It takes a lot of automation to make the nation’s largest city run, but it’s easy for that kind of automation to perpetuate existing problems and fall unevenly on the residents it’s supposed to serve. So to mitigate the harms and ideally increase the benefits, New York City has created a high-level city government position essentially to manage algorithms.

Mayor Bill de Blasio created the job, formally titled the Algorithms Management and Policy Officer, with an executive order he signed last week. The person who ultimately holds the role will be responsible for, basically, ethics management, which entails developing guidelines and best practices to make the city’s automated decision-makers make more equitable, fair, and transparent decisions.

Why now?

The mayor’s office announced the creation of the position following the publication of a report (PDF) by a city panel called the Automated Decision Systems Task Force, which spent about 18 months assessing the city’s use of what it calls automated decision systems, or ADS.

“The use of ADS is increasing both within New York City government and in municipalities across the United States,” the report notes, “as cities continue to see value in delivering services more quickly and effectively to residents who depend on them, streamlining decision-making processes, expanding their abilities to help their residents, and attempting to identify and remove any human bias from their work.”

The panel’s top recommendation was the creation of a single entity in the city government to standardize baseline principles to be applied by all other agencies within the city government that rely on automated decision-making. The report also suggests principles the manager should incorporate into that baseline framework when it is developed.

A strong public education and transparency program should be among those considerations, the report says. The city should not only explain in plain language what algorithmic systems are in place but also create processes in which individuals can request more information about the decisions made by those systems, why those decisions are made, and potentially challenge those decisions.

Bigger than the Big Apple

In some ways, the city may prove a test bed for the rest of the nation. With a population of about 8.6 million, New York City has more residents squeezed into its square miles than the majority of US states. The city’s five boroughs, standing alone, would be the 12th largest state by population, squeezing in after New Jersey and just ahead of Virginia.

Decisions in every department of every state are increasingly being handed over to software systems that often prove both opaque and biased. Entire books have been written about the many ways in which software coded by human hands, with all our unconscious human biases, can perpetuate inequality.

Algorithmic scoring in criminal justice, for example, tends to be disproportionately punitive to black suspects as compared to white ones. Algorithmic scoring in hospital settings has led to black patients receiving far less medical care than white patients.

Even luxury goods aren’t immune: New York financial regulators are probing Apple and Goldman Sachs after a report indicating some men were receiving far superior credit terms to their wives, who had higher incomes or better credit scores than their husbands, went viral.

https://arstechnica.com/?p=1623307

The Public Internet Registry, a subsidiary of a nonprofit called the Internet Society, has managed the .org domain since 2002. Earlier this year, ICANN asked for public comment on a new contract for the organization. The most significant change was the elimination of provisions limiting price increases for .org domain owners.

According to one tally, more than 3,000 parties wrote in opposing the removal of price caps. Only six comments supported the change. Yet ICANN ignored this lopsided response and approved the contract in June. At the time, the PIR said that it had “no specific plans for any price changes.”

But earlier this month, PIR announced that its parent organization, the Internet Society, was selling PIR to the private equity firm Ethos Capital.

“This transaction will provide the Internet Society with an endowment of sustainable funding and the resources to advance our mission on a broader scale as we continue our work to make the Internet more open, accessible and secure,” the Internet Society said.

The announcement was little noticed at the time—I only heard about it after seeing a story in the Register about the transaction. The Register story, which is worth reading in full, notes that Ethos Capital has a number of close connections to former ICANN officials.

PIR insists that it “will continue to meet the highest standards of public transparency, accountability, and social performance in line with its longstanding purpose-driven mission.”

But notably absent from the announcement is any commitments to limit future price increases. That means there’s a risk that Ethos Capital could dramatically raise prices for .org customers in the coming years.

It’s not clear if ICANN has any authority to block the transaction or impose additional protections for .org domain holders. It’s also unclear who must approve the transaction, or when the deal will finally close. Ars has reached out to ICANN, the Internet Society, and PIR asking for comment about the possibility of price hikes and the process for completing the transaction, and we’ll update this story if we receive a response.

https://arstechnica.com/?p=1622485

The Fifth Amendment to the US Constitution bars people from being forced to turn over personal passwords to police, the Pennsylvania Supreme Court ruled this week.

In a 4-3 ruling, justices from Pennsylvania’s highest court overturned a lower-court order that required the suspect in a child-pornography case to turn over a 64-character password to his computer. The lower-court ruling had held that the compelled disclosure didn’t violate the defendant’s Fifth Amendment rights because of statements he made to police during questioning.

“It’s 64 characters and why would I give that to you,” Joseph J. Davