemented, it is in process — with an impact on everyday users when it is passed into legislation.

The Philippines joins a long list of countries that now require people to register with the government to gain access to basic communications tools. “I think it’s actually one of the less surprising trends,” Tanya Lokot, associate professor in digital media and society at Dublin City University, said. In many of the authoritarian countries that Lokot studies — including Russia and Belarus — mandatory SIM card registration has been in place for a decade or more.

The reasons why authoritarians impose SIM registration requirements are obvious, Lokot said: “If you can just buy a SIM card, without tying it in any way to your ID, it really frees you up in terms of what you can use that number to do.” 

By making registration mandatory, the theory goes, states discourage people from using their mobile phones to take part in protests, online opposition discussions or signing digital petitions — because those actions can then theoretically be linked back to them. The same argument is used by those who believe real-name policies on social media will help dissuade peddlers of hate speech or racism from spreading their comments online.

Not acting becomes a net negative for those trying to exert control over their population. Giving people the freedom of expression “for the authoritarian regimes is not a good thing, because their whole shtick is kind of trying to deepen the control over what their citizens do, and how they communicate,” Lokot said.

Linking a device to an individual is also helpful for regimes to be able to leverage hardware-based monitoring of citizens. 

“If [states] know that a number is tied to a particular person, it's much easier to do targeted requests for data or metadata, and then to basically track every step of whatever that person is doing using that phone number,” Lokot said. It’s all about triangulating movements and putting together the disparate pieces of an individual’s online and offline worlds, and official identification documents are one of the easiest ways to connect the two.

“It makes it easier for law enforcement to track and monitor people,” Damar Juniarto, executive director at SAFEnet, an Indonesia-based nonprofit focused on ensuring the safety of expression online and offline, said. “Now people have to give their identification, and in some countries have to register on a single submission platform.” Juniarto is particularly concerned about the impact on vulnerable groups like LGBTQ+ people. “They are coming out as gay or lesbian, and then the government knows these people are using these specific phone numbers, and can be tracked because of that,” he said.

None of this is theoretical: In Russia, which has some of the strictest monitoring of opposition because of the perilous state in which President Vladimir Putin rules, the government has been using mobile phone data to go after opposition activists and protesters. The Russian state has gained access to phone metadata from key protesters, investigating who they’ve been in contact with and using that to build linkages that identify networks of opposition who can then be silenced through targeted arrests and harassment, Lokot explained. It is very easy to follow the digital breadcrumbs into the physical world in a country where mandatory SIM registration with a government ID is required. 

“Usually, with the phone number, you have a passport. And with the passport, you have an address, or at least a place where that person is registered,” Lokot said. “It's really like a trail towards identifying —  and sometimes physically tracking down — a particular individual.”

That’s the particular concern of those who are opposed to the dragnet-style collection of data that comes alongside mandatory SIM card registration: that what could, in theory, be excused as a legitimate reason to collect information is used to tamp down dissent, and worse, shared among law enforcement agencies to enable the harassment of individuals who the state sees as a threat. Mandatory SIM card registration, and the associated data that stems from that — from passport numbers to call logs to home addresses — can then be used to build giant databases. “When you have all these things together, it results in there being huge troves of data that aren’t necessarily well-guarded,” Lokot said. Russia has a thriving black market for accessing data from government databases. (Every cloud has a silver lining: Russia’s porous data economy allows open-source investigation teams like Bellingcat to identify individuals accused of war crimes in Ukraine.)

While they are sometimes used to identify people accused of wrongdoing, these databases are also being deployed by common criminals to commit mortgage or identity fraud. “There's all sorts of concerns about the fact that the state is accumulating so much data,” Lokot said. “The key concern is that [the state is] using it to persecute people, but the other concern is that it's also not very good at keeping that data safe, and therefore it also is dangerous for ordinary citizens. If they don’t get in trouble for posting protest calls online, their data can still be misused.”

That’s in large part what worries those in the Philippines about the imminent arrival of their mandatory SIM card registration law. “The stakes are related to the high level of distrust in the government,” Palatino said. “We’re in a situation where law enforcement aggressively wage a brutal war with drugs, but are also accused of committing human rights violations with no regard for privacy and civil liberties. They’ll have a new tool with this law to get our personal information. Naturally there’s concern about it.”

Palatino also worries that the SIM card requirements “will open the way for other draconian legislation.” Days before we spoke, he read about a law proposed by a Filipino senator that would outlaw “fake news” — by which the legislator meant information with which they did not agree. “They want to criminalize anonymity on the internet,” he said. “It’s a reflection of our policymakers being divorced from what’s being experienced by ordinary users.”

The other issue at hand here is that if a country’s laws require retailers to check your ID before they’ll give you access to a cell phone SIM card, and you don’t have one, you can’t get a mobile phone at all. It’s disenfranchisement on a mass scale. Data from GSMA shows that around 14% of people in low and middle income countries don't have a national identification card. They are primarily women, the unemployed, people with disabilities and those with little formal education.

Of course, with mandatory registration in more than 150 countries and counting, it is easy to assume that the genie is not going back into the bottle. Mandatory SIM card registration is probably here to stay.

Juniarto is less defeatist. “I think it’s not too late,” he said. There are ways to lobby governments, if they’re beholden to requiring registration, to impose methods that help maintain people’s cybersecurity without impinging on their rights or disenfranchising them. He pointed to Estonia as an example of a country that has been a major innovator in digital governance, while not overreaching when it comes to linking government IDs with phone SIM cards.

Of course, authoritarian regimes looking to crack down on dissenting voices won’t adopt this kind of approach willingly. “We need regulatory bodies in the U.N., like the ITU [International Telecommunication Union], to introduce a new digital identity process that’s safer for everyone,” Juniarto said. “We need to import this model from Estonia, so everyone knows we have to protect the privacy of people.” It’s vital, Juniarto said, for a simple reason: “Protecting privacy means you’re protecting democracy itself.”

Related Articles

Western companies face withering criticism on how they exit authoritarian states

Caitlin Thompson

Life in Pakistan without a digital ID

Alizeh Kohari

Pakistan’s biometric ID scheme is stripping citizenship from thousands of people

Alizeh Kohari

The post Mandatory SIM card registration forces users to surrender personal data appeared first on Coda Story.

It’s September 23, four days after the Iranian government shut down the internet in the northern Kurdish city of Sanandaj. Not long after Mahmoudi and I spoke, the Iranian government blocked access to Instagram and WhatsApp (estimated to be used by 70% of Iranian adults) and shut down the internet for hours each day so that even basic communication, let alone work, became almost impossible.

The internet disruptions followed several days of nationwide, anti-government protests in response to the death of 22-year-old Mahsa Amini while she was in the custody of Iran’s vicious and widely reviled morality police. 

At least 76 people have been killed during the protests, human rights groups say, and over 700 arrested. The police said Amini died of a heart attack. But her father insisted she was healthy. Photos that emerged after her death were gut-wrenching: her eyes were purple and swollen. She appeared to have been tortured.

Mahmoudi is the executive director of United For Iran, a non-profit focused on human rights advocacy within the country that has built an application called Gershad, which first came to prominence in 2016, enabling Iranian women to warn each other about morality police in the vicinity. 

At the time, United For Iran kept their involvement in building Gershad quiet, but they have been open about the value of cell phone apps and web resources in helping to drive progressive change. One example is Nahoft, an app that enables Android users to encrypt their messages before sending them. (Over 90% of mobile phone users in Iran use the Android operating system.) Gershad has been a pivotal tool in this recent round of protests. Its Twitter account — where the group reposts some of the app’s reports on the Morality Police — has exploded, weekly impressions growing from 1,900 to nearly 1.5 million.

The shutting down of Iran’s mobile internet, though, has made the app largely unusable. Limited internet access has drastically narrowed who can use the application, leaving many still-active protesters vulnerable, echoing a similar shutdown in 2019 when an order from Supreme Leader Ayatollah Ali Khamenei demanded “Do whatever it takes to stop them.” In the two weeks that followed, close to 1,500 people were killed.

For protesters, a popular app like Gershad serves as a rallying cry, a way to keep spirits up and motivate people to come out onto the streets. This sudden freeze in activity has jeopardized that aspect of the app. “The silence leads to people thinking there's nothing else happening. So it kind of takes the wind out of the sails,” Mahmoudi says. “So people don't go out on the street as much and it kind of fizzles out. And then they kill us.”

When Gershad made its debut in 2016, it spread rapidly. “Within 12 hours, we had to get a new server,” Mahmoudi told me. The group had released the app with no advertising, yet it had a user base of 10,000 people within the first 48 hours. That kind of popularity quickly attracted the attention of the Iranian government, which banned Gershad and its APIs (application programming interface, the software that allows apps to talk to each other) within 24 hours of its release. 

The ban, intended to render the app useless to those who had downloaded it, was quickly circumvented by the development team — building functions into the interface that worked around the censorship. Even in the app’s infancy, its adversarial relationship with Iranian authorities seemed clear. The app was designed to help Iranian citizens retain some control, while the Iranian authorities appear determined to violently repress even the most minor displays of individual agency.

“I wouldn’t necessarily say the government is at the forefront of our minds,” Fereidoon Bashar, Executive Director of ASL19, a Canadian technology company focused on civil society and who heads Gershad’s software development, told me. “For us, it's mostly about how we can make the app more secure, more private, but that means the government is certainly an adversary.” 

Iran has a history of using technology to limit the freedom of its citizens. Early this month, Iranian officials announced that facial recognition technology would now be used to identify and fine women who weren’t adhering to the country’s rigid dress code.

