8 ms·

EFF’s “Spying on Students” Report Highlights Tech Companies’ Data Collection

189 points by DiabloD3 10y ago

trendia 10y ago
When the telecoms wanted Congress to lift that pesky ISP consumer information protection, they argued that the regulations allowed Google to get ahead while they were left in the dust. Will educational companies lobby for the same kind of freedom?
- pryelluw 10y ago
  I used to work in EdTech. One of the most common issues school admins told me face to face was how big tech corps were storing all of the students data with merely a promise to not exploit it. Its one ofnthe few great advertising opportunities that are left and companies are itching to get to it.
- bigbugbag 10y ago
  I thought that the ISP consumer information protection never went into effect, so there was nothing to lift.
Icedcool 10y ago
This is yet another example of a need for some level of a bill of rights for our online lives/information. Something that guarantee's proper and fair usage, with privacy. The decision making of which I'm sure would be a long and deep debate. If someone stuck an rfid tag in your ear, and tracked where you moved and what you did, I would expect some compensation for that information. Yet we get cookies attached to our browsers, we are profiled and tagged to watch everything that we do online. The de-regulation of the consumer information protection is important in that it is bringing attention to a bigger issue. The ISP's just want to do the same thing other companies have been doing all along.
- ocdtrekkie 10y ago
  One of the things that strikes me as so crazy we don't have this here in the US, is the UN considers it a basic human right[1]. [1] http://www.un.org/en/universal-declaration-human-rights/ http://www.un.org/en/universal-declaration-human-rights/
  - Icedcool 10y ago
    Interesting. Thanks for the link.
    - cmdrfred 10y ago
      Is article 12 what you are speaking on? "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." That seems really broad. Does this apply to private citizens and firms or only governments? If the former it seems a great deal of journalism would be illegal. A few recent examples. When Rachel Maddow released Trumps tax returns was that a violation of article 12? What about when that "grab her by the" tape came out, Trump clearly intended that to be a private conversation and it was a "attack upon his honour and reputation" wasn't it? I don't see a line that allows for truthful attacks. I don't know if I want to live in a country where it is illegal to report on fact in such a broad and sweeping manner.
      - philipov 10y ago
        I think what we need is acknowledgement that any sufficiently large institution is indistinguishable from government, and include only those corporations that meet the criteria of "too big to be private" (related to "too big to fail") in restrictions placed on government.
        cmdrfred 10y ago
        Who defines sufficiently large? There is probably a ISP that is smaller than the New York Times does this standard not apply to them?
mirimir 10y ago
I'm reminded of Cambridge Analytics' claims about profiles for everyone in the US. So now profiles will include stuff from parents' social media: prenatal sonograms, baby pictures, first step videos, etc. Also logs from interactions with toys. And their social media. Plus the educational records. I can't imagine that will work out well for them :(
hackuser 10y ago
I agree with the EFF's position but what the EFF, I, and others with the same point of view lack is an elevator pitch on the harm of losing privacy (or the benefits of privacy). The EFF and I generally assume know the risk is well-known, but it's not. When people ask me, 'what's the harm?' or 'so what?', I don't have an effective answer prepared. So what is an effective answer? Requirements: Short, high-impact, memorable (it must spread), crystal clear for the completely non-technical, not easily refuted.
- mysterydip 10y ago
  In my opinion: it's permanent. Simple as that. Even if the info is harmless in isolation today, any new bit that can be identified as you becomes part of your aggregate. Ten years from now, or tomorrow, People You Don't Like could be in charge of any given agency or company, and deny you things then based on what you did today that was perfectly legal or ethical. There are more extrapolations from that but it should be enough to be short but get the gears turning.
  - dhimes 10y ago
    Nobody cares. What I hear? "So what?"
    - deleted 10y ago
      [deleted]
    - pdkl95 10y ago
      Insurance companies mining as much data as possible to find reasons to deny claims. There is a very good chance that they will be (are already?) able to infer prohibited information to raise prices. If they are concerned with racial issues (or similar), try pointing out how data analysis can hide institutional racism (or other biases) - even unintentionally - into the algorithms behind finance, criminal sentencing/parole, future employment opportunities, etc. Even if none of that happens to apply, there are two big reasons they should care. First, the unknown. In the circus we call our current political environment, do they really want a future $POLITICAL_ENEMY to have a detailed map of who they are, what they do, what they like, where they move during the day and who was with them (COTRAVELER), and anything else modern machine learning techniques can find? The final reason is... because it isn't always about them. Other people might be in worse situations and it's important to stand with them by normalizing sufficient privacy. In his essay[1] on why he wrote PGP, Philip Zimmermann said >> "What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity." This is similar to the concept of herd immunity[2] with vaccines. Vaccines are not 100% protection and some people cannot take them for various reasons. Those people still benefit from the general vaccine use producing fewer opportunities for infection. Similarly, when enough people protect their privacy, there is less incentive to abuse data thanks to lower profits and increased political costs. [1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html [2] https://en.wikipedia.org/wiki/Herd_immunity https://en.wikipedia.org/wiki/Herd_immunity
pizzetta 10y ago
While the right to be forgotten can recall "sanitization" or some kind of censorship, kids should be able to have their histories and everything associated with them pre-adulthood expunged. As kids we all did silly and regrettable things. It'll be a shame if we allow those things to follow people thought-out their lives. As kids we're exploring all kinds of ideas --some good, some regrettable, but we should be able to explore them without fear these crumbs of exploration will follow us in to the future as if we were fully mature and aware as we explored ideas.
- mirimir 10y ago
  Yes, this! In criminal law, that used to be the norm.
- jstanley 10y ago
  > As kids we're exploring all kinds of ideas --some good, some regrettable, but we should be able to explore them without fear these crumbs of exploration will follow us in to the future as if we were fully mature and aware as we explored ideas. Why shouldn't everybody be allowed to explore ideas without consequence?
  - pizzetta 10y ago
    When you are a kid you can get into the wrong crowd and easily want to explore stupid things (bullying, drugs, bias, prejudice, etc.) Adults don't have the luxury or excuse of youth to say, "it was a stupid thing to say, but my thoughts were immature and my mind and self are still developing". There are some things that one as an adult should not "get away with" where non-adults should, in my estimation.
    - Silhouette 10y ago
      Adults don't have the luxury or excuse of youth to say, "it was a stupid thing to say, but my thoughts were immature and my mind and self are still developing". Perhaps we should, at least more than we do in practice today. I'm not sure enforcing conservative views or limiting open debate on controversial subjects is good for either the individuals involved or society as a whole.
squozzer 10y ago
Finally, a "for the children" argument that doesn't take away rights. Given the situation, my emotional state is hopeful, but not sanguine.
- Bartweiss 10y ago
  ...before this, I'm not sure I've ever seen a "for the children" argument that supported individual rights. And perhaps worse, I never even noticed until this moment. It's a bit funny, I regularly argue for youth rights, but standard "for the children" arguments are purely rights-restrictive.
liquidise 10y ago
One thing that is rarely mentioned in the online privacy discussion is how it stands to influence elections in 20 years. Right now we take ideological issue with statements of candidates past preachers or professors. Imagine when a simple leak will spill every horrible thing a candidate said during their teenage years to friends on Facebook messenger or aim. It will be a lagging indicator of privacy policy, but one that stands to influence American politics in a couple of decades.
- _iao 10y ago
  That already doesn't matter. Trump openly said he molested women.. No one cares apparently.
  - Silhouette 10y ago
    Lots of people cared. Just not quite enough or in the right parts of the US, unfortunately.
- bigbugbag 10y ago
  Zuckerberg got leaked offering to give personal info of harvard students and calling those dumb f*cks for giving him this information through thefacebook, but it didn't have any kind of impact, people still flock to facebook to give away all their private data. So I doubt this kind of leak will have a significant impact.
Animats 10y ago
If you have access to a school-provided tablet, see if it's doing a MITM on SSL/TLS connections. Go to some web site like a big bank, and examine the site's certificate in detail.

189 points by DiabloD3 10y ago

When the telecoms wanted Congress to lift that pesky ISP consumer information protection, they argued that the regulations allowed Google to get ahead while they were left in the dust. Will educational companies lobby for the same kind of freedom?

pryelluw 10y ago
I used to work in EdTech. One of the most common issues school admins told me face to face was how big tech corps were storing all of the students data with merely a promise to not exploit it. Its one ofnthe few great advertising opportunities that are left and companies are itching to get to it.
bigbugbag 10y ago
I thought that the ISP consumer information protection never went into effect, so there was nothing to lift.

Icedcool 10y ago

This is yet another example of a need for some level of a bill of rights for our online lives/information. Something that guarantee's proper and fair usage, with privacy. The decision making of which I'm sure would be a long and deep debate. If someone stuck an rfid tag in your ear, and tracked where you moved and what you did, I would expect some compensation for that information. Yet we get cookies attached to our browsers, we are profiled and tagged to watch everything that we do online. The de-regulation of the consumer information protection is important in that it is bringing attention to a bigger issue. The ISP's just want to do the same thing other companies have been doing all along.

ocdtrekkie 10y ago
One of the things that strikes me as so crazy we don't have this here in the US, is the UN considers it a basic human right[1]. [1] http://www.un.org/en/universal-declaration-human-rights/ http://www.un.org/en/universal-declaration-human-rights/
- Icedcool 10y ago
  Interesting. Thanks for the link.
  - cmdrfred 10y ago
    Is article 12 what you are speaking on? "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." That seems really broad. Does this apply to private citizens and firms or only governments? If the former it seems a great deal of journalism would be illegal. A few recent examples. When Rachel Maddow released Trumps tax returns was that a violation of article 12? What about when that "grab her by the" tape came out, Trump clearly intended that to be a private conversation and it was a "attack upon his honour and reputation" wasn't it? I don't see a line that allows for truthful attacks. I don't know if I want to live in a country where it is illegal to report on fact in such a broad and sweeping manner.
    - philipov 10y ago
      I think what we need is acknowledgement that any sufficiently large institution is indistinguishable from government, and include only those corporations that meet the criteria of "too big to be private" (related to "too big to fail") in restrictions placed on government.
      - cmdrfred 10y ago
        Who defines sufficiently large? There is probably a ISP that is smaller than the New York Times does this standard not apply to them?

mirimir 10y ago

I'm reminded of Cambridge Analytics' claims about profiles for everyone in the US. So now profiles will include stuff from parents' social media: prenatal sonograms, baby pictures, first step videos, etc. Also logs from interactions with toys. And their social media. Plus the educational records. I can't imagine that will work out well for them :(

hackuser 10y ago

I agree with the EFF's position but what the EFF, I, and others with the same point of view lack is an elevator pitch on the harm of losing privacy (or the benefits of privacy). The EFF and I generally assume know the risk is well-known, but it's not. When people ask me, 'what's the harm?' or 'so what?', I don't have an effective answer prepared. So what is an effective answer? Requirements: Short, high-impact, memorable (it must spread), crystal clear for the completely non-technical, not easily refuted.

