Vogel Internet, Information Technology, and e-Discovery Blog : Texas Internet, Information Technology, eCommerce, & E-Discovery Lawyer & Attorney Peter S. Vogel : Gardere Wynne Sewell Law Firm : Dallas TX

The FTC settled its claims that HTC sold millions of mobile devices using the Droid and Microsoft software because the devices were not secure. The FTC’s Complaint specifically identified “potential exposure of sensitive information and sensitive device functionality through the security vulnerabilities in HTC mobile devices, consumers are at risk of financial and physical injury and other harm,” and among other things:

…malware placed on consumers’ devices without their permission could be used to record and transmit information entered into or stored on the device, including financial account numbers and related access codes or personal identification numbers, medical information, and personal information such as text messages and photos.

Sensitive information exposed on the devices could be used, for example, to target spear-phishing campaigns, physically track or stalk individuals, and perpetrate fraud, resulting in costly bills to the consumer.

Misuse of sensitive device functionality such as the device’s audio recording feature would allow hackers to capture private details of an individual’s life.

The NY Times reported that this was “first attempt by the commission to police a manufacturer of mobile devices.”

The FTC has invited interested parties to submit comments about the settlement through March 22, 2013, so it remains to be seen if HTC is out of the woods on the security problems.
 

• Email This
• Print
• Comments (1)
• Trackbacks
• Share Link

The FTC reminded consumers to protect against identity theft during tax filing season, and provided a laundry list of precautions to insure that tax information does not fall into the wrong hands including:

• Make sure that anyone helping you prepare your taxes is trustworthy.
• File taxes early in the tax season to reduce the window of time in which a thief could fraudulently file under your Social Security number.
• If filing electronically, only submit forms through a secure Internet connection.
• If filing by mail, go to the post office directly to mail the envelope.
• Do not respond to email messages asking for your personal information that purport to be from the IRS. If the IRS needs to contact you, it will do so by mail.

More Tax Related Identity Theft advice is available at OnGuardOnline.gov which is a website managed by the FTC, and many other agencies including: IRS, SEC, Homeland Security, FCC, FDIC, and Departments of Commerce, Education, State, and Justice.

To learn more about what the FTC is doing to protect the public I welcome you to read my eCommerce Times February 2013 column entitled “Of Apps and Antitrust: FTC Monitoring Kicks Into High Gear.”
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

FTC Chair Jon Liebowitz is resigning after 4 years during which he “pushed for online privacy protections and sought to restrain unfair competition,” but as the New York Times reported he “stumbled in an attempt to rein in the Internet search practices of Google”:

Competitors, advertisers and some consumer advocates had complained that Google manipulated the results of its Internet searches to give top priority to results that featured companies in which it held an interest, while punishing those that were a competitive threat.

The Washington Post speculates that the new Chair could be “other Democrats on the commission, Julie Brill and Edith Ramirez,” but Chair's departure:

...will create at least a temporary partisan split, with two Democrats, two Republicans and one seat empty until President Obama can gain confirmation for a nominee. Such 2-2 divides on the five-member commission are not uncommon during transitions, but they can make it difficult to chart a forceful path for the FTC.

No one knows about the future of the FTC, but given its role to manage privacy on the Internet in the US it will be interesting to see who is selected, and also to watch the confirmation process to see what the Senate is concerned about.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The FTC and Google reached a landmark agreement regarding allegations of antitrust behavior by Google regarding Google search engine. But also the settlement allows competitors of Google’s “on fair, reasonable, and non-discriminatory terms – to patents on critical standardized technologies needed to make popular devices such as smart phones, laptop and tablet computers, and gaming consoles.”

The FTC included the following statement about Google’s search engine:

The evidence the FTC uncovered through this intensive investigation prompted us to require significant changes in Google’s business practices. However, regarding the specific allegations that the company biased its search results to hurt competition, the evidence collected to date did not justify legal action by the Commission.

Undoubtedly, Google took aggressive actions to gain advantage over rival search providers. However, the FTC’s mission is to protect competition, and not individual competitors. The evidence did not demonstrate that Google’s actions in this area stifled competition in violation of U.S. law.

Not everyone is happy with the FTC settlement as the Washington Post reported:

Consumer groups, Google’s rivals and some legal analysts say the company now will be emboldened to enhance the visibility of its own products for travel, shopping and other lucrative services in ways that will make it harder for people to find other offerings and will lead to higher prices.

After almost 2 years of investigation by the FTC surely Google is pleased. Comscore’s latest rankings indicate 67% of all US searches on conducted on Google, so this FTC resolution remains to be seen how this will impact the search engine market.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Although in mid-December the Washington Post reported that there was an apparent antitrust settlement with Google and the FTC, Google reached out to me to let me know otherwise. Google sent me an email  with a link to former FTC Commissioner Orson Swindle's article and a Forbes article which I reference below.  Google wanted me to know among other things said:

The FTC, though it looked like it was very soon to announce resolution of its Google investigations, may be putting this off a little longer, at least, presumably due to competitor push back. But, from what has been reported in the media to date, it seems like a solution is very close which not only protects consumers but also protects innovation.

Commission Swindle wrote in the Washington Post regarding the FTC investigation:

Google’s competitors, led by Microsoft and the FairSearch coalition, have been clamoring for government action against the company for years. To the FTC’s credit, it appears this extraordinarily well-funded public relations and lobbying ploy will not bear fruit for FairSearch and its accusation of search bias by Google.

In a recent report Forbes including this summary regarding the FTC investigation:

The final chapter in this investigation clearly has yet to be written, and much may change over the coming weeks and months. If the rumors prove true, the FTC’s actions will send a signal to all tech companies that they must act responsibly, but also that they can continue innovating and growing without constant fear of a potentially damaging enforcement action.

So I guess we all need to stay tuned for the FTC’s action regarding Google’s search engine business.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The Washington Post reported that the FTC and Google have reached a deal in the 2 year investigation about monopoly practices where Google “would agree to new limits on its ability to use snippets of content from other Web sites and would agree to make it easier for marketers to transfer their online ads to other services.” However the five FTC Commissioners still have to ratify this agreement.

Assuming the US resolves its antitrust claims against Google, don’t forget that the EU continues to press its antitrust claims against Google. In a report earlier this year the Washington Post indicated that the threat to Google was a:

…$4 billion fine and a formal ruling that it has abused its dominance in the search market to hurt rivals across a range of industries.

Since Google accounts for about 90% of the searches in the EU a negative antitrust ruling will surely impact Google’s business.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The FTC reported that 80% of apps used by children contained the ability to access the Internet (compared to 62% in 2011) and 13% had the ability to access user geo-location (compared to 10.5% in 2011). The New York Times reported:

Several hundred of the most popular educational and gaming mobile apps for children fail to give parents basic explanations about what kinds of personal information the apps collect from children, who can see that data and what they use it for…

The FTC’s 2012 Report is entitled Mobile Apps for Kids: Disclosures Still Not Making the Grade is a follow-up to a similar report in 2011 and concludes by calling “on everyone involved in the mobile app marketplace – app stores, app developers, and third-parties that interact with the apps – to follow the three key principles laid out in the FTC’s Privacy Report:”

(1) adopting a “privacy by- design” approach to minimize risks to personal information;

(2) providing consumers with simpler and more streamlined choices about relevant data practices; and,

(3) providing consumers with greater transparency about how data is collected, used, and shared.

Of greatest relevance to the findings in this report, industry participants must work together to develop accurate disclosures regarding what data is collected through kids’ apps, how it will be used, who it will be shared with, and whether the apps contain interactive features such as advertising, the ability to make in-app purchases, and links to social media.

This information about the invasion of children’s privacy with apps is alarming and clearly the needs to be better regulated by our government.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The NY Times reported that Spokeo was “compiling and selling people’s personal information for use by potential employers in screening job applicants.” For the first time ever, the Federal Trade Commission (FTC) charged and assessed a fine for use of personal Internet data in violation of the Fair Credit Reporting Act. Spokeo confessed that it violated federal laws by “furnishing a consumer report to any person who does not have permissible purpose to receive the consumer report…” 

Between 2008 to 2010 Spokeo sold “coherent people profiles” that could include:

an individual’s address,
phone number,
marital status,
approximate age,
e-mail address,
hobbies,
ethnicity,
religion,
participation on social media sites,
photos,
and other information.

Spokeo founder and President Harrison Tang admitted the FTC charges and signed the Consent Order with the FTC.

This fine and confession by Spokeo are significant as they indicates social media sites must comply with federal privacy laws, and the that the FTC is being vigilant to protect consumers.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Myspace agreed to 20 years of US government oversight of privacy, just like Facebook did in 2011 and Google did in 2010. On May 8, 2012 the Federal Trade Commission (FTC) released a statement about its settlement with Myspace dislosing the following mispresentations which were violations of federal privacy laws :

• Myspace provided advertisers with the Friend ID of users who were viewing particular pages on the site.
• Advertisers could use the Friend ID to locate a user's Myspace profile to obtain personal information publicly available on the profile and, in most instances, the user's full name.
• Advertisers also could combine the user's real name and other personal information with additional information to link broader web-browsing activity to a specific individual.
• Myspace certified that it complied with the U.S.-EU Safe Harbor Framework…, including the requirements that consumers be given notice of how their information will be used and the choice to opt out.

As part of the settlement agreed “… to implement a comprehensive privacy program, and …regular, independent privacy assessments for the next 20 years.” TheFTC solicits public comments:

The agreement will be subject to public comment for 30 days, … through June 8, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit written comments electronically or in paper form by following the instructions in the "Invitation To Comment" part of the "Supplementary Information" section. Comments can be filed electronically at this link. Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.W., Washington, DC 20580.

Myspace’s confession is not a big surprise given that Facebook and Google entered into similar agreements in the past 2 years.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

 Earlier this week Carrier IQ representatives met with officials at the FTC, FCC, and with the staff of a number of Senators. For more details about Carrier IQ please read my eCommerce Times column “Carrier IQ and the US' Escalating Privacy Risk Level.”

The Washington Post reported that Carrier IQ Andrew Coward (senior vice president for marketing) said “This week Carrier IQ sought meetings with the FTC and FCC to educate the two agencies . . . and answer any and all question”…but he was “not aware of an official investigation.” As well, the scope of the privacy controversy has enlarged. In addition to class action lawsuits against Carrier IQ other class-actions have been filed against AT&T, Sprint Nextel, Apple, T-Mobile USA, HTC, Samsung, and Motorola.

Stay tuned for more about Carrier IQ and privacy.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

A researcher recently found that Carrier IQ software is secretly installed on most modern Android, BlackBerry, and Nokia phones. Android developer’s Trevor Eckert’s 17 minute video demonstrates how that Carrier IQ software is loaded on his phone, cannot be disabled, tracks every keystroke, and sends the data to Carrier IQ.  After receiving this massive data from millions of cell users, Carrier IQ "correlates and aggregates the data for near real-time system monitoring and business intelligence" for phone carriers and manufacturers ostensibily to improve quality.

Eckert demonstrated that Carrier IQ software was logging and potentially transmitting the sensitive information of consumers, including:

• when they turn their phones on;
  
• when they turn their phones off;
  
• the phone numbers they dial;
  
• the contents of text messages they receive;
  
• the URLs of the websites they visit;
  
• the contents of their online search queries—even when those searches are encrypted; and
  
• the location of the customer using the smartphone—even when the customer has expressly denied permission for an app that is currently running to access his or her location.

As a result Representative Edward Markey (D-Mass.), co-Chair of the Congressional Bi-Partisan Privacy Caucus, sent a letter to the Federal Trade Commission  asking what is being done to investigate.