Despite the adaptability and flexibility of the Gershad developers, the question for many Iranian developers is whether technology that is largely used to oppress Iranians can also be used to liberate them?

In 2018, for example, in response to Telegram’s growing popularity within the country, Iran banned the application and introduced Telegram Gold, which advertised new features and, most importantly, was actually available. The app became a user-data farm for the Iranian government, which quickly collected close to 14 million users’ private information. 

“If you don't have people familiar with the geopolitical situation on your team, then definitely your tools might be like a weapon in their hands,” said Amir Rashidi, director of digital rights at the Texas-based Miaan Group, which provides technical, legal, and research expertise to human rights organizations in Iran and the region.

Bashar, for much of our conversation, seemed barely able to bring himself to speak. Like Mahmoudi, he appeared exhausted and sad. “I’ve seen better days,” he admitted, as soon our call began. For him, his work on Gershad, despite its success and its value to the protests, was no substitute for not being there, for not being out on the streets and actively present.

“Maybe I don't think of it as guilt or maybe I should,” he sighed. “It's definitely a feeling that you're on the outside and there are people that are, you know, being violently brutalized and oppressed. It’s been hard to watch.”

“I don’t necessarily see the internet shutdown as something that concerns the app’s success,” he told me. “The consequences that follow internet shutdowns are faced by actual protesters and people.” 

Despite the shutting down of mobile internet services and the effect on daily life, Iranians have kept coming out onto the streets to make their anger heard. Reports emerging from Iran have suggested that the vans of the morality police — large white-and-green patrol vehicles from which officers kept their eyes on Iranian citizens, particularly women — have disappeared entirely.

Rashidi, who told me that the shutting down of the internet in Iran was his ”biggest fear,” acknowledged that the crowds of people willing to brave police brutality and prison had inspired hope in all those who imagine a less repressive future for Iran. “I mean, we had witnessed police brutality for a long time,” he said, “but this one was different. She was so innocent. There was nothing wrong with her dress and that basically fanned the flames of frustration. That’s why we're seeing all these protests around the country.”

Though experts continue to doubt that these protests will result in the overthrow of the Khamenei regime, the protesters have managed to change the debate. Previous protests had centered around the economy and electoral corruption; now culture and repression are the catalysts.

Mahmoudi told me she has a comment left for Gershad’s team saved on her computer. The message helps remind her that technology can still be a force for good: “Gershad is a successful example of channeling hatred and anger to underground tunnels without the need for leadership or the media. Every minute we are recreating the map of our city…together.” 

The message speaks to Gershad’s ultimate philosophy: it’s about the user base, it’s about collaboration and the lack of hierarchy or singular control, and it’s about access and agency.

“I really like that,” Mahmoudi said, smiling.

Related Articles

Women are the primary targets of Iran’s surveillance state

Frankie Vetch

Internet shutdowns gain popularity, and obscurity

Mariam Kiparoidze

Kazakhstan shut down its internet. These programmers opened a backdoor

Katia Patin

The post Stakes turn deadly as Iran’s government threatens the phone apps aiding protesters appeared first on Coda Story.

It was August 2020, and the young political asylum seeker from Uganda was about to walk out of the Imperial Regional Detention Facility in California, just north of the U.S.-Mexico border. Ssemanda eagerly took a shower and changed into a fresh set of clothes. He felt “joy and happiness” — a sensation that he was, at long last, “finally moving out.”

But then he saw the device: a black GPS-enabled electronic ankle monitor. Before Ssemanda was released, an employee at the detention center fastened the electronic bracelet around his leg, handed him a charger, and barked a few instructions at him about the device, a common tool used by U.S. Immigration and Customs Enforcement (ICE) to monitor migrants awaiting their immigration hearings. “If anything goes wrong, you’re coming back to the detention center,” Ssemanda recalled him saying. With the bulky monitor newly wrapped around his ankle, Ssemanda felt his mood lurch back to distress. 

“That is where my happiness stopped. That is the moment I regretted. I didn’t get that happiness of someone being free.”

The monitor gave Ssemanda his first scare a few days later when he flew to his new home on the East Coast. A few hours into the flight, his bracelet began beeping loudly, indicating that it was low on batteries. But Ssemanda had placed the charger in a checked bag. Mortified, he ran to the plane’s bathroom and hid there every time the device blared. “I was so uncomfortable, I didn’t want to attract people’s attention,” he recalled. When the plane landed, he couldn’t shake the worry that he had done something wrong, and immigration agents were on their way to scoop him up and put him back in detention.

“You feel like at any time, someone can come and grab you,” he told me. “You feel you cannot move freely. Like you are carrying a burden you can’t expose. I felt like I was a prisoner, inside another prison.”

Across the U.S., a surveillance system tracking the movements of tens of thousands of people seeking refuge or permanent residency in the U.S. is quietly but quickly expanding. The ankle monitor attached to Ssemanda’s leg is one piece of a program run by federal immigration officials known as “Alternatives to Detention,” (ATD) which places people in deportation proceedings and awaiting court hearings under electronic surveillance while their cases are pending. 

Authorities monitor ATD enrollees through three primary methods: the GPS ankle device; a telephonic reporting system that facilitates participant check-ins using voice-recognition technology; and an increasingly common mobile check-in app that uses facial recognition software. Although the program launched in 2004, the number of migrants placed under ATD has skyrocketed under the Biden administration. When President Joe Biden took office in January 2021, less than 90,000 people were in the program. Now, more than a quarter million people, including asylum seekers like Ssemanda, are enrolled in the digital surveillance system.

This is due almost exclusively to the adoption of the mobile facial recognition app, SmartLINK. Just a year ago, one-third of all immigrants under digital surveillance were on the app; now, it accounts for 75% of enrollees. It’s unclear how many of these people are asylum seekers. ICE acknowledged a public records request that Coda sent seeking data on this question, but the agency had not fulfilled our request at the time of publication. What we do know is that anyone on ATD — asylum seeker or not — can expect to spend more than a year under the government’s digital eye. The average person is enrolled in the program for 421 days. This trend shows no sign of slowing down. The Biden administration has requested $527 million in funding for ATD in the 2023 fiscal year, an $87 million — or 20% — increase from its 2022 budget. The company overseeing the program in partnership with ICE has the ability to monitor up to 400,000 people in its current contract, according to Axios.

ICE spokespeople and officials at the Department of Homeland Security espouse the technology-driven approach to immigration enforcement as a kinder, gentler alternative to physical detention. But for people like Ssemanda, there was nothing humane or gentle about the ankle monitor. It merely shifted the boundaries of incarceration from cell to self.

“You feel you’re in prison again,” he said, likening the bracelet to an electronic cage that hovered overhead as he tried to carve out a new life in the U.S. It was an unwieldy symbol of his tenuous place in America, a subtle threat.

The monitor also brought up the sensation of being tracked in the country he fled, Uganda, where he was kidnapped, beaten, and tortured for his advocacy against the government, mobilizing youth in support of democracy efforts. “I left my country because of certain kinds of problems I had, and then when I came here, I couldn’t believe that I’m the one having that bracelet. That I was facing this kind of situation in the U.S.”

“If they had told me that we are setting you out on the condition that you are going to have a bracelet, I would have told them, please, keep me inside,” he said. When Ssemanda caught up with friends who were still in detention, he would advise them to stay. “I told them, please don’t waste time moving out,” he added. “This bracelet, you won’t feel well. I’m outside, but I’m not okay.” The stigma attached to the ankle monitor, the anxiety produced by its beeps, the sensation that the government could be tracking his movements — it all weighed on him to the point he cried “tears of joy” when it finally came off after three months on his body, thanks to the successful appeals of his immigration attorneys.

Ssemanda’s experiences are consistent with findings from a 2021 report published by the immigrant rights groups Freedom for Immigrants, the Immigrant Defense Project and the Benjamin N. Cardozo School of Law. The study cited surveys of approximately 150 immigrants placed under electronic ankle monitoring, in which 90% of respondents said the device negatively affected their mental health, causing psychological harms ranging from anxiety to sleep disruption, social isolation, and depression. Twelve percent of respondents said the shackle led them to thoughts of suicide. Nearly 40% said they believed the monitor’s mental health impact was permanent.

Karlyn Kurichety, an attorney with the border-based migrant rights group Al Otro Lado, which provides legal support to asylum seekers, said ATD’s surveillance system has been “retraumatizing” for clients who have experienced government repression overseas. 

“We work with a lot of clients who are survivors of torture,” she said. “And oftentimes government surveillance in their country of origin was a part of the persecution or was something that led up to severe acts of violence against them.” Kurichety added: “[ATD] really serves no purpose other than just to harass and intimidate survivors, often survivors of violence who are exercising their legal right to seek asylum in this country.”

Roberto, a 36-year-old political asylum seeker from Latin America, said the monitor made him feel as though he was still in confinement. “That has a big impact and even more if you are running away from places where you weren’t free,” explained Roberto, who asked to withhold his country and real name due his ongoing asylum case. “You come from political persecution, running away from people who want to hurt you, from a system that wants to hurt you. And come here looking for help and shelter.”

He added: “The U.S. has been a role model for a lot of countries and if these solutions ended up in the hands of the dictatorships we are running away from, the impact would be truly negative. Imagine you are in a dictatorship and they put this ankle monitor on you for being opposed to the government. So I think the U.S. should think about this. Using these technologies and giving the idea of using them to other governments is a threat.”

The ankle monitor was stressful and psychologically burdensome for Roberto and even seemed to rub off on his young daughter, who recently told him she didn’t like the U.S. “I asked her why, and she answered that she didn’t like the monitor,” he said. “Even though she is 4, she can perceive that it is negative.” 

The latest iteration of ATD has shifted from ankle to face, thanks to SmartLINK, the mobile phone app that people are required to download and use for periodic check-ins with ICE. During check-ins, ATD enrollees must upload a photo of themselves, which is then matched to an existing picture taken during their program enrollment using facial recognition technology. The app also captures the GPS data of participants during check-ins to confirm their location. 

SmartLINK is expanding the boundaries of ICE’s digital monitoring system, this time from a wearable device to something that is less visible but ever-more ubiquitous. This expansion is taking place despite mounting concerns about the program’s negative effects on enrollees, and federal officials’ failure to provide adequate information about SmartLINK’s data collection policies and privacy safeguards. This is no small matter, especially given SmartLINK’s corporate origins. Along with the rest of ATD, SmartLINK is run by B.I. Incorporated, a cattle tracking-turned-prison technology firm and a subsidiary of the private prison company the GEO Group, which operates more than 100 state and federal prisons, detention centers, and other facilities nationwide.

Since the ATD’s inception during the Bush era, B.I. has contracted with ICE to provide its surveillance technology. ICE’s most recent contract with B.I., signed in 2020, allocates $2.2 billion to the company over a five-year period. Critics argue that B.I.’s partnership with ICE creates a financial incentive for the expansion of mass immigrant surveillance. They also say that it contradicts the government’s argument that the program is a genuine “alternative” to detention, given that the company earning the government contract for ATD technology is a subsidiary of one of the nation’s primary for-profit detention providers. 

Jacinta Gonzalez, ​​senior campaign director for Mijente, a group that campaigns against the use of surveillance in immigration enforcement, underlined this point. “To now have the same companies that have been in charge of private detention centers basically shapeshift and now pretend that they're the market for alternatives to detention, and promote that in a way that is really kind of expanding the surveillance web that is in the power and in the hands of ICE, is incredibly concerning,” she said. “It is marketing by a company that is just trying to continue to make a profit off of human suffering.”

“We don't really see these as a true alternative or really any alternative at all because they are still, in essence, punitive. They're surveilling people and restricting their liberty,” explained ​​Layla Razavi, interim co-executive director at the nonprofit Freedom for Immigrants. She added: “Alternatives to detention is a phrase that first started being used over a decade ago by advocates to talk about what a vision would look like for a world in which we didn't have immigration detention centers, but instead were welcoming in supporting newly arriving immigrants into this country. And that phrase, as it began to gain steam among the immigrants rights movement and advocates, started to become co-opted by the very private prison companies that were advocating and lobbying the federal government directly for increased resources.”

There has been some pushback to the ATD’s rollout in Washington — more than two-dozen House Democrats recently sent a letter to DHS Secretary Alejandro Mayorkas, expressing concern with the program. But the general attitude within the administration seems to be enthusiastic about the tech, said Rebekah Wolf, policy counsel at the D.C.-based nonprofit American Immigration Council. “There is certainly a sense in the administration that there is no appetite for release without some form of surveillance, and so that’s why they are so dramatically increasing these programs. The impression is that this is the only way that they could ever make gains or move forward on some of their promises in reducing detention and restoring asylum at the border.”

Some speculate that the government has turned to SmartLINK because it is vastly more scalable — anyone with a smartphone can download the application and use it — and likely cheaper to implement than placing tens of thousands of people on a GPS tracking ankle bracelet. Julie Mao, deputy director of the immigrant rights legal firm Just Futures Law, which focuses on the intersection of immigration and technology, recalled working as an immigration attorney in Louisiana in 2014 amid an increase in border crossings. “That’s when we really saw an explosion of ankle shackles happen,” she explained. “I think we’re at a similar inflection point now.” Mao added: “I suspect they are reaching their supply limit for ankle shackles. The logistics of shipping ankle shackles back to the border, ankle shackles breaking, needing to resupply. That is costly and difficult compared to just downloading an app.”

Politically, it’s not hard to see why this would be an appealing approach to Biden administration officials, as Republicans’ bullishness on immigration has long left Democrats on the defensive. Shifting the geography of detention to the digital sphere puts liberal politicians in a different place on the continuum of immigration enforcement, giving them a new narrative, one in which they can fend off attacks from the right of being “soft” on the border while also claiming to take a more “humane” approach than their Republican counterparts.

Surveillance technology is inherently difficult to visualize and illustrate. “It effectively depoliticizes the technology because people can't get it in their heads,” said Austin Kocher, an assistant professor focusing on U.S. immigration enforcement with the Transactional Records Access Clearinghouse (TRAC), a research center based at Syracuse University. He continued: “Whereas the Republicans want very simple ideas and very simple concrete material things that are very easy to point to and mobilize around. Democrats are much more effective at sort of depoliticizing these technologies through their diffusion in society.”

The government has made little information publicly available about SmartLINK’s privacy and data collection policies. Since B.I. is a private company, it is not subject to federal public records laws.

Advocates have tried, and failed, to get more details about SmartLINK from the federal government. In September 2021, a coalition of immigrant’s rights groups filed a Freedom of Information Act (FOIA) request with ICE seeking information “pertaining to the collection of data from the SmartLINK application, the retention, sharing, and use of such data, and the nature of monitoring through the application.” ICE never responded, and last month the organizations sued the agency under FOIA to try to obtain the information.

The lawsuit alleges that BI’s privacy policy for SmartLINK “allows for extremely broad collection of data,” and points to language in the policy, which states that the app collects  “individuals’ names, contact information, social security number;” “information such as facial images from photos and voice samples from audio files;” “[g]eolocation data about physical movements and location;” and “App activity and other usage activity such as Internet and similar network activity.”

Julie Mao of Just Futures Law, one of the groups that submitted the records request and is involved in the FOIA litigation, said she and other advocates are concerned that ICE “has not provided oversight over the contracting company that it’s using.” The agency and BI, she added, “are hiding the ball on what data is being collected on individuals.” In addition to Mao’s concerns about the app’s data retention and collection policies, there is a lack of clarity about whether the data collected via SmartLINK is accessible to other government agencies.

When Coda inquired about these practices with B.I., the company referred us to ICE. A spokesperson for the agency did not address questions about the app’s data collection, retention, and sharing policies, but stated that ICE is “committed to protecting privacy rights, and civil rights and liberties of all participants within the Alternatives to Detention Program.”

According to a fact sheet about ATD on GEO’s website, “All data collected through [electronic monitoring] is the property of ICE, not GEO or BI. Any biometric information collected through technology tools resides solely on the participant’s electronic device and is not transferred, transmitted or downloaded to any other device or system.” The company cites an excerpt of B.I.’s contract with ICE, which stipulates that “the Contractor shall not retain, use, sell, disseminate, or dispose of any government data/records or deliverables.” It also states that B.I. “complies with all federal privacy laws” but this doesn’t mean much in the U.S., where there is no comprehensive federal privacy legislation. One page on the website promises that B.I. “does not track individuals, collect background data, or conduct any ‘surveillance’ activities,” while another limits this pledge solely to “‘surveillance’ activities.”

In 2019, ICE told the Congressional Research Service that SmartLINK does not monitor SmartLINK’s enrollees’ locations through their phones “as a GPS monitor would” and only gathers location data during participants’ check-ins. But Mao noted that the application has the technical capability to monitor enrollees’ locations in real-time. People in ATD have expressed fears that the app is monitoring their whereabouts beyond the designated check-ins. 

“Our concern is that this program is being used as this mass surveillance control system for immigrants,” she said.

The privacy policy for SmartLINK offers a more detailed picture than what appears on the GEO website, including a long list of data that the app does collect — location data, photos and videos taken through the app, audio files, voice samples, and audio messages sent through the app, and information about a user’s device, including IP addresses and other unique identifiers. The policy acknowledges that third parties “may use automatic information collection technologies to collect information about you or your device.”

When Coda Story contacted B.I. for comment on the above policy, the company confirmed that the March 2022 document is up to date. Mao said the policy “confirms that BI is collecting a tremendous amount of sensitive data through its mobile application and sharing that information with third parties.” This is no small matter — independent research has shown that when this kind of data is available to third parties, it can be incredibly easy for anyone, from digital marketers to government agencies, to pinpoint a person’s identity and gather an enormous amount of information about their behavior.

And ICE already has access to a bulk of Americans’ data. An eye-opening investigation from the Georgetown Law Center on Privacy and Technology recently found that the agency has built a sweeping national surveillance apparatus that has the ability to spy on most people in the U.S. by accessing state and local government databases and purchasing data from private data brokers, which package and sell peoples’ data for profit.

Like most technologies, SmartLINK doesn’t always work like it should. Problems like service outages or a phone falling into the toilet, that would normally just be cause for frustration, can trigger a deep sense of dread for enrollees, as can simple malfunctions. Juan, a 24-year-old asylum seeker from Central America, has been on SmartLINK for the last year. Before that, he was placed on an ankle monitor. One afternoon, he attempted to submit a photo of himself for his weekly check-in, but he couldn’t tell if the upload had successfully gone through. Shortly after the scheduled check-in, an employee overseeing the check-ins with B.I. called Juan and told him to upload a new photo on the app, which Juan did.

A few minutes later, Juan got another call, this time from a different employee. This person had a harsher tone, Juan recalled, asking why he didn’t take a picture, and telling him that his failure could result in a penalty. The remark upset Juan, who told him he intended to call his lawyer. “You can talk to your lawyer, the president, it doesn’t matter to me,” the employee replied. Juan instantly worried that a technical mistake made with the app could lead to serious consequences and even his possible re-detention. So, he explained, “I had to put my head down and do as he said.”

