6 ms·

Apple is an ally in name only on tightening privacy laws

58 points by green-eclipse 7y ago

PunksATawnyFill 7y ago
If you look at Apple’s sign-on scheme, you see that it’s a “solution” to a problem that they’ve helped perpetuate: forcing people to use E-mail addresses as user IDs. This amateur-hour policy isn’t just inconvenient; it’s a security disaster: https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...
zepto 7y ago
Says Jeff Bezos’s newspaper. It seems like the only point here is that Apple opposes state by state regulation in favor of federal regulation. The headline is therefore absolutely false.
jmull 7y ago
This is pretty weird. The knock on Apple here is that while they generally support federal privacy regulation they aren't lobbying for or influencing specific legislation (unlike some other tech companies). That seems better than the alternative, doesn't it?
- snowwrestler 7y ago
  In lawmaking, general support is meaningless. All that matters is what ends up in the law. If you're not defending or actively supporting a particular bill, you're yielding ground to the people who are attacking it. This is a standard tactic for companies who don't want a bill to pass, but also don't want to get attacked for opposing it. It's often paired with opposition that is run through their trade association, which lets the trade association take the political heat (which is part of what they get paid to do). The article notes that Apple is a member of associations who oppose specific privacy bills. Privacy seems to be a priority for Apple in its product design, marketing, and personally for Tim Cook. So far, it does not seem to be a lobbying priority. And Apple does lobby on some issues; they spent $6 million doing so in 2018.
  - jmull 7y ago
    > This is a standard tactic for companies who don't want a bill to pass, but also don't want to get attacked for opposing it. I don't think that's true. The standard tactic is to support a bill that has no teeth and/or imposes a significant "floor" cost such that complying with the regulation is a large proportion revenue for small companies but a very small proportion to large, established companies, thus preventing potential small/new competitors from establishing a foothold.
    - snowwrestler 7y ago
      This is a tactic for when you are trying to suppress smaller competitors but I don’t think that is Apple’s concern right now.
  - dpkonofa 7y ago
    >If you're not defending or actively supporting a particular bill Alternatively, maybe they just don't like the bills that have been presented so far. I've read several of these privacy bills and they're very clearly written by people who have zero clue about the technology in question or the massive amounts of data being discussed. I'd be generally supporting the direction of these bills but would not personally back them myself either. In that case, what's the solution?
    - snowwrestler 7y ago
      Suggest the language that you would like.
      - dpkonofa 7y ago
        They have. Apple supported the policy development and language of the GPDR in the EU and has publicly come out as saying that it's the standard by which the US should operate also. The GPDR not only shows that it understands what's at stake but it gives consumers the control over the data and a means of verification of compliance. If you live in the EU, you can compel any corporation to send you a copy of all data they have on you and delete it from their system and then provide proof of deletion.
m463 7y ago
I wish apple would let me firewall my mobile devices. I'm not talking about some apple weakened/curated interpetation of privacy or security.
throwaway8879 7y ago
I would advise everyone to be actively paranoid about security/privacy issues. Nobody is on your side. Every corporation and state actor will screw you over if it comes to that. It is human nature to feel comfort knowing that "someone" is on your side. Nobody is, however attractive and privacy-hip Apple pretends to be.
- dpkonofa 7y ago
  Considering that you can actively monitor network traffic and, essentially, prove that Apple does not send your data (at least in any unencrypted form) to their servers, they seem to be talking the talk when it comes to security and privacy. I'm not even sure how Apple could screw you over "if it comes to that" when they don't have access to the data in question. The encryption being used is end-to-end and the only person that has the key is the user. Unless you duplicate passwords or share them with people, your data is unreadable by Apple.
  - throwaway8879 7y ago
    I understand all of that, but still am willing to be in the Stallman or tinfoil-hat conspiracy nut camp just to be safe. I'm too old to be actively trying to figure out whom to trust, and whom not, especially since there are so many actors involved. So it's best to distrust everyone. We can have a discussion about which life jacket brand is the most reliable, and what advanced underwater-breathing technique we could practice, or the hundreds of ways to save ourselves from drowning. But the only way to be absolutely certain is not to get into water in the first place.
    - dpkonofa 7y ago
      That seems paranoid and fearful to the point of being paralyzing. I'm sorry you feel that way.
bocklund 7y ago
One interpretation is that a major differentiator for Apple is privacy. The moat they are trying to create gets a little narrower if other companies are required to catch up. It's aligned with their incentives to ship privacy features, but not have it be required by law.
Despegar 7y ago
