Senate Guts Privacy Rules. Will House Follow Suit?
eff.org
eff.org
Is there no party that values privacy, individual liberty, or the constitution?
I thought these "Senators" took an oath to protect the constitution. From the way they vote, it seems they never even read it!
(2) Oddly silent were folks like Google, Microsoft, etc. I fully expect to have to pay for privacy, or to have to choose whom I trust with my data: Comcast or Google.
Its a shitty time for privacy, period.
Here's the text of the bill (it's pretty short): https://www.congress.gov/bill/115th-congress/senate-joint-re...
It looks like all this does is undo an FCC rule from Dec 2, 2016. My understanding is that if this passes, our internet privacy will be the same as it was on Dec 1, 2016.
Am I wrong? Why is this so bad?
No element of that rule change, implemented weeks after the election, could possibly have taken effect before next December. (There are complex notification requirements that could push parts of it out even longer).
Prior to August 2016, the FTC regulated all aspects of consumer protections. Unfortunately, the FTC has a specific call-out ceding authority to the FCC for certain parts of the regulation of 'common carriers', which ISPs fell into.
AT&T sued and said that the FTC carve-out for common carriers means that the FTC can't regulate any part of their business, not even consumer protections like data privacy. In August, the US Court of Appeals ruled in favor of AT&T, which meant that the FCC would have to enact new rules and would have responsibility for consumer protection with regards to common carriers.
The FCC passed consumer protection rules in October (which came into force in December). The FCC has authority on rulemaking unless there's an explicit congressional action saying otherwise. So along comes the new Republican Senate and they pass this bill to nullify the FCC rules. It's written ambigiously enough that you'll likely need another act of congress to undo it, which would require a Democratic congress / senate / President.
In summary: before August, the FTC protected your data. Since last winter, the FCC was protecting it. If this passes, nobody will be protecting it.
I read into it a bit more. The original FTC suit was brought against AT&T in 2014, but in 2015 the FCC reclassified ISPs as common carriers under Title II. So the 9th Circuit's August ruling just reflected that reclassification by the FCC.
The FCC's new consumer protection rules from last year are much harsher for ISPs than the previous FTC rules, so now there is a two-tiered system of data protection.
Senator Flake suggested in the WSJ that he wants the FCC to come up with consumer protection rules for ISPs that use the FTC's framework. (Source: https://archive.is/hKz0a)
To protect consumers from these harmful new regulations, I will soon introduce a resolution under the Congressional Review Act to repeal the FCC’s flawed privacy rules. While the resolution would eliminate those rules, it would not change the current statutory classification of broadband service or bring ISPs back under FTC jurisdiction. Instead, the resolution would scrap the FCC’s newly imposed privacy rules in the hope that it would follow the FTC’s successful sensitivity-based framework.
This seems pretty reasonable, but we still need Congress or the FCC to come up with another system that will fill the regulatory gap left by the 2015 rule change.
As far as corporations? Not unconstitutional, but I don't think passing laws in the interest of the People's privacy against corporations would be unconstitutional either, so if our government had our best interests in mind, then they'd pass those laws instead of repealing them.
That is still a debatable issue though. I completely agree with you, but there are possible world views in which one might think allowing ISPs to sell your viewing data will provide a better product to the end user. Of course this assumes trust that these corporations will act ethically with your data (i.e. anonymize the data before selling and not allowing any leaks of non-anonymised data). That's a dream world to me, but a lot of people seem to be living in dream worlds to me these days.
https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Smith_v._Maryland
"The Senate" didn't vote for this. The Republicans did.
Scroll down to "Grouped by Vote Position".
EDIT: Better link
https://www.senate.gov/legislative/LIS/roll_call_lists/roll_...
Grouped By Vote Position is most useful for this question, they don't offer a by-party grouping but it's pretty easy to scan all 50 YEAs and see every one is followed by an "R." All the NAYs are from Democrats or independents. Senator Isakson (R) didn't vote because he's recovering from surgery, I don't know why Rand Paul (R) didn't vote.
[0] https://www.congress.gov/bill/115th-congress/senate-joint-re...
The democratic party is greedy and selfish, but their positions on many issues are far less anti-human.
[1] https://www.senate.gov/legislative/LIS/roll_call_lists/roll_...
Yea: 50, all R
Nay: 46 D, 2 I
Abstain: 2, all R
ISPs' and carriers' data would cover every single person with a phone or Internet connection. It would be a universal database of locations, and a virtually-universal database of browsing habits tied not only to an IP, but an address and social security number. Will all of that be disclosed? Unlikely. But with an incentive to warehouse it, more ISPs and carriers will, and that makes for a juicy target.
Google does have access in some situations (chrome + linked profile), but as far as I know they don't sell that access.
Of course, both offer some subset of information for users.
Hell, I do use ad-blockers and block assets coming from known Facebook domains, and they probably still have more information about my browsing history than I realize.
Access: Many people in this country do not have a choice as to which ISP they use. They are locked in due to anti-competitive practices, rural homes, or some other reason. You can make the choice much more easily not to use a certain website that tracks your behavior.
Cost also comes into play here, as you pay your ISP to deliver service. Google and Facebook are free, because they subsidize their services by selling and collecting data. Your ISP charges you a large amount of money already, and are increasing their own margins through this practice. It would be different if they did something akin to what Amazon did with their Kindles, where you provide the same service with and without tracking, and charge appropriately. The way things are now, you don't have a choice.
Lack of notification: Your data is being collected and sold through an implicit agreement with your ISP, likely entombed in a bunch of fine print that no one ever reads, nor anyone but a lawyer could decode. While this is the case with Google and Facebook, it's pretty much common knowledge that they do this. The carriers and ISPs implemented their tracking under-the-radar, and provided no way for anyone to opt-out.
I'm sure there's a lot more arguments out there, but that's what I have on top of my head right now.
In a market where everyone has a wide variety of ISPs available and people can start one without massive infrastructure work (for instance, with widely available fiber infrastructure and a choice of who to light it), then we don't need as many restrictions on ISPs can do; people can handle that by selecting an ISP that meets their requirements.
But until we can make ISPs less of a monopoly, and make it possible for others to easily enter the market, then it's reasonable to restrict what those monopolies can do.
If their privacy policies change to something that you are unwilling to tolerate, the cost to you of switching to a competitor is... Neither low, but not insurmountable.
These companies are well aware of this - which is why they care about how they use your private information.
For most Americans, if their ISP, (Or their ISP, and their only competitor) adopt anti-user policies, there is nothing that they can do.
I can put up with some discomfort by switching to DDG for my websearches. I can't afford to be a peer to a T3 ISP.
It's software vs hardware.
[1] https://arstechnica.com/information-technology/2016/09/att-t...
Visits nytimes.com, huffingtonpost.com and cnn.com: user is interested in current events and is probably liberal
Visits webmd.com and kaiserpermanente.org: user is probably sick
I'm sure you can extrapolate further. Now let's say I'm a gay person growing up in a conservative house and ads start popping up for all the family members on our shared IP for gay dating sites. That might be problematic for certain people.
1. You fall in the category of, "What if <my closest family members or friends> find out private information XYZ about me, based on which domain names I visit? My life would be ruined."
2. You don't fall in that category.
Group 1 has real fears. For some of them, even knowing whether they're home might be a life threat, and I understand that. But I don't imagine ISPs are fighting so hard just for the sake of targeting group 1; I imagine they might even avoid them if they could, for legal fears. They must be reaping immense benefits from gathering domain name browsing history about group 2 as well, and I assume those in group 2 are still terrified at the thought personally (as opposed to only because they're terrified of what would happen to group 1).
So let's leave the first group aside in this discussion. I'm trying to figure out what the most serious (but realistic) things are that people in group 2 are risking, and how ISPs are reaping profits from them. For example, ID theft or burglary is something that can happen to anybody. How much is your ISP recording & selling when you're home increasing the risk of burglary? etc.
Also: if you think group 1 is the vast majority of people and group 2 is the real minority hear, I'd be interested in hearing that argument as well, since I really don't have data on this (data would be welcome). My current instinct is group 2 is the majority.
I work in ad tech, so as a matter of principle I don't have any ad or privacy blockers turned on. But even in my personal life I always keep my blinds open, I don't care if my neighbors see me living my personal life. I also keep all my Facebook posts public, etc.
But I realize that there are all kinds of situations I can and can't imagine where people need more privacy. My own life situation could even change such that I feel the need for more privacy. That's why I believe that people should by default have a right to privacy, but give it away only if they so chose.
If I were them:
Look how much money Google and Facebook make doing this. Doesn't make sense to prevent AT&T, Verizon, and Comcast from doing the same.
Yes, but they prefer the terms "lobbying" and "campaign contributions".
While theoretically they are concerned with their constituency so they can keep their job, the big problem with our system is the expense of running campaigns. While serving in congress, our representatives a massive amount of time is spent "dialing for dollars". The parties even require ("encourage") spending time "fundraising".
This makes lobbying easy. Constructing a compelling case isn't necessary. Just promise to free up their time by making various donations to their campaign and/or their party. This is legal as long as there isn't specific quid pro quo, thanks to McDonnell v United States.
John Oliver's overview of the problem: https://www.youtube.com/watch?v=Ylomy1Aw9Hk
I'm sure you're familiar with the numerous ways corporations (and others) add indirection when donating. Especially in the era of "Super PACs".
If you're a telco, you can walk into the office of a politician in Alabama and say: "Hey, we employ 5,000 people in your state. Google employs 100. Why the hell would you support legislation that allows Google to make money this way but bans us from doing it?"
(This is, incidentally, why the conventional wisdom about money ruling politics is bunk. Tech is one of the richest industries that exists. But it's relatively politically ineffectual because it employs so few people, and it does so primarily in a handful of rich, coastal states.
A professor of mine once pointed out to me that in the environmental area, it's the environmental groups that need to do lobbying. The power company can just call up a Congress-critter and remind them of the thousands of jobs in their district that are tied to that company's well-being.)
I've been shopping around for VPN routers and provider in light of this, and I expect others are too. I've used Tor in the past, but I expect for all of the devices in our house, that might get a bit cumbersome. I'd also like someone to hold accountable for QoS issues.