He added: “Sometimes I asked myself, why is there all this monitoring? So many photos, so much information. I think this is a question that not just me, but everyone in the program is asking. It makes no sense. As migrants, they act like we are criminals, risks to the community. But we are not.”

Juan is not the only person for whom SmartLINK’s technology has proven stressful. Some users have taken to expressing their frustration with the app’s functionality on the App Store, where SmartLINK has a 2.8 rating. In reviews, multiple users state they had trouble logging into the app and uploading photos and location data. “When I try to log in, I have to make 3 attempts every time,” one wrote. “Then today I never got the alert that I had a check-in. This is a pretty major flaw when your freedom relies on it.” (GEO disputes claims that the app routinely malfunctions, writing that “an average of 88.4% of SmartLINK check-ins were completed successfully over the last five years.”)

A report published this week by a coalition of immigrant’s rights groups found the app’s check-in process is emotionally taxing for enrollees and fears of constant surveillance trigger anxiety. The study published testimonials from 11 people on ATD. One respondent, who came to the U.S. from South Africa, said “SmartLINK reminds me of Apartheid in my country. The constant harassment by police everyday because you’re a member of a certain political party.”

Carlos, 39, has been on SmartLINK for about a year. He described the app as “the same” as the ankle monitor. “Physically, it’s different. But it’s the same uncertainty, worry. The only thing that changes is the system.” Carlos believes ATD’s surveillance has affected the psychological well-being of his entire family, including his three teenage daughters. He describes it as a “shadow” that hangs over the family. “Every time I get a call from an unknown number and they see it, they think that it’s from ICE asking me where I am. It’s the same fear.”

When it comes to migration, the turn to technology as the more “humane” way to enforce policy has followed a predictable narrative pattern. Criticisms arise with the status quo; new tech crops up to address said concerns and save the government money, and then the process repeats itself.

Each fork in the road to a digitally-enforced border and immigration system, however, beckons unintended consequences. Technologies first used on immigrants become susceptible to “mission creep” and later expand to other people and areas. “We know that oftentimes surveillance technologies are first used on marginalized populations at the border, against immigrant communities as a means of surveillance and then spreads to other places as well,” said Saira Hussain, a staff attorney at the Electronic Frontier Foundation, a nonprofit focused on digital privacy and surveillance.

Last year, Coda reported on communities that are subjected to constant technological monitoring along the U.S.-Mexico border. A resident of a town in Southern Arizona enveloped by surveillance technology said the area’s digital infrastructure made her feel “paranoid” about privacy and government intrusion and influenced how she moved around town. During the 2020 protests held in response to the police killing of George Floyd, CBP deployed drones to more than a dozen cities across the U.S., which logged hundreds of hours of video footage in a digital network managed by the Department of Homeland Security and accessible to local police departments.

Mario Perez, whose experience in detention led him to become an immigration organizer and activist, was on SmartLINK for three years. He began to worry about the data the app collected on him after learning of an ICE raid at a poultry plant in Mississippi. Nearly 700 people were arrested, thanks in part to data that authorities had captured from workers’ GPS monitors. Headlines about the raid made Mario wonder about the kind of access immigration officials had to the data on his phone. “It just seems like it’s a mess,” he said. 

“With reports about general surveillance in the U.S. and general American citizens being surveilled by ICE, if this isn’t worrying everybody — I don’t care if you are an immigrant or under one of these programs — this is just getting started from what we’re seeing. We don’t know far this is going to be taken. It’s really scary.”

Related Articles

Greece aims long-range sound cannons at migrants across its border

Isobel Cockerell

Between the US and Mexico, a corridor of surveillance becomes lethal

Erica Hellerstein

How San Francisco police surveillance closed in on Black Lives Matter protests

Caitlin Thompson

The post ‘I felt like I was a prisoner’: The rapid rise of US immigration authorities’ electronic surveillance programs appeared first on Coda Story.

This decision has become urgent in Myanmar, where the Norwegian telecommunications company Telenor has been trying to untangle itself from the country since the junta seized power in a coup on February 1, 2021. In doing so, Telenor is torn between selling its Myanmar subsidiary quickly or protecting the millions of users whose data could end up in the hands of the military.

Now the company faces a new hurdle, one that could have broader implications for how European companies do business in illiberal countries. 

On February 8, an anonymous Myanmar citizen and a Norwegian law firm filed a complaint with the Norwegian Data Protection Authority alleging that Telenor’s sale violates Europe's General Data Protection Regulation, or GDPR, which applies to countries in the European Economic Area, which includes Norway. The complaint asks Norway’s state  privacy agency to investigate and intervene to ensure that the sale does not violate the right to privacy of its customers and put them at risk of exposure to military surveillance.

If successful, the GDPR complaint would require Telenor to delete or anonymize the data belonging to its 18 million Myanmar customers before selling its Myanmar subsidiary. In doing so, it is poised to set a precedent for how European companies operate inside authoritarian regimes.

The tussle over Telenor's exit from Myanmar is a microcosm of the struggle facing many executives at Western corporations interested in acting at least with a minimum of responsibility inside countries which challenge that impulse at every turn.  

“What we are hoping to bring across to Telenor is indeed that it's not not a question of wanting them to stay and continue to serve in that environment, but to act responsibly and act legally," said Ketil Sellæg Ramberg, a privacy and data security law specialist at SANDS, the Norwegian law firm that filed the GDPR complaint.

WHAT IS TELENOR AND WHY ARE THEY SELLING? 

The Norwegian government is a majority shareholder in Telenor Group. It’s subsidiary, Telenor Myanmar, is the second largest telecoms firm in the country with a population of over 54 million people. 

Telenor has been trying to exit Myanmar because of military pressure to install intercept spyware that would give authorities a straight line of access to users’ information, which would violate Norwegian and EU sanctions.

Installing the intercept tech is “unacceptable” and “would constitute a breach of our values and standards as a company,” said Telenor Group in a press release in September 2021. 

The likely buyers for control of Telenor Myanmar's data are M1 Group, a Lebanese company with a history of doing business in authoritarian countries like Syria and Sudan, and Shwe Byain Phyu Group, a group of  Myanmar companies with ties to the military involved in gem mining and petrol stations, The sale is expected to be finalized on February 15. 

Human rights groups in Myanmar are strongly opposed to the new buyers. The lives of civil society activists and journalists are “endangered by this secretive sale to a military-linked conglomerate,” said Yadanar Maung, the spokesperson for the human rights group Justice For Myanmar. 

“We are also concerned that Shwe Byain Phyu is a front for the junta, who want control of Telenor as a source of revenue, at a time when they are desperate for funds to finance their campaign of terror,” Maung added.

WHAT’S AT STAKE? 

The junta has extensive control over telecoms companies in Myanmar. By law, the government can request user data without a warrant, intercept communications or take control of telecoms services in “emergency situations.”

This data is valuable to the military, which has been carrying out a brutal crackdown since it staged a coup that has  killed over 1,500 people, according to the human rights group Assistance Association for Political Prisoners. 

Authorities can use phone records and mobile payment receipts to map out pro-democracy networks, identify who is providing financial support to opposition groups and ultimately, target activists and squash dissent.

“They want it to crush the opposition,” said Oliver Spencer at the human rights group Free Expression Myanmar. “They want information about who’s criticizing the military and who’s organizing the military. And the Norwegian company owned by the Norwegian people is about to hand that information over.”

According to reporting by Myanmar Now, Telenor has complied with at least 200 requests for information by the junta-controlled Ministry of Transport and Communications since the coup. Some of these requests were for sensitive data, like the last recorded location of a phone number. 

Despite this, Telenor does stand out as the most sensitive to data privacy concerns in a country where the junta has significant sway over the other two leading telecom options, said Spencer. 

Telenor is “far better than their competitors in regards to the protection of data and therefore their users’ privacy. Without a doubt, they were far better,” Spencer said. 

It’s not a high bar. The Myanmar government runs 50% of MPT, the largest telecoms provider. Another firm, Mytel, is owned half by the Myanmar military and half by the Vietnamese military. Mytel or MPT SIM cards are likely being monitored.

If Telenor leaves the market, people “will all be forced to use companies that are directly or indirectly controlled by the military. Then, of course, the military has access to everything that flows through those telecoms pipes,” Spencer told me.

WHAT’S THIS GDPR COMPLAINT ALL ABOUT?

A GDPR complaint is a consumer’s tool to hold European companies accountable for how their data is used and protected. 

The major concern behind the complaint against Telenor is that, without proper privacy safeguards, the data of millions of users will be subject to surveillance by the junta in Myanmar, exposing activists, journalists and citizens and putting their safety at risk.

The use of GDPR in this context is unconventional. The privacy law is designed to protect EU residents and citizens, and it is rarely applied to international subsidiaries. But Ramberg, the law specialist at the firm that filed the complaint, argues that Telenor Myanmar is bound by GDPR because Telenor Group, based in Norway, has sufficient control over the company. “This actually has real life consequences for real life people,” said Ramberg, “This endangers people’s right to speak freely about issues that might not necessarily be in line with the dictatorship.”

The company disagrees, stating that Telenor Group “does not exert any control on the handling of customer data by Telenor Myanmar, and therefore GDPR does not apply to customer data in Myanmar,” wrote director of communications Cathrine Stang Lund.

Related Articles

Myanmar sets a dangerous precedent with the new draft of its cyber security bill

Caitlin Thompson

Digital insurgents rally against Myanmar’s military junta

Burhan Wazir

Myanmar prepares for military to ratchet up control of the internet

Burhan Wazir

The post Western companies face withering criticism on how they exit authoritarian states appeared first on Coda Story.