Apple has already endorsed GDPR as the model for privacy legislation in the US in the highest profile way, with a keynote speech by the CEO in a conference for privacy regulators in the EU’s parliament [1]. And their statement basically says that again in the principles they want to be incorporated in a privacy bill [2]: >“We believe privacy is a fundamental human right and is at the core of what it means to be an American. To that end, we advocate for strong federal legislation that protects everyone regardless of which state they may live. Accordingly, the bulk of our advocacy is at the federal level. We understand the frustration at the state level — we are frustrated too — but this topic is so important we need to be united across America. >“We have been clear that we think any law should be grounded in four principles: the right to have personal data minimized or not collected at all; the right to know what customer data is being collected and what for; the right of users to get a copy of their data, correct and delete it; and finally, the right to safeguarding personal data through strong security. We have advocated for these protections publicly and consistently in over a hundred meetings with lawmakers across the country. >“We would be the first to say we can do more and constantly challenge ourselves to do so. We have offered to help write the legislation and reiterate this offer. We do not believe however in having a company PAC or in using company funds to donate to any political candidate and have no intention of ever doing so.” The various privacy bills in the states are frankly not good enough. They’re good in the sense that a patchwork of privacy laws will force Congress to pass a federal law, but they aren’t as strong as GDPR. California’s law, the bill proposed by DuckDuckGo and Senator Wyden all preserve the status quo by making people opt-out. GDPR requires your explicit informed consent (opt-in). At a high level if you want to know whether a proposed privacy bill is industry friendly or not you should check to see whether it’s opt-out or opt-in. The bill in Washington that the article mentions Microsoft was lobbying for was another industry friendly, preserve-the-status-quo bill [3]: >But Shankar Narayan, director of the Technology and Liberty Project at the American Civil Liberties Union in Washington state, applauded the expected failure by local lawmakers to reach an agreement on new privacy rules. He complained that strong-arm corporate lobbying had taken over the process, watering down consumer rights in favor of protecting business interests. >”Of course, some protections would be better than no protections," he said. "But this bill offered only the illusion of privacy, nothing more." The ideal scenario is for there to be one federal privacy law that covers the entire US, but only if it’s as strong as GDPR (opt-in, enforcement mechanisms with fines based on revenue, etc). That’s what Apple should be lobbying for (if a state legislature wants to pass a similar-to-GDPR bill then they should back that as well in the meantime). [1] https://techcrunch.com/2018/10/24/apples-tim-cook-makes-blistering-attack-on-the-data-industrial-complex/ https://techcrunch.com/2018/10/24/apples-tim-cook-makes-blis... [2] https://www.washingtonpost.com/technology/2019/07/15/apples-statement-privacy-lobbying/ https://www.washingtonpost.com/technology/2019/07/15/apples-... [3] https://www.politico.eu/article/how-lobbyists-rewrote-washington-state-privacy-law-microsoft-amazon-regulation/ https://www.politico.eu/article/how-lobbyists-rewrote-washin...
manicdee 7y ago
The problem is legislation that includes A and B can be desirable to Apple because of A but undesirable because of B. So Apple can’t support the bill because expressing support for A implicitly supports B because they are in the same bill. Hypothetical bill: Allow same sex marriage and require married women to leave the work force. Do you support same sex marriage? If so, why aren’t you supporting my bill? WHAT KIND OF ALLY ARE YOU?!?!
- dpkonofa 7y ago
  This is exactly what came to mind when reading this article. Not only that but, if you actually read the bills that these politicians are suggesting, they are so ignorant of what actually happens in the real world with people's privacy and their data that they're basically meaningless.
SpikeDad 7y ago
This article is a pile of garbage. Apple is the only tech company walking the talk about privacy in both corporate policies and practical application of privacy in their platforms. A quote like this from the article: >Despite Apple’s public stance on privacy, a Washington Post investigation earlier this year found Apple allows iPhone apps to include tracking software that surreptitiously sends the personal data of Apple customers to outside companies. shows the article is merely an ego boo to WaPo to pretend they have some kind of cred on the subject but they don't. More like an article from Fortune - usually inaccurate WRT Apple. What should have followed this paragraph in an accurate article would be this: "As Apple discovers application developers who violate their policies on data collection and privacy within applications they remove the offending applications and strengthen their internal procedures and policies to prevent a reoccurrence."
- dpkonofa 7y ago
  Agreed. Even when the article discusses the disagreements that Apple has with policy-makers related to these laws, they're leaving out exactly why Apple is at ends with these people. Namely, these politicians don't actually understand how the technology works and so their solutions don't actually do anything to stop what they claim they're trying to stop. The trade groups that they claim are fighting them are even fighting them about different things than what their comments claim. Especially considering that Apple was a pretty big proponent of the GDPR, I'd say, if anything, these politicians should go out of their way to have these talks with Apple rather than waiting for Apple to contact them.