In addition to Representative Markey’s letter, Senator Al Franken (chairman of the Subcommittee on Privacy, Technology, and the Law) sent his own letter to Carrier IQ which included the following:

I am very concerned by recent reports that your company's software - pre-installed on smartphones used by millions of Americans - is logging and may be transmitting extraordinarily sensitive information from consumers' phones ... It also appears that an average user would have no way to know that this software is running - and that when the user finds out, he or she will have no reasonable means to remove or stop it. ... These actions may violate federal privacy laws, including the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. This is potentially a very serious matter.

Senator Franken requested that Carrier IQ answer by December 14, 2011.

On December 1, 2011 Carrier IQ issued a press release in which Carrier IQ stated that consumer’s privacy is protected:

Consumers have a trusted relationship with operators and expect their personal information and privacy to be respected. As a condition of its contracts with operators, Carrier IQ operates exclusively within that framework and under the laws of the applicable jurisdiction. The data we gather is transmitted over an encrypted channel and secured within our customers’ networks or in our audited and customer-approved facilities.

Actually Carrier IQ claimed that “Our software makes your phone better by delivering intelligence on the performance of mobile devices and networks to help the operators provide optimal service efficiency.”

This is alarming news and it seems to me we all expect our government to step in to protect consumers’ privacy which seems has been seriously compromised! 

• Email This
• Print
• Comments (1)
• Trackbacks
• Share Link

After the US government filed charges that Facebook violated US privacy law, Facebook finally confessed that it failed to protect the privacy of its 800 million active users. The Federal Trade Commission (FTC) welcomes the public to submit comments on the settlement through December 30, 2011.

Under the proposed consent order, which does not include any fines, Facebook is:

barred from making misrepresentations about the privacy or security of consumers' personal information;

required to obtain consumers' affirmative express consent before enacting changes that override their privacy preferences;

required to prevent anyone from accessing a user's material more than 30 days after the user has deleted his or her account;

required to establish and maintain a comprehensive privacy program designed to address privacy risks associated with the development and management of new and existing products and services, and to protect the privacy and confidentiality of consumers' information; and

required, within 180 days, and every two years after that for the next 20 years, to obtain independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order, and to ensure that the privacy of consumers' information is protected.

The Facebook user community surely welcomes these commitments to comply with privacy laws, and it’s good to see that FTC will monitor Facebook’s privacy compliance for the next 20 years. The 20 year privacy monitoring is similar to the FTC’s agreement for Google to protect privacy after Google’s social media disaster with Buzz.

However, time will tell if the FTC can really police social media privacy, so it would be wise for social media users to protect their own privacy.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

My eCommerce Times column for October is entitled “Shore Up Your Privacy Policy Before Disaster Strikes” and I encourage you to read it. Actually it was published the same day as my blog that more than 7.5 million children under 13 are on Facebook. Since the Federal Trade Commission regulates Internet privacy in the US and particularly the 1998 Children’s Online Privacy Protection Act , it’s only a matter of time before we can expect some action.

Facebook’s latest user statistics are that more than 75% of Facebook users are outside the US.  So it seems likely that the EU, Japan, Canada, and many other countries will inquire about what Facebook intends to do about children using Facebook!

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Not only was Google’s roll out of Buzz in 2010 badly received by the user community, the Federal Trade Commission (FTC) filed a Complaint for Google’s violation of its own Privacy Policies:

 ...Google launched its Buzz social network through its Gmail web-based email product. Although Google led Gmail users to believe that they could choose whether or not they wanted to join the network, the options for declining or leaving the social network were ineffective. For users who joined the Buzz network, the controls for limiting the sharing of their personal information were confusing and difficult to find, the agency alleged.

