8 ms·
Spanish football league defends phone 'spying'
- nkassis 8y agoWell... I hope this is something GPDR covers. If there was a case to start seeing the impact of the new law, this seems like a good example.
- lightbyte 8y agoWould GDPR even cover this? I don't see why La Liga would need to include any personal information about the user in their data. They are concerned with identifying the buisness streaming pirated matches, not who is watching. Edit: The official statement actually answers this >The codes will not refer to your name, but to your IP address and the specific ID assigned by the PPP when you register.
- paulcole 8y agoIf someone's recording the sounds around me, I don't see anyway that's not personal information about me.
- Tharkun 8y agoWho would be the guilty party here? If your phone is spying on me, I'll likely get angry with you. The fact that you're a victim of the football league isn't my problem, you're the one doing the spying.
- chopin 8y agoLa Liga of course. They are recording data about me, without my consent. Doing it through some third party (the phone owner) doesn't absolve them.
- tupilaq 8y agoWell, that (IP address and specific ID) probably constitutes information from which the identity of a natural living person can be discerned and therefore does fall under the protections of GDPR. However, that by itself doesn't mean you can't collect it, just that you need to have specifically asked for their informed consent and not hidden this purpose away in a changelog.
- brownbat 8y agoIsn't this really gathering data about a nonconsenting third party, the business? Does GDPR generally allow you or your apps to collect information that helps identify legal and moral transgressions around you? What if you are watching the game at a friend's house? The collection is definitely going to have some false positives. In that case the coordinates would identify your friend. It seems like deputizing devices to spy on others. Regardless if those others may be doing something wrong or are caught up by accident, it seems like the sort of thing data protection would prevent. This will be a good test of real competing interests. I don't know that privacy should win in the end here, but both sides actually have powerful prima facie cases to make.
- JorgeGT 8y agoThis was indeed discovered because as per GPDR, they had to specify why they were using the mic and GPS. As soon as the update hit the store (after the GPDR entered into effect) and some users saw the changelog and user permission requests disclosing this use, it started to hit the news here in Spain. The Spanish regulator, AEPD, has stated that preliminary steps to begin an official investigation are being conducted already: https://twitter.com/AEPD_es/status/1006115567227559936 https://twitter.com/AEPD_es/status/1006115567227559936 For those who understand Spanish, here's a good technical analysis: https://reversecodes.wordpress.com/2018/06/12/analizando-la-app-de-la-liga-para-android/ https://reversecodes.wordpress.com/2018/06/12/analizando-la-...
- thiagocsf 8y agoThanks for sharing! Entertaining read. The app uses rot(4) to obscure data, includes a debug link with the collected data, and has the Fluzo service api key hardcoded, among other gems.
- bthrm 8y agoOf course the API key is hardcoded... how else would the app contact the server?
- jchw 8y agoAt some point the app needs to have some credential hardcoded, but you can make it more obscured by getting the API key from your own server with some kind of challenge/response. This makes it easier to rotate third party API keys and cut off unauthorized usage, by including information in the challenge request that could be used to correlate unauthorized requests. Your hardcoded credential could then become a cryptographic key that you could rotate on app upfates. I am not sure how many apps actually go through this trouble.
- hartator 8y agoYou mean they were using the mic to see if you were watching the game?
- deleted 8y ago[deleted]
- lightbyte 8y agoThe actual statement from La Liga is in spanish, I translated it with DeepL [1] here: >Privacy policy of the LaLiga app. >Regarding the new privacy policy of the LaLiga app, we would like to make some clarifications. >Origin >LaLiga has the responsibility to protect clubs and their fans from fraud in the broadcasting of football matches by public institutions (HORECA). These fraudulent activities represent an estimated annual loss of 150 million euros for Spanish football, which translates into direct damage to clubs, operators and fans, among others. >For this reason, LaLiga has implemented a new functionality in its official app with the sole purpose of detecting these fraudulent exploitations, transparently informing about them and asking users for their express and specific consent, with or without their being able to lend it freely. >This new functionality for fraud detection is enabled in the app since last Friday, June 8, 2018, only for Android system users and nationally*. >Functioning >When a user downloads or updates the APP, the operating system of your mobile device will prompt them through a pop-up window to provide their consent for LaLiga to activate the microphone and geopositioning of their mobile device. Only if you decide to accept it, the microphone will pick up the binary code from audio clips, for the sole purpose of knowing if you are watching football matches played by LaLiga teams, but the content of the recording will never be accessible. >We protect user privacy >LaLiga has implemented appropriate technical measures to protect your privacy if you authorize us to use this feature. These measures are detailed below: >LaLiga will only activate the microphone and geopositioning of the mobile device during the time slots of matches in which LaLiga teams compete. >LaLiga does not access the audio fragments picked up by the device's microphone, as they are automatically converted into binary code on the device itself. LaLiga only accesses this binary code, which is irreversible and does not allow you to obtain the audio recording again. >If this code matches a previous control code, LaLiga may know that you are watching a particular match. If it does not match, the code is removed. >The codes will not refer to your name, but to your IP address and the specific ID assigned by the PPP when you register. >We will periodically remind you that LaLiga may activate your microphone and geo-positioning and ask you to confirm your consent. >You can revoke your consent at any time in the mobile device settings. [1] https://www.deepl.com/translator https://www.deepl.com/translator
- deleted 8y ago[deleted]
- glitcher 8y ago> The broadcasting of football matches in public places without a paid licence cost the game an estimated 150 million euros (£132m; $177m) a year, it said. Sounds suspiciously familiar to the way questionable data have been represented about money lost due to piracy in other industries (software, movies, music). I am very skeptical about those types of claims.