Another, more recent example, was when I found out that I had been swept up in one of Georgia’s biggest political scandals in a decade. Earlier this month, a massive data leak revealed to the nation that state security services had been secretly monitoring the electronic communications of hundreds of journalists, politicians, diplomats, high-ranking members of the clergy — and me.

So, why did a 19-year-old woman, fresh out of university, working her first job at a nightclub, become a target of Georgia’s security services? 

The answers to that question point not just to what Bassiani is, but what it means to many young Georgians. For us — living in a former Soviet country, strongly influenced by the conservative ideologies espoused by older generations and the powerful Georgian Orthodox Church, where LGBTQ people face daily oppression — it was much more than just a club. It was a safe space, where everyone was equal.

I can recall the first time I went there vividly.

I spent pretty much every weekend at the club. Then, in 2017, the founders asked me to join their team. I love music, I’m always on the hunt for what’s new and exciting, and I jumped at the chance. I became the manager of Bassiani’s record label, and handled bookings and promotions for the club.

I thought it would be a cool job. And it was. 

But Bassiani faced regular attacks from right-wing political and religious groups. They started spreading lies about us, saying that we were performing bizarre rituals in the club and selling drugs. Soon pro-Russian groups started attacking us online, calling us “drug addicts,” “gays” and “whores.” One Facebook post in particular went viral, in which a man alleged that a strangely dressed woman could always be found standing near the club’s toilets holding a basket full of drugs that she handed out to anyone passing by. 

The rumors and innuendo turned into an outright attack in 2018, when the police raided Bassiani. In the previous few weeks, five people in Tbilisi had died in their homes after taking adulterated MDMA, bought from a Russian dealer on the dark web. That was all the reason the Georgian police needed to target the club, even though there had been no fatalities on our premises. 

May 12 was just a regular Friday club night, until police clad in riot gear barged in. They pointed guns at dancers and at the DJs who were playing, made us turn off the music, kicked us out and shut down the club. Later, news reports said hundreds of people were arrested. I remember my mom calling me frantically, then rushing to the club to find me.

It’s clear that the raid was a show of power by the government, staged to demonstrate exactly what it thinks of progressive people and their beliefs. So, the next day, we pushed back and announced a rally in front of the parliament building. We set up massive speakers and started playing music. Over 10,000 people showed up. It was one of the best raves of my life — thousands of people dancing in the heart of the city.

The square in front of Georgia’s parliament is the heart of the country’s political life. It is where every protest of any significance has ever taken place. Previous generations had occupied it to demand independence from the Soviet Union. At the Bassiani protest, my generation found the voice it needed to speak up for its freedoms.

Bassiani was closed for a month while the authorities rifled through the club’s business documents. They found nothing to incriminate us and were left with no choice but to let us reopen. I should, however, have known that the matter would not end there. 

I found out that my phone had been tapped just over a year before the leaks made such information public. In July 2020, a few months into the Covid-19 crisis, I received a call from an unknown number. Like so many other businesses, Bassiani had closed in March, and I had left my job to explore other opportunities. I was in my garden at the time and wondered who was ringing me.

It was the police. 

A man told me that officers had been listening to my phone conversations for the entire summer of 2018, starting from the raid on the club in May. I was frightened and enraged. What had I done to be spied on like this? 

The man said that the police had monitored my phone for three months before shutting down the investigation. They didn’t tell me what they found or what they had done with all the information they had gathered. But, two years later, in the middle of a pandemic, I was being summoned to a police station to sign a document stating that I had been informed that I had been placed under police surveillance.

I remember calling my friends who had also worked at Bassiani. Many had received a similar call. I spoke to my uncle, who is a lawyer. He told me there wasn’t much I could do, except sign the paperwork. 

Months later, the stress of this revelation still hasn’t left me. I don’t remember what I said on the phone back then, whether they were reading my messages and listening to all my calls. I feel like I have no privacy anymore, that someone is still listening to me and watching me whenever I use Facebook, send a WhatsApp message, or speak to anyone on the telephone. Many of my friends feel the same way. And with good reason.

In October this year, I realized that Georgia’s snooping went much much deeper than Bassiani. An anonymous whistleblower leaked thousands of documents online, detailing how the nation’s security services had been systematically spying on a wide range of public figures, from prominent news reporters to foreign diplomats.

The scale of the surveillance was so immense that even Georgia's public ombudswoman, Nino Lomjaria, was taken aback. "We live in a terrible country," she said in an interview broadcast on national television in September. "I could not imagine this kind of monitoring."

Bassiani has been closed for a year-and-a-half now. I miss it deeply. Growing up and going to school, I always felt like an outsider. I was a rebellious kid, who had problems with teachers and some of my fellow students. I felt different from them, showed it in my own way and was bullied for doing so. Bassiani was one of the few places where I have felt at home.

That’s why the rave outside parliament felt so momentous, and why the subsequent surveillance felt so intrusive. It wasn’t just clubbers who were there — our parents showed up, as did every other person who wanted to protest against the government’s decision to raid a nightclub and demonize its patrons. I think we showed them that we weren’t alone and that we have a little bit of power too.

Photos by Hitori O.G

As told to Harsimran Gill  

The post I was 19 years old and working at a nightclub — then I got caught up in a government phone-hacking scandal appeared first on Coda Story.

Green, the executive director of the trans rights nonprofit TransWave Jamaica, had been following the twists and turns of a years-long political effort to roll out a digital ID system that would provide Jamaicans with a national identity card while collecting their personal information and biometric data. The latest attempt would require any Jamaican who wants to apply for an ID to give authorities documentation showing their sex assigned at birth, which would be displayed on the back of the card.

Green fears that this requirement could create considerable risks by “outing” trans Jamaicans who don’t identify with their sex assigned at birth, exposing them to possible discrimination and violence while they use the card in their daily lives. 

“For a lot of trans people who are in the process or have transitioned, they just want to be able to exist and go about their business. What that looks like for a lot of people is not having to disclose their trans status,” she said. “The bill opens us up to be outed.”

The bill gives only a binary choice to Jamaicans whose gender identity does not correspond with the sex on their birth certificate: Put it down anyway or opt out of the system entirely. Green, who identifies as trans, said she would choose not to enroll in the system as it is drafted and suspects that other trans Jamaicans would follow suit. “I’m pretty sure people will choose not to get it because of the requirement,” she said. “It’s a risk to our lives.”

Green’s objections to the bill are part of a wider range of concerns — from privacy to human rights — surrounding the island nation’s biometric National Identification System (NIDS) as it heads into a likely vote in Parliament this month. 

Jodi-Ann Quarrie of the human rights organization Jamaicans for Justice explained that neighboring governments, keen to introduce their own digital ID programs, will also be keeping a close eye on the NIDS over the next few months. “If it passes, we know that this will be the draft legislation for most other countries across the region,” she said.

The draft legislation calls for a wholesale sweep of personal data. Under the bill, residents will be asked to submit a wide range of biographic and biometric information — name, nationality, occupation, marital status, facial image, fingerprints, sex, and signature — in order to be issued with a digital ID card. The current draft bill also suggests that Jamaican authorities may request additional data, such as driver’s license, passport, birth registration, and taxpayer numbers. The document does not explain how any of the information will be stored or secured.

The proposed bill is just the latest attempt by the Jamaican government to roll out the NIDS. In 2019, the Supreme Court struck down a law passed in 2017 that required all citizens to enroll, concluding that it violated the privacy rights of residents. A revised version of the law, which changed the enrollment requirement from mandatory to voluntary, was reintroduced in 2020 and is expected to pass by the end of the year.

Supporters say the bill’s primary aim is to provide identity documents to Jamaicans who currently lack them. But critics believe that it falls short of providing clear privacy safeguards. They also argue the request for personal information could dissuade certain populations from applying for the ID, including trans Jamaicans or people experiencing homelessness who do not have a fixed address.

Green said an earlier version of the draft bill didn’t ask for Jamaicans’ sex assigned at birth, but that changed in the newest version of the proposal in July. When Green saw that had been tacked on, she felt disappointed. “I thought we were taking a step in the right direction in terms of not having it on the document,” she explained. “To me, it’s not necessary.” 

Groups outside the island are also monitoring the legislation to see how it influences other countries in the region. Verónica Arroyo works for the digital rights group Access Now, which is part of a coalition of local and international organizations that have voiced concern over the draft bill. She says that conversations about new digital ID systems are already underway in neighboring Barbados, St. Lucia and the Dominican Republic.

“They will gather all of this information and there is no moment where you have the power as a citizen to decide, ‘I don’t want the government to have this,’” Arroyo said. “There is not enough clarity on how the government will handle this data. Nothing in the bill that can give us any guidance.”

While the Jamaican bill stipulates that digital ID enrollment is voluntary, Arroyo and Quarrie fear that it could end up as a functionally mandatory system. Both believe that the system has the potential to prevent people who have not signed up from accessing vital social services — a concern borne out in research examining the impact of digital ID systems in other countries around the world. 

“Though the law may not say it’s mandatory, everything you do will require it,” Quarrie said.  

Quarrie also flagged data protection and security concerns, pointing to a recent data breach by a government contractor that left the immigration documents and coronavirus test results of hundreds of thousands of travelers to Jamaica exposed on the open web. “This is the same government that will be controlling NIDS,” she added.

The bill is currently before Jamaica’s parliament, which will reconvene from recess in early September. Quarrie says she expects to see the legislation passed by the ruling Jamaica Labor Party by the end of the year.