The FTC Complaint alleged that Buzz violate US privacy laws, and also violate the US – EU Safe Harbor Framework to allow personal data to be lawfully transferred from the EU to the US. Ultimately Google settled this dispute with the FTC and the FTC announced:

The proposed settlement bars the company from future privacy misrepresentations, requires it to implement a comprehensive privacy program, and calls for regular, independent privacy audits for the next 20 years.

Clearly the FTC settlement with Google sends a huge wake up message to everyone to review their Privacy Policies to avoid FTC actions!

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The Electronic Privacy Information Center (EPIC) issued its second annual privacy report card with lower grades of “C for consumer data protection efforts and a D on civil liberties.” Mark Rotenberg, executive director of EPIC said "Our bottom-line assessment is that with respect to privacy, things are getting worse.” The EPIC is pleased that President Obama’s first Cyber Czar Howard Schmidt (who was appointed in December 2009) is working with privacy groups. EPIC’s report is critical of the Federal Trade Commission (FTC) which is now reevaluating US privacy laws in the wake of Google’s Buzz disaster and alleged privacy violations by Facebook. Clearly everyone needs to keep an eye on how the Obama administration manages privacy, and now that the Democrats do not control both houses of Congress it will be interesting to see how law makers deal with privacy.

New Congress and Privacy

As matter of fact after the November 2, 2010 election the Washington Post reported  that “Rep. Joe L. Barton (Tex.), ranking GOP member of the House Energy and Commerce Committee, signaled the legislative push in a statement about his correspondence with Facebook executives on privacy issues…I want the Internet economy to prosper, but it can't unless the people's right to privacy means more than a right to hear excuses after the damage is done.” Reports of data breaches continue and merely needs to check out the FBI’s websites of Cyber Crime Stories which clearly impact us all. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Let’s see a show of hands- do you read Terms of Service? Privacy Policies? Or Click Agreements? I routinely ask audiences this question and rarely do I ever get any hands raised. My recent Technology Law column in eCommerce Times entitled “Who Reads Terms of Service, Privacy Policies or Click Agreements?” identifies many legal issues concerning website contracts. Every fall since 2000 I’ve taught a course on theLaw of eCommerce at the SMU Dedman School of Law and every fall I find that virtually none of my students have ever considered reviewing Terms of Service, Privacy Policies, or Click Agreements. But by the end of the semester they routinely review these contract terms. I was pleased to see a former student from 2004 recently who told me that he regularly reviews these contract provisions. The irony of not reviewing these contract provisions is that people have no idea what legal rights and privacy they may be giving up.

FTC and Privacy

TheFederal Trade Commission regulates privacy in the US and if a website does not have a Privacy Policy that’s okay but if there is a Privacy Policy the website must follow its promises to website visitors. Since so few people review Terms of Use, Privacy Policies, and Click Agreements the FTC is considering making changes to US privacy laws particularly regarding the Children’s Online Privacy Protection Act. However in the meantime until the US privacy laws are changed, websites have pretty much a free hand since no seems care.

• Email This
• Print
• Comments (2)
• Trackbacks
• Share Link

President-Elect Obama’s Twitter account was hacked “offering his more than 150,000 followers a chance to win $500 in free gas.” Twitter settled the FTC’s charges that “that it deceived consumers and put their privacy at risk by failing to safeguard their personal information, marking the agency’s first such case against a social networking service.” In my recent testimony before the Texas Senate I highlighted the problem with violating FTC privacy laws, and obviously this is just the beginning of Social Media claims that we will all deal with about Internet privacy.

FTC Settlement Terms

Here’s what Twitter agreed to as part of its settlement:

Twitter will be barred for 20 years from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information, including the measures it takes to prevent unauthorized access to nonpublic information and honor the privacy choices made by consumers. The company also must establish and maintain a comprehensive information security program, which will be assessed by an independent auditor every other year for 10 years.