58 points by green-eclipse 7y ago

If you look at Apple’s sign-on scheme, you see that it’s a “solution” to a problem that they’ve helped perpetuate: forcing people to use E-mail addresses as user IDs. This amateur-hour policy isn’t just inconvenient; it’s a security disaster: https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...

zepto 7y ago

Says Jeff Bezos’s newspaper. It seems like the only point here is that Apple opposes state by state regulation in favor of federal regulation. The headline is therefore absolutely false.

jmull 7y ago

This is pretty weird. The knock on Apple here is that while they generally support federal privacy regulation they aren't lobbying for or influencing specific legislation (unlike some other tech companies). That seems better than the alternative, doesn't it?

snowwrestler 7y ago
In lawmaking, general support is meaningless. All that matters is what ends up in the law. If you're not defending or actively supporting a particular bill, you're yielding ground to the people who are attacking it. This is a standard tactic for companies who don't want a bill to pass, but also don't want to get attacked for opposing it. It's often paired with opposition that is run through their trade association, which lets the trade association take the political heat (which is part of what they get paid to do). The article notes that Apple is a member of associations who oppose specific privacy bills. Privacy seems to be a priority for Apple in its product design, marketing, and personally for Tim Cook. So far, it does not seem to be a lobbying priority. And Apple does lobby on some issues; they spent $6 million doing so in 2018.
- jmull 7y ago
  > This is a standard tactic for companies who don't want a bill to pass, but also don't want to get attacked for opposing it. I don't think that's true. The standard tactic is to support a bill that has no teeth and/or imposes a significant "floor" cost such that complying with the regulation is a large proportion revenue for small companies but a very small proportion to large, established companies, thus preventing potential small/new competitors from establishing a foothold.
  - snowwrestler 7y ago
    This is a tactic for when you are trying to suppress smaller competitors but I don’t think that is Apple’s concern right now.
- dpkonofa 7y ago
  >If you're not defending or actively supporting a particular bill Alternatively, maybe they just don't like the bills that have been presented so far. I've read several of these privacy bills and they're very clearly written by people who have zero clue about the technology in question or the massive amounts of data being discussed. I'd be generally supporting the direction of these bills but would not personally back them myself either. In that case, what's the solution?
  - snowwrestler 7y ago
    Suggest the language that you would like.
    - dpkonofa 7y ago
      They have. Apple supported the policy development and language of the GPDR in the EU and has publicly come out as saying that it's the standard by which the US should operate also. The GPDR not only shows that it understands what's at stake but it gives consumers the control over the data and a means of verification of compliance. If you live in the EU, you can compel any corporation to send you a copy of all data they have on you and delete it from their system and then provide proof of deletion.

m463 7y ago

I wish apple would let me firewall my mobile devices. I'm not talking about some apple weakened/curated interpetation of privacy or security.

throwaway8879 7y ago

I would advise everyone to be actively paranoid about security/privacy issues. Nobody is on your side. Every corporation and state actor will screw you over if it comes to that. It is human nature to feel comfort knowing that "someone" is on your side. Nobody is, however attractive and privacy-hip Apple pretends to be.

dpkonofa 7y ago
Considering that you can actively monitor network traffic and, essentially, prove that Apple does not send your data (at least in any unencrypted form) to their servers, they seem to be talking the talk when it comes to security and privacy. I'm not even sure how Apple could screw you over "if it comes to that" when they don't have access to the data in question. The encryption being used is end-to-end and the only person that has the key is the user. Unless you duplicate passwords or share them with people, your data is unreadable by Apple.
- throwaway8879 7y ago
  I understand all of that, but still am willing to be in the Stallman or tinfoil-hat conspiracy nut camp just to be safe. I'm too old to be actively trying to figure out whom to trust, and whom not, especially since there are so many actors involved. So it's best to distrust everyone. We can have a discussion about which life jacket brand is the most reliable, and what advanced underwater-breathing technique we could practice, or the hundreds of ways to save ourselves from drowning. But the only way to be absolutely certain is not to get into water in the first place.
  - dpkonofa 7y ago
    That seems paranoid and fearful to the point of being paralyzing. I'm sorry you feel that way.

bocklund 7y ago

One interpretation is that a major differentiator for Apple is privacy. The moat they are trying to create gets a little narrower if other companies are required to catch up. It's aligned with their incentives to ship privacy features, but not have it be required by law.