If NIDS moves forward, Jamaica would become the latest addition to a growing list of countries with digital ID laws, including India, Bangladesh, Ethiopia, Afghanistan, Kenya, Colombia, and Nigeria.  

Many of the ID schemes have come under attack by privacy and human rights groups. A June 2021 study of Uganda’s digital ID law by researchers with the Center for Human Rights and Global Justice at New York University found that the system “has become an important source of exclusion for the poorest and most marginalized,” barring millions of people — up to an estimated third of the adult population — who did not yet have the identity card from accessing public services. 

Other research has found digital ID systems in Bangladesh, Ethiopia, Nigeria, Zimbabwe and Thailand, can expand surveillance of already vulnerable populations and prevent them from obtaining cards due to their lacking the identification documents required to sign up.

The World Bank has thrown its weight behind digital identification systems, contending that they “can unlock opportunities for the world’s most vulnerable.” In 2019, the Inter-American Development Bank also approved a $68 million loan to the Jamaican government to develop NIDS.

But in addition to international development organizations, a number of voices within the private sector, including financial services providers and telecommunications operators have expressed enthusiasm for digital identity systems. “It is seen as the first step toward building a digital economy, and that supposedly has a lot of positive knock-on effects,” said Christiaan van Veen, a director of the Digital Welfare State and Human Rights Project at NYU School of Law.

Van Veen, who studies the global impacts of digital ID systems, says that Jamaica is “a test case” for other countries.

“You see policymakers and other governments looking at those processes and basically learning, what would it mean if I were to do the same thing in my country?” he said. “It’s a bit of a proxy fight for what will happen in other countries. Where the chips will fall will matter for what other countries will do.”

The post Jamaica is poised to end data privacy appeared first on Coda Story.

Police showed Williams a blurry surveillance photograph taken during a robbery. It wasn’t him. “The cops looked at each other. I heard one say that ‘the computer must have gotten it wrong,” Williams told lawmakers on July 13, during a hearing on law enforcement’s use of facial recognition. 

Williams, who is Black, had been incorrectly identified by facial recognition. 

“It was so backwards,” he said. “I thought I knew the law, and I was wrong.”

The U.S. federal government has not limited law enforcement’s use of facial recognition. The hearing at the House Judiciary Subcommittee on Crime, Terrorism and Homeland Security was tasked with exploring what to do about that.

Why is Congress considering regulating or banning facial recognition? 

Robert Williams is not alone. Research shows that facial recognition is particularly bad at correctly identifying people of color. 

Alongside concerns over bias and accuracy, there is an ongoing national conversation about how facial recognition fits into a broader picture of over-policing communities of color.

“I don't want anyone to walk away thinking that if only the technology was made more accurate, its problems would be solved,” said Williams, in his written testimony to the subcommittee. 

Facial recognition frequently operates in secret. Often, people don’t know it was used in a police investigation, leaving them unable to challenge it. The U.S. Government Accountability Office, a watchdog agency, found that 20 federal agencies used facial recognition with virtually no oversight. 

However, public opinion on facial recognition is mixed. While 55% of Americans think the government should limit police use of the technology, 65% don’t support an outright ban, according to a 2019 survey by independent research body the Ada Lovelace Institute. 

What are the U.S. laws now? 

There is no nationwide regulation of facial recognition. Guardrails are enacted only at a state, county or city level. In May, Massachusetts imposed one of the first statewide restrictions on police use of the technology. California placed a three-year moratorium on using it in police body cameras. Cities including San Francisco and Portland, Oregon have banned it entirely.  

However, national attempts to regulate facial recognition have repeatedly failed. Last year, the Ethical Use of Facial Recognition Bill did not make it past introduction in the Senate. The 2020 Facial Recognition and Biometric Technology Moratorium Act met a similar fate.

It has also fallen on companies to self-regulate. Amazon and Microsoft have promised not to sell facial recognition to police, while IBM has abandoned its facial recognition products. 

Is there a bipartisan appetite to curb police use of facial recognition?

Seems like it.

Representative Andy Biggs (Republican, Arizona), the subcommittee’s ranking member, said that even if the technology works properly, it remains problematic. 

“I think the issues which we've discussed today are not just issues with the accuracy of the technology. I think we're talking about a total invasion of privacy, which is absolutely unacceptable,” he said. 

Albert Fox Cahn, a privacy expert at the privacy advocacy group Surveillance Transparency Oversight Project, is hopeful that lawmakers are moving in the direction of an outright ban.

 
“People clearly know that Congress has waited too long. I think there are some people who still are using the language of regulation, but when you actually dive into the details of what those regulations look like, a lot of the time, it's closer to a moratorium than anything else,” he said. 

What would federal regulation even look like?

Some lawmakers, like Representative Ted Lieu (Democratic, California), acknowledged that a ban will be difficult. Representative David Cicilline (Democratic, Rhode Island) weighed whether any amount of regulation would solve the problems with bias and inaccuracy. 

“Is there even any training that might help law enforcement to overcome these inaccuracies, or are they so embedded in the system that we should ban facial recognition?” asked Cicilline.

Other lawmakers questioned whether a warrant should be required for use of the technology, which is not always the case. Subcommittee chairwoman Sheila Jackson Lee (Democratic, Texas) explored whether prosecutors should be required to inform defendants if facial recognition was used.

However, privacy advocates will not be pleased, should federal action fall short of a ban. 

“Facial recognition surveillance is more like nuclear or biological weapons than it is like alcohol and cigarettes. It’s too dangerous to be effectively regulated. We need to simply prohibit its use,” wrote Evan Greer, director of the nonprofit advocacy group Fight for the Future, in a statement following the hearing.

So, will Congress actually do it? 

Hypothetically, we’ll get an answer soon enough. 

“There's a bill in Congress right now that every single member of that committee should be supporting, if they're serious about preventing things like what happened to Robert Williams from happening again. If they're not supporting it, they're talking out of their butts,” Greer told me. 

Greer is referring to the Facial Recognition and Biometric Technology Moratorium Act. It was first introduced by Democrats in 2020, but it went nowhere. Democrats have reintroduced the bill, which would prohibit federal funding for facial recognition and other biometric technologies, restrict its use by federal agencies and require state and local entities to place their own moratoriums on the tools in order to receive federal money. 

Then there’s the George Floyd Justice in Policing Act, which aims to prevent the use of facial recognition in body cameras. It has passed in the House, but the Senate has yet to vote on it. 

“I’ve given up on predicting what bills will pass and which won’t,” said Fox Cahn. “All I will say is that it really is a good sign that we continue to see lawmakers on both sides of the aisle recognize the urgency of acting.”

The post Will Congress actually ban facial recognition? appeared first on Coda Story.

It was 2016, and lawmakers in Pakistan had passed a sweeping and controversial internet law granting the government the power to censor online content, including criminalizing hate speech and defamation. The bill, part of a national plan to combat terrorism, came in the wake of a 2014 terrorist attack on a school in Peshawar that killed more than 130 children. 

Authorities said its implementation would help defend the country against threats to national security and cybercrime; critics argued that its broadly defined provisions could be used to muzzle online expression and content critical of the government. One prominent Pakistani legal expert, who has helped a number of other countries draft internet laws, said it was “the worst piece of cybercrime legislation in the world.”

Aziz, co-founder of the Pakistani digital rights group Bolo Bhi, campaigned against the law as it was being debated, speaking out against its potential impact on freedom of speech. Five years after the passing of the Prevention of Electronic Crimes Act (PECA), Aziz said it has been used against journalists and dissidents, as well as women who have come forward with allegations of sexual harassment online, but then been charged with defamation.

The outcome, Aziz said, “just confirms and validates the apprehensions we raised when the law was being introduced.” The U.S. State Department echoed critics’ concerns, concluding in a 2021 human rights report on Pakistan that it “gives the government sweeping powers to censor content on the internet, which authorities used as a tool for the continued clampdown on civil society.” Between 2016 and 2020, Pakistan’s ranking in the global internet freedom index fell from 31st to 26th, according to the U.S.-based nonprofit Freedom House. 

Pakistan’s assault on digital freedom is once again on Aziz’s mind, as U.S. politicians threaten to change a landmark internet law that could affect the bounds of online expression well outside of their country’s borders. The 1996 law, Section 230, shields websites from legal liability for the content users post online. The 26-word mandate, signed by President Bill Clinton and widely referred to as the “digital Magna Carta,” has allowed tech giants like Facebook, YouTube, and Twitter, to flourish without worrying about legal liability. 

Yet Section 230 has come under fire from American lawmakers on both sides of the aisle as a bipartisan appetite to regulate large technology companies has grown, especially following the January 6 insurrection at the U.S. Capitol and the deplatforming of former President Donald Trump from Facebook and Twitter. Both events have ratcheted up calls on the right and the left to hold social media platforms accountable for their content moderation decisions, with Republicans principally concerned about biases against conservative voices on social media, and Democrats focused on the role of platforms in spreading disinformation and extremism. 

Section 230 has become a flashpoint in American politics and the subject of numerous attempted legislative reforms in the past two years. Since 2020, roughly two-dozen bills have been introduced, by Congressional Democrats and Republicans alike, to slash or chip away at it. Some would repeal the law altogether; others would strip away platforms’ liability shield for posted content involving civil rights, harassment, child sexual abuse and more. 

While the proposals vary and reflect a broad range of concerns, from censorship to cyberstalking, it’s unclear which, if any, will pass. But what is obvious is that there is significant political will to eliminate or reconfigure Section 230. In a January 2020 interview, Joe Biden — now President of the United States — stated that it should be “immediately” revoked, while former president Donald Trump repeatedly called to repeal the law during his time in office.