mysterydip 10y ago
In my opinion: it's permanent. Simple as that. Even if the info is harmless in isolation today, any new bit that can be identified as you becomes part of your aggregate. Ten years from now, or tomorrow, People You Don't Like could be in charge of any given agency or company, and deny you things then based on what you did today that was perfectly legal or ethical. There are more extrapolations from that but it should be enough to be short but get the gears turning.
- dhimes 10y ago
  Nobody cares. What I hear? "So what?"
  - deleted 10y ago
    [deleted]
  - pdkl95 10y ago
    Insurance companies mining as much data as possible to find reasons to deny claims. There is a very good chance that they will be (are already?) able to infer prohibited information to raise prices. If they are concerned with racial issues (or similar), try pointing out how data analysis can hide institutional racism (or other biases) - even unintentionally - into the algorithms behind finance, criminal sentencing/parole, future employment opportunities, etc. Even if none of that happens to apply, there are two big reasons they should care. First, the unknown. In the circus we call our current political environment, do they really want a future $POLITICAL_ENEMY to have a detailed map of who they are, what they do, what they like, where they move during the day and who was with them (COTRAVELER), and anything else modern machine learning techniques can find? The final reason is... because it isn't always about them. Other people might be in worse situations and it's important to stand with them by normalizing sufficient privacy. In his essay[1] on why he wrote PGP, Philip Zimmermann said >> "What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity." This is similar to the concept of herd immunity[2] with vaccines. Vaccines are not 100% protection and some people cannot take them for various reasons. Those people still benefit from the general vaccine use producing fewer opportunities for infection. Similarly, when enough people protect their privacy, there is less incentive to abuse data thanks to lower profits and increased political costs. [1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html [2] https://en.wikipedia.org/wiki/Herd_immunity https://en.wikipedia.org/wiki/Herd_immunity

pizzetta 10y ago

While the right to be forgotten can recall "sanitization" or some kind of censorship, kids should be able to have their histories and everything associated with them pre-adulthood expunged. As kids we all did silly and regrettable things. It'll be a shame if we allow those things to follow people thought-out their lives. As kids we're exploring all kinds of ideas --some good, some regrettable, but we should be able to explore them without fear these crumbs of exploration will follow us in to the future as if we were fully mature and aware as we explored ideas.

mirimir 10y ago
Yes, this! In criminal law, that used to be the norm.
jstanley 10y ago
> As kids we're exploring all kinds of ideas --some good, some regrettable, but we should be able to explore them without fear these crumbs of exploration will follow us in to the future as if we were fully mature and aware as we explored ideas. Why shouldn't everybody be allowed to explore ideas without consequence?
- pizzetta 10y ago
  When you are a kid you can get into the wrong crowd and easily want to explore stupid things (bullying, drugs, bias, prejudice, etc.) Adults don't have the luxury or excuse of youth to say, "it was a stupid thing to say, but my thoughts were immature and my mind and self are still developing". There are some things that one as an adult should not "get away with" where non-adults should, in my estimation.
  - Silhouette 10y ago
    Adults don't have the luxury or excuse of youth to say, "it was a stupid thing to say, but my thoughts were immature and my mind and self are still developing". Perhaps we should, at least more than we do in practice today. I'm not sure enforcing conservative views or limiting open debate on controversial subjects is good for either the individuals involved or society as a whole.

squozzer 10y ago

Finally, a "for the children" argument that doesn't take away rights. Given the situation, my emotional state is hopeful, but not sanguine.

Bartweiss 10y ago
...before this, I'm not sure I've ever seen a "for the children" argument that supported individual rights. And perhaps worse, I never even noticed until this moment. It's a bit funny, I regularly argue for youth rights, but standard "for the children" arguments are purely rights-restrictive.

liquidise 10y ago

One thing that is rarely mentioned in the online privacy discussion is how it stands to influence elections in 20 years. Right now we take ideological issue with statements of candidates past preachers or professors. Imagine when a simple leak will spill every horrible thing a candidate said during their teenage years to friends on Facebook messenger or aim. It will be a lagging indicator of privacy policy, but one that stands to influence American politics in a couple of decades.

_iao 10y ago
That already doesn't matter. Trump openly said he molested women.. No one cares apparently.
- Silhouette 10y ago
  Lots of people cared. Just not quite enough or in the right parts of the US, unfortunately.
bigbugbag 10y ago
Zuckerberg got leaked offering to give personal info of harvard students and calling those dumb f*cks for giving him this information through thefacebook, but it didn't have any kind of impact, people still flock to facebook to give away all their private data. So I doubt this kind of leak will have a significant impact.

Animats 10y ago

If you have access to a school-provided tablet, see if it's doing a MITM on SSL/TLS connections. Go to some web site like a big bank, and examine the site's certificate in detail.