Despegar 7y ago

Apple has already endorsed GDPR as the model for privacy legislation in the US in the highest profile way, with a keynote speech by the CEO in a conference for privacy regulators in the EU’s parliament [1]. And their statement basically says that again in the principles they want to be incorporated in a privacy bill [2]: >“We believe privacy is a fundamental human right and is at the core of what it means to be an American. To that end, we advocate for strong federal legislation that protects everyone regardless of which state they may live. Accordingly, the bulk of our advocacy is at the federal level. We understand the frustration at the state level — we are frustrated too — but this topic is so important we need to be united across America. >“We have been clear that we think any law should be grounded in four principles: the right to have personal data minimized or not collected at all; the right to know what customer data is being collected and what for; the right of users to get a copy of their data, correct and delete it; and finally, the right to safeguarding personal data through strong security. We have advocated for these protections publicly and consistently in over a hundred meetings with lawmakers across the country. >“We would be the first to say we can do more and constantly challenge ourselves to do so. We have offered to help write the legislation and reiterate this offer. We do not believe however in having a company PAC or in using company funds to donate to any political candidate and have no intention of ever doing so.” The various privacy bills in the states are frankly not good enough. They’re good in the sense that a patchwork of privacy laws will force Congress to pass a federal law, but they aren’t as strong as GDPR. California’s law, the bill proposed by DuckDuckGo and Senator Wyden all preserve the status quo by making people opt-out. GDPR requires your explicit informed consent (opt-in). At a high level if you want to know whether a proposed privacy bill is industry friendly or not you should check to see whether it’s opt-out or opt-in. The bill in Washington that the article mentions Microsoft was lobbying for was another industry friendly, preserve-the-status-quo bill [3]: >But Shankar Narayan, director of the Technology and Liberty Project at the American Civil Liberties Union in Washington state, applauded the expected failure by local lawmakers to reach an agreement on new privacy rules. He complained that strong-arm corporate lobbying had taken over the process, watering down consumer rights in favor of protecting business interests. >”Of course, some protections would be better than no protections," he said. "But this bill offered only the illusion of privacy, nothing more." The ideal scenario is for there to be one federal privacy law that covers the entire US, but only if it’s as strong as GDPR (opt-in, enforcement mechanisms with fines based on revenue, etc). That’s what Apple should be lobbying for (if a state legislature wants to pass a similar-to-GDPR bill then they should back that as well in the meantime). [1] https://techcrunch.com/2018/10/24/apples-tim-cook-makes-blistering-attack-on-the-data-industrial-complex/ https://techcrunch.com/2018/10/24/apples-tim-cook-makes-blis... [2] https://www.washingtonpost.com/technology/2019/07/15/apples-statement-privacy-lobbying/ https://www.washingtonpost.com/technology/2019/07/15/apples-... [3] https://www.politico.eu/article/how-lobbyists-rewrote-washington-state-privacy-law-microsoft-amazon-regulation/ https://www.politico.eu/article/how-lobbyists-rewrote-washin...

manicdee 7y ago

The problem is legislation that includes A and B can be desirable to Apple because of A but undesirable because of B. So Apple can’t support the bill because expressing support for A implicitly supports B because they are in the same bill. Hypothetical bill: Allow same sex marriage and require married women to leave the work force. Do you support same sex marriage? If so, why aren’t you supporting my bill? WHAT KIND OF ALLY ARE YOU?!?!

dpkonofa 7y ago
This is exactly what came to mind when reading this article. Not only that but, if you actually read the bills that these politicians are suggesting, they are so ignorant of what actually happens in the real world with people's privacy and their data that they're basically meaningless.

SpikeDad 7y ago

This article is a pile of garbage. Apple is the only tech company walking the talk about privacy in both corporate policies and practical application of privacy in their platforms. A quote like this from the article: >Despite Apple’s public stance on privacy, a Washington Post investigation earlier this year found Apple allows iPhone apps to include tracking software that surreptitiously sends the personal data of Apple customers to outside companies. shows the article is merely an ego boo to WaPo to pretend they have some kind of cred on the subject but they don't. More like an article from Fortune - usually inaccurate WRT Apple. What should have followed this paragraph in an accurate article would be this: "As Apple discovers application developers who violate their policies on data collection and privacy within applications they remove the offending applications and strengthen their internal procedures and policies to prevent a reoccurrence."

dpkonofa 7y ago
Agreed. Even when the article discusses the disagreements that Apple has with policy-makers related to these laws, they're leaving out exactly why Apple is at ends with these people. Namely, these politicians don't actually understand how the technology works and so their solutions don't actually do anything to stop what they claim they're trying to stop. The trade groups that they claim are fighting them are even fighting them about different things than what their comments claim. Especially considering that Apple was a pretty big proponent of the GDPR, I'd say, if anything, these politicians should go out of their way to have these talks with Apple rather than waiting for Apple to contact them.