Twitter Adds Location to Messages

Recently Twitter announced that it would allow “users tag their messages with their location.” So given the FTC settlement it seems that adding location would seriously impact privacy if one can easily learn when the tweets are originating.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Apparently large scale phishing attacks resulted in compromises to tens of thousands of webmail accounts, hardly a surprise. However it is pretty amazing that so many individuals fall for the phishing tricks. As a matter of fact this morning I got an email purportedly from PayPal indicating that my account had been hacked and if I would only provide personal information including credit card information, social security number, date of birth, well you get it. Of course it would be incredibly stupid for me, or thousands of these phishing victims to believe the emails that come to our inboxes. What can we do to protect ourselves?

OnGuard Online

Apparently few people take the time to review OnGuard Online before they get duped by phishing and spam attacks. However the OnGuard Online is a great website hosted by a number of federal agencies and non-profits including: Federal Trade Commission, Department of Commerce, Department of Homeland Security, Internal Revenue Service, Computing Technology Industry Association, National Crime Prevention Council, Better Business Bureau, and Anti-Phishing Working Group (APWG). OnGuard Online provides cute videos and games to educate consumers about the risks associated with: phishing, computer security, email scams, spam, VOIP, among other topics. The OnGuard Online site also provides publications and allows consumers to file complaints.

Federal Government to the Rescue?

If the CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act of 2003 is any indication it’s probably unlikely that the US government can do much to protect citizens since there seems to be an increase in spam and phishing since 2003, not a reduction as was hoped when the 2003 law was passed. There are estimates that 80% of all email is unsolicited which should be reason enough for individuals to be more leery of suspicious phishing emails. Hotmail claims it has 400 million accounts so the number of compromised accounts could be huge and reports from the APWG estimate that phishing attacks will continue. Since the US government does not seem capable of managing cyber security and the White House cannot get anyone to be Cyber Czar is it any wonder that the webmail accounts are compromised by the thousand?
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Behavior Advertising

A recent privacy blog discussed the February 2009 Federal Trade Commission Staff Report entitled “Self-Regulatory Principles For Online Behavioral Advertising,” and the opt-out questions posed by Congress are at the heart of whether new Internet privacy laws are required. The Internet economy, and certainly Google is chief example, are dependent upon the current behavioral advertising model and surely will be impacted by a change in the privacy laws in the US.

eMail Surveillance

Most US citizens believe that their emails are private. However employee privacy regarding emails in the workplace (not personal webmail) may be misplaced since in the US emails are private to employers and in the EU, Canada, and other countries emails are private to the employees. Nevertheless there are more questions being asked in Congress about how many e-mails are being collected in the name of security. The recent report that National Security Agency exceed its authority by intercepting emails and phone calls continues to be debated in Congress. Given President Obama’s cybersecurity agenda it will be interesting to see how the US congress can reconcile the expectation of personal privacy and need for Internet security. These debates will continue as the Internet evolves. Stay tuned for more.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

No surprise that the Chinese government blocked social networking on the eve of the 20th anniversary of the military crackdown at Tiananmen Square. As a matter of fact just before the Olympic Games began in August 2008 China limited Internet access as the government wanted control over information before and during the Games. Many people from the West were surprised since China was hosting the international Games, but it seems logical that a totalitarian government would not change its behavior in such a circumstance.

More Social Networking

It’s about time that smaller businesses got the clue that they need to use social networking to promote their activities, so it’s no surprise to read reports that small businesses are directing their efforts to attract traffic with social networks. Targeted advertising works even better on the Internet, but learning how to identify potential customers has always been a primary goal of marketing.

In February 2009 the Federal Trade Commission issued its FTC Staff Report entitled “Self-Regulatory Principles For Online Behavioral Advertising” following public hearings and “sixty-three comments on the Principles from eighty-seven stakeholders, including individual companies, business groups, academics, consumer and privacy advocates.” Since the US relies on self-regulation of privacy these comments were all considered before releasing the Principles. One need merely review Google’s Analytics site to how much information about is captured about our activity on the Internet. The fact that this monetized is one thing, but the potential loss of privacy has many alarmed.

• Email This
• Print
• Comments
• Trackbacks
• Share Link