Yet, while much of the debate in the U.S. has focused on the domestic impact of a post-Section 230 internet, lawyers, human rights campaigners, and digital rights activists around the world predict that eliminating the law could have global consequences. Among their fears are that scrapping or significantly amending the law could set a precedent for countries from Asia to Latin America to introduce new policies that place severe restrictions on digital speech or make platforms liable for the material posted on their sites, causing them to aggressively remove content that could expose them to lawsuits. 

Eric Goldman is a professor focusing on internet law at California’s Santa Clara University School of Law and has written extensively about Section 230. As he put it, “To the extent that the U.S. stops trying to fight for free speech online, every other country in the world is going to fall even further on the censorship scale.”

Farieha Aziz expects a U.S. decision on Section 230 to influence the conversation on tech regulation in Pakistan, where the government has repeatedly tightened control of the internet in recent years. In addition to the cybercrime law, authorities have banned dating applications over concerns about “immoral” content and unveiled regulations imposing penalties, including hefty fines and potential bans, on social media platforms that violate government requests to take down content. 

“The first thing that happens over here is the government tends to borrow from the narrative of, ‘Oh, but this happens elsewhere as well, this happens in democracies,” she said. If the U.S. changes Section 230, Aziz predicts that Pakistani authorities are “immediately going to draw from it and use this as a justification that, “Look, even in the U.S. they believe the companies need to be held liable.’”

Internet reform and global consequences

So, how could scrapping a U.S. internet law affect how people around the world engage with digital platforms? 

Section 230 protects websites and platforms like Facebook, Amazon, Twitter, and YouTube from lawsuits over the content users create, like comments on online news stories, restaurant reviews on Yelp, videos on YouTube, social media posts and more. 

One of Section 230’s foremost experts, Jeff Kosseff, an assistant professor of cybersecurity law in the United States Naval Academy's Cyber Science Department, describes it as the “26 words that created the internet.” The Electronic Frontier Foundation, a U.S.-based nonprofit that advocates for digital privacy and free speech, refers to it as “the most important law protecting internet speech.” 

For critics, however — including U.S. lawmakers — Section 230 has given social media giants too much legal protection and shielded them from accountability for their approach to content moderation. Democrats who have spoken out against it say that the legal shield removes the incentive for platforms to moderate harmful content, including disinformation, hate speech, conspiracy theories, and extremism. Republicans opponents, meanwhile, argue that it provides cover for social media companies to censor voices on the right. 

Though the two sides have both embraced reform, they have different objectives, underscoring how legislation scaling back platform immunity can be used to advance vastly different political agendas. Democrats want companies to more aggressively moderate harmful content, such as hate speech and misinformation, while Republicans want to limit the abilities of the same social media companies to moderate postings on their platforms.

While most countries have yet to pass local liability legislation, Section 230 has acted as the “law across the world,” according to Anupam Chander, a law professor at Georgetown University who specializes in international tech regulation. The European Union has taken a similar, but less sweeping approach, passing legislation in 2000 shielding platforms from liability if they are unaware of illegal content or quickly comply with requests to take it down.

Chander says a change to Section 230 will have “ripple effects across the world.” It could license other countries to introduce policies making platforms liable for content hosted on their sites, forcing them to more aggressively moderate and remove material that could expose them to litigation or violate local laws.

“There's a lot of speech that might lead to liability across the world. And I think that is a risk of 230 changes,” Chander said. “The precedent it will set for the most free-speech-promoting democracy in the world to hold platforms responsible for the millions of speech messages that they offer each day is really quite stunning.”

Latin America and deplatforming

In Latin America, the U.S debate on Section 230 is already influencing conversations about platform liability. A recently proposed draft bill in Mexico would give the country’s telecommunications regulator (IFT) the power to overrule social media networks in decisions about content moderation. It would also require platforms with more than one million users to get authorization from the IFT to operate in the country and impose fines of up to $4.4 million on digital platforms for non-compliance. Human Rights Watch said the legislation would “place the harshest restrictions on free speech that Mexico has seen in decades.”

Mexico’s draft bill came a month after Donald Trump’s suspension from Facebook and Twitter, a decision that infuriated President Andrés Manuel López Obrador, who had a warm relationship with the former U.S. president, and vowed to lead an international campaign against social media censorship. 

Javier Pallero, an Argentina-based policy director for the digital rights group Access Now, draws a line connecting Mexico’s proposal, which was drafted by a member of Lopez Obrador’s party, Trump’s social media suspension and bipartisan support for Section 230 reform. 

“If the country that used to champion this limitation of liability is now questioning it, then that generates the space for other countries and lawmakers to spark proposals of reform,” he said.

In Brazil, too, it appears that U.S. wrangling over Section 230 has fast-tracked efforts at internet reform. At least four bills related to content moderation and platform liability have been proposed since the U.S. Capitol riot, including two that explicitly reference Trump’s deplatforming from social media outlets. 

Like Republicans in the U.S., conservative politicians in Brazil have set their sights on what they see as excessive censorship of right-leaning voices. One proposal would ban platforms like Facebook and Twitter from moderating content unless they received a court order; another would make platforms liable for financial damages when they censor or ban content that expresses a user’s opinion.

The bills — all introduced by Congressional members of the right-wing Partido Social Liberal, which was President Jair Bolsonaro's party before he split from it in 2019 — mirror Republican lawmakers’ concerns in the U.S. about suppression of right-wing voices on social networks. 

Artur Pericles, head of research at InternetLab, a technology-focused research center in the capital, Sao Paulo, told me that he had noted similarities between the Brazilian platform liability bill for opinion-related content moderation and legislation introduced by U.S. Senator Josh Hawley, a Republican from Missouri, in June 2020. Hawley’s bill — the Ending Support for Internet Censorship Act — would only extend Section 230 protections to companies that are able to prove political neutrality by getting an immunity certification from the Federal Trade Commission. 

“Both the left and right agree that platforms have too much power,” Pericles explained. “But then the left thinks that platforms should be more accountable to combat misinformation and hate speech. The right thinks that the platforms should have less power so they are not able to censor people on the right.”

Bolsonaro has also thrown his weight behind the push to regulate content moderation. In mid-May, the government published a draft executive order that would bar platforms from taking down content unless they have a court order, an option that could bypass Congressional efforts, and become law with the swipe of Bolsonaro’s pen. 

Though Pericles suggested the proposals would be unlikely to survive legal challenges, he said the executive order, in particular, has already had an impact on public discourse, highlighting platform liability and drawing attention to politicians’ efforts to limit content moderation. “Even if it doesn't make it into law, it definitely has changed the conversation and has given it a new sense of urgency,” he said. “People on the right who support the president have been drawing on the conversation in the United States for a while now.”

Illustration by Teona Tsintsadze

The post How changing a 26-word US internet law could impact online expression everywhere appeared first on Coda Story.

If technology is sold on the basis of this law, said Caitlin Bishop, a campaign manager at Privacy International, “that’s a problem.”

Critical reaction to the European Commission’s proposed Artificial Intelligence Act was sparked on April 14 by a leak in Politico. The draft law is the first legal framework on the use of AI in the world, and it also creates standards for the use of remote biometric mass surveillance tools in public spaces. However, there are significant exemptions and it does not outlaw facial recognition, as many had deemed essential to be effective.

An important advisor to the European Commission on privacy issues, known as the European Data Protection Supervisor, called for an outright ban on facial recognition. 

Experts argue that the draft legislation is not sufficiently focused on privacy rights. “It feels to us that the regulation, more than anything, determines what AI can be sold, and focuses more on the relationship between the people that are kind of developing the AI and deploying the AI than the people who will be surveilled,” said Bishop. 

The legislation does not cover private companies’ use of facial recognition, for example. 

“Face recognition isn't less concerning, invasive or harmful when it's being used by private companies,” Bishop said. “In fact, sometimes it's more so, because you have fewer rights when it comes to your interactions with those companies.” 

It is also unclear whether biometric surveillance tools like facial recognition, gait recognition (technology that identifies people by their walk) or emotion recognition can be used by public entities other than law enforcement, like welfare services or transportation authorities.

The European Commission’s proposal only provides narrow restrictions in live, real-time facial recognition, explained Albert Fox Cahn, the founder and executive director of Surveillance Transparency Oversight Project. 

“But there is no ban on historical facial recognition where you take a crime scene photo or CCTV photo and run it through facial recognition, which is the dominant form of facial recognition being used around the world,” he explained. 

The proposal has been met with frustration by member states, as well. 

In a letter addressed to the European Commission, 40 Members of the European Parliament criticized an important exemption that allows public authorities, and potentially private companies acting on their behalf, to use AI-enabled biometric surveillance tools “in order to safeguard public security.” 

European regulations have been used as a yardstick for other privacy legislation from California to Uganda. Similar conversations about regulating facial recognition are happening in parallel around the world. On May 7, a court in São Paolo, Brazil blocked the use of the technology on the city’s metro. 

The post EU’s weak AI law sets a low bar for global facial recognition regulations appeared first on Coda Story.

Earlier this week, opposition politician Vladimir Milov and activist Alyona Popova filed a complaint against Russia at the European Court of Human Rights (ECHR) over the mass use of facial recognition technology during a protest in Moscow last September. The protest saw more than 20,000 people rally in support of protesters and political prisoners arrested during the lead up to local council elections. While the protest was sanctioned by the authorities, attendees were made to pass through metal detectors equipped with CCTV cameras. 

In their complaint to the ECHR, Milov and Popova stated that the mass use of facial recognition violated several articles of the European Convention on Human Rights, including those on the right to freedom of assembly and the right to privacy.

Technology experts say the lawsuit faces a number of hurdles. “This is the first case of such a lawsuit against the facial recognition system in Moscow. But it can hardly change the big picture of both local or federal programs for the development of tracking systems, or on broad public opinion,” said Leonid Kovachich, a Moscow-based technology expert, via email. 

Moscow started trialing facial recognition in 2017. Two years later, Moscow City Hall announced that the technology had been successful in tackling crime and moved to install up to 200,000 surveillance cameras with facial recognition throughout the city. 

According to Kovachich, privacy still remains a low priority in Russian public life. “Historically Russians have not been as concerned with privacy issues as people in the West. And there has not been much awareness among the general population about surveillance. So it was not of great concern. The common opinion was: I'm a simple person, I can hardly be interesting to the intelligence services.” 

“However, as soon as people face real persecution and other difficulties associated with surveillance and facial recognition, attitudes begin to change,” added Kovachich. “In Russia, various social movements have emerged that analyze the legitimacy of such systems, develop countermeasures and even share secrets on how to cheat facial recognition systems with makeup and other means of camouflage.”

In February Coda Story followed Katrin Nenasheva, an artist and an activist in Moscow, an organizer of “Follow,” a rally which attempted to trick facial recognition technology with makeup. You can watch our video here.

Image by Gogi Kamushadze

The post Russian opposition files lawsuit against Moscow’s use of facial recognition tech appeared first on Coda Story.

Organized by Austria’s Erste Foundation, which encourages citizens to become active members of society, the conference — “How the EU can take the lead in governing technology globally” — addressed the growing need for the regulation of large technology companies, such as Facebook or Google. 

“Trust is lost. Stakes are very high. We need to pull this all into public accountability,” said the keynote speaker, Marietje Schaake, former member of the European Parliament from the Netherlands. Schaake was speaking to the media at the sidelines of the conference. 

Silicon Valley’s giants stand accused of a plethora of far-reaching systemic flaws ranging from discriminatory race and gender practices in algorithmic decision making to enabling the use of micro-targeting to spread political propaganda. In the EU, the big tech platforms have come under increasing scrutiny with the bloc’s ground-breaking data protection regulation (GDPR) coming into effect last year. 

Europe is already home to the world’s strictest data privacy laws and Schaake is one of the most prominent voices arguing the EU can do much more. Having served as a Member of the European Parliament for a decade, the Dutch politician was behind some of Europe’s key digital initiatives, such as the Digital Agenda for Europe, which was originally conceived in 2010 to speed up the roll-out of high-speed internet in Europe. In 2017, she was singled out by Politico as one of the 28 most influential Europeans. After she resigned at the end of her parliamentary term this year, she was appointed the international policy director of Cyber Policy Center at Stanford University. 

Schaake’s argument contends that since companies like Facebook, Twitter or Google have effectively become the guardians of how information flows, people around the world have lost trust in information sources of any kind. She blames the advertising model whereby “paying instead of convincing” determines one’s position in the marketplace of ideas.  

“Governing for profit optimization allows blatant conspiracy to rise above news stories in search results,” Schaake said in Vienna. “Companies like Facebook allow their clients to advertise against categories such as ‘Jew Hater’, or ‘Hitler did nothing wrong’.” 

In an effort to counter micro-targeted disinformation campaigns, the European Commission proposed a new Digital Services Act earlier this year. These are mostly connected to Russian online influence operations in Europe. For example, the UK-based impact agency 89up reported that Russia spent up to $5.18 million on attempts to influence British voters to vote Leave in 2016’s UK’s EU membership referendum. 

The act is due to be presented at the end of 2020 and is widely expected to contain updated transparency rules on political advertising which would require big tech platforms to subject their algorithms to more stringent forms of regulation. 

More recently, the European Commission’s incoming president Ursula Von der Leyen pledged to create “a Europe fit for the digital age” by enhancing the Digital Services Act with proposals including ethical regulations for AI and new taxes for tech companies.

Algorithms and accountability 

Many experts in Europe today agree on two areas of regulation that could help alleviate the problem of manipulation on social media and micro-targeting for political goals: Content moderation and holding social media algorithms accountable.

The first would make social media companies liable for the content of their platforms. Algorithmic accountability would then force big tech companies to reveal the formulas they use to collect data and match them with advertisers. 

“The debate about intermediary liability is really at the heart of this question. Should companies like YouTube or Twitter be liable for what happens on their platforms?” Schaake asked journalists at the conference. 

Katarzyna Szymielewicz from the Polish NGO Fundacja Panoptykon, which has been engaged in legal battles pushing for the implementation of the right to explanation of automated decisions in Poland, sees a clear link between liability and algorithmic accountability.

“Liability doesn’t concern only content. It’s more about the way tech platforms moderate the discussion. The users might create the content, but the companies create the algorithm. They should have certain transparency obligations,” she said. 

A host of advocacy groups in Europe, but also increasingly more in the United States, who call for algorithmic accountability of big tech companies demand the introduction of legislation that would make the inner workings of the algorithms used by companies like Facebook or Google transparent. 

“It’s not like we want them to reveal all their codes as part of the solution,” said Szymielewicz. “They use hundreds of these algorithms on a daily basis; that would be impossible… We just want them to share with the public the decisions behind building these algorithms, how do they optimize them.” 

Schaake says that she has observed a change in the way companies like Facebook engage with the legislators. 

She says that just three years ago, Facebook was still in denial that the information flows on the platform could have any impact on countries’ electoral processes, let alone assuming any responsibility for the content shared by its users. 

“I remember sitting on a panel on intermediary liability back in 2016. I asked Facebook representatives if they thought their platform could somehow influence the outcome of the upcoming American elections. They told me: ‘don’t watch too many movies’”. 

Since then, she says, especially after the 2018 Cambridge Analytica scandal, Facebook is more aware about how the platform can manipulate users.  

“They [Facebook] now say they have a lot to learn. They say these things are very complicated, but that they are working on it,” Schaake added. “I think that they are really stressed out about all the pressure they are currently under, so they want to create an impression that they want to cooperate on this, but that’s very far from reality.” 

As the global debate about how digital technologies pose serious challenges to the integrity of democratic institutions gathers momentum, new hurdles have emerged. Facebook’s recent announcement that the company will not fact check political ads has led to calls for the voluntary suspension of online political advertising before next month’s UK election. The problems with digital campaigning has also cast a shadow on the 2020 U.S. presidential election.

The issue was given more prominence last week when the actor and comedian Sacha Baron Cohen gave a speech attacking Facebook and other social media platforms for enabling the spread of hate speech and misinformation. Speaking about Facebook’s decision to not fact check political ads, Baron Cohen said that under its own rules, the company would have allowed Adolf Hitler to run propaganda on its platform.

Facebook’s Asia-Pacific Policy Communications Director Clare Wareing said that the company has been working with experts and legislators across Europe on four areas where the company thinks regulation could help. 

“We are committed to working with experts and policymakers to shape the rules of the internet and have outlined four areas where we think regulation could help — harmful content, election integrity, privacy and data portability,” she said in an email. 

Since Facebook, like other big tech companies, considers its algorithms a trade secret, algorithmic accountability is not among the four areas cited. 

However, there have been initiatives on both sides of the Atlantic to release the codes from the so called “black boxes”. Earlier this year, a Democratic member of the U.S. House of Representatives Yvette Clarke introduced the Algorithmic Accountability Act, which would require large tech companies to audit their algorithms for potential abuses of human rights. 

Some version of the right to explanation is already enshrined in the EU’s GDPR, which mandates that users are able to ask for the data behind the algorithmic decisions made for them, including advertising programs, and social networks. 

Thomas Lohninger, the director of Vienna-based digital rights NGO Epicenter.works and a former policy advisor for European Digital Rights, says that the EU should be much more confident in going beyond the existing regulation.  

“Sadly, our politicians often feel like they are powerless when it comes to Google or Facebook,” he said. “But we have seen that the past two legislative terms in the EU have woken up to these issues.” 

After the wave of misinformation campaigns during the last EU elections, there is an appetite in Brussels to go beyond the existing regulation. The European Commission is currently carrying out an in-depth analysis into algorithmic transparency. The Commission will engage with experts, academics, industry, civil society and policy-makers throughout the project.  

“Two studies are currently under evaluation, focusing in particular on governance consideration, oversight and algorithmic auditing technologies,” the EU’s Digital Single Market spokesperson Inga Höglund said in an email. The results of the study are expected to be used in policy-making decisions about algorithms

“Preliminary work on the project has already informed several policy steps taken by the Commission, such as regulation on ‘platform-to-business’ trading practices, which establishes an obligation on online platforms and search engines to be transparent about the general parameters which determine online ranking, she added. 

Implementation requires architecture

Joanna Goodey who heads the Freedom and Justice department at the EU’s Agency for Fundamental Rights says that, whenever the forthcoming Digital Services Act is eventually enacted, the key thing will be its implementation. 

“You can have the best law drafted in the world, but the reality is the implementation,” she said during a panel discussion at the conference. “Do we have an architecture strong enough in the EU? One can argue that the data protection authorities have been grossly under-resources to deal with the GDPR.” 

Schaake says that so far it has been the tech companies who have shown more initiative in setting rules and standards.

“As soon as anti-trust investigations were announced in Europe and the U.S., we’ve seen tech companies hiring more lobbyists for their campaigns,” she said. “They are also funding a lot of civil society organizations, as well as many academic programs, that are working on tech policy.” 

She continued: “The question is then not whether we will see rules and regulation, but who is in charge of it and based on which principles and desired outcome.”

The post At the forefront of Europe’s battle for tech transparency appeared first on Coda Story.