- oh_sigh 8y agoThat's a bad one I agree. I think a better argument for enforcing their rights is the fact that if they don't, they are effectively punishing establishments that actually do pay to license the broadcast.
- admax88q 8y ago> I think a better argument for enforcing their rights I don't think anyone is arguing that they shouldn't be enforcing their rights. But that they shouldn't use use people's phones as listening devices to do so.
- oh_sigh 8y agoYes, but OP took umbrage to how the estimated losses were calculated, and a statement like: > The broadcasting of football matches in public places without a paid licence cost the game an estimated 150 euros (£132; $177) a year, it said. would not be anywhere near as convincing as a statement with monetary values multiplied by a million. Focusing on the unfairness of what unlicensed streamers are doing avoids that issue.
- Quarrelsome 8y agocould I as a fan not use a similar justification to tap phones of executives and agents to locate cases of gouging and fraud to prevent "costing the fans an estimated x million euros" through inflated ticket prices?
- throw2016 8y agoInteresting only Android users are targeted thanks to Google's frivolous approach to privacy and surveillance. At what point does Google take responsibility? Here is an OS and permission system that works against its users based on open source technology by a surveillance loving company actively involved in building a techno dystopia. That summarizes everything wrong with tech today. But even worse is the army of short sighted and self serving apologists happy to hand wave and diminish everything when not muddying the waters. If this is what a football league is doing one can only imagine what governments and other nefarious interests are upto with Android. When surveillance infrastructure is there it will be used exactly for that.
- Larrikin 8y agoAndroid has had the exact same permission model as Apple for years now
- graeme 8y agoThe app is using the app for background audio monitoring. Ios apps can't do that without displaying a big bar showing they are recording. I'm assuming la liga app is background audio.
- narag 8y agoiPhones in Spain are absurdly expensive.
- Scoundreller 8y agoMy other thinking is ROI. The people with the $100 Android phones were perceived as more likely to watch a black-market broadcast.
- narag 8y agoOf course. If you can spare more than 600€ for a phone, you surely have no problem with pay tv for you giant tv at home. Some like the crowd no matter what, though.
- danbruc 8y agoIf you generate a fingerprint of the audio on the phone, you would not leak too much information about the environment. Shazam, for example, computes the spectrum, picks the strongest peaks, and uses the relative positions of small groups of peaks in time and frequency as features to search for in known recordings. Those features are quite sparse and you can not reconstruct the audio from them. You could however identify more or less every audio signal in the environment you have a copy of to compare against. You could do better by sending out the fingerprint you are looking for and compare it against the past couple of seconds or minutes on the phone so that you could only report a match if one occurred. This would avoid leaking what music you are listening to or what you are watching on TV unless it is what they are looking for. If you report a match with GPS coordinates, the server could throw away everything but the position so that the position is not easily linked to a user. This still reveals all the living rooms in which someone watched the match and used the app, so it's not perfect. If you have a map of all relevant businesses, you could just count matches in the proximity for each or you could only keep matches from locations from which a certain minimum number of matches were reported which should also get rid of most living rooms. This is still not perfect, it, for example, potentially leaks how popular different places are but from a privacy perspective of app users it seems acceptable to me, at least given you trust them to do it right. The real issue, at least in my opinion, is that they turn the app users against the business owners of the places they like to watch matches at. I am not against them trying to track the ones down that are not paying, they have a legitimate interest in that. But the way they are trying to do it seems wrong to me. There are probably some app users that would welcome if everyone had to pay but I guess most don't really care whether their favorite sports bar pays or not and even more would not want to cause trouble for the business owner even if they think they should pay. In consequence this is a feature that many if not most app users would not want to use even if there were no privacy issues. They still put it in hoping that nobody would take notice and that they could get away with it, at least for some time.
- narag 8y agoPrivate home licenses are different from public locals licenses and signals are also slightly different. Actually what bars do is buy a home license and use it for public locals. What I would find infuriating is they get away with it. Data Protection laws are very strict for the little guy, we will see what they do with the 500 pound gorilla. I'm not optimist. These laws did nothing to curb "legal spam" until GDPR. I'm very satisfied with how all the idiots that flooded us with spam are now begging me to allow them to keep doing it. Good riddance!
- Rjevski 8y agoJust wondering, are the games broadcast on paid channels or on public and free-to-view ones? This approach would make sense if the games are on paid channels and the nominal fee for those only covers viewing for one person (in which case it makes sense for establishments to pay more, given they're showing it to more people). But if the games are broadcast on free channels, then there shouldn't be any difference whether or not a person is watching it at home or a bar is showing the game - in either case, the TV advertisers are the ones paying for the game, and this revenue depends on how many people watch the channel (so showing off the game in a bar actually benefits everyone). I feel like in this situation it's the latter, and the people from the football league are just greedy (what a surprise) and any excuse to try and extort money is a good one in their book.
- Jare 8y agoShowing the TV program in a bar is a public performance, and the license only allows for private use. Regardless how you interpret the benefits of public display (and I agree 100% with you), it's not our decision but the licensor's.
- Rjevski 8y agoAnything that can be received for free over the air without signing any kind of license agreement should not count as "public performance" in my book.
- acjohnson55 8y agoAereo thought so too. Their business model was based around hosting colocated TV antennas, from which they streamed broadcast TV to users on a 1:1 basis, geofenced by broadcast market. The Supreme Court shot this argument down. https://en.m.wikipedia.org/wiki/Aereo https://en.m.wikipedia.org/wiki/Aereo The problem is that this is the business model of broadcast networks in a world of cable TV. The statutory retransmission fees funnel some cable TV revenue back to the broadcasters. It doesn't really make sense from first principles, but it has been a pragmatic compromise. The messed up thing about Aereo is that after being shot down by the Supreme Court, they tried to get a license to operate as a cable company but were shot down on that front, too.
- mkeyhani 8y ago> It added it had received the microphone data only as code rather than audio, and that it could match that code with audio data from a match. That sounds funnily absurd to me. By that line of argument, even sound is not really audio. After all, it's being encoded as air pressure waves :-) EDIT: Pardon my ignorance. Based on Google Translate's translation of their statement [1], it seems that they are using some kind of perceptual hashing which is quite interesting. [1]: http://www.laliga.es/noticias/nota-informativa-138 http://www.laliga.es/noticias/nota-informativa-138
- Bromskloss 8y agoI guess they mean that they just have a summary of the sound, not enough to listen to it or anything. It would be a bit like just having the hash of a piece of data, not the data itself.
- mkeyhani 8y agoThanks. You are right. I stand corrected.
- petepete 8y agoThe sooner there's a Netflix for sport the better. Allowing fans to watch matches at a reasonable price, without having to sign up for channels and sports they're not interested in is such an obvious move, but the way rights are distributed means we'll be stuck in the dark ages for years.
- martinald 8y agoI don't think this is the problem, at least in the UK market. For English Premier League there was initially just Sky bidding. Prices got pretty ridiculous for the matches as the football association could keep on putting price up and as so many people take Sky just for sports, they had no option to accept. It then has got even more loopy. BT under the ex-CEO got into the fray, with BT and Sky bidding against each other for matches. Fees skyrocketed even more. Now Amazon is bidding for live matches, so there is a 3 way bid driving prices even higher. Even buying Sky Sports by itself is still really expensive, about £35/$50/month via NowTV. Plus you'd need BT Sports (~£10/month) and now Amazon Prime (~£8/month) to watch all the matches. Sports are just going to keep on getting more and more expensive until the end customer stops paying, as the market will just work that way.
- leephillips 8y agoThe article doesn’t say what this app does - is it for match schedules, news, or what? But this is probably a good example of why I generally refuse to install apps unless I genuinely need to. Almost all apps that people install can be replaced by using a web browser. Yet I see my friends installing tons of apps for no specific reason. Each one increases your attack surface.
- eveningcoffee 8y agoThey should be prosecuted for unlawful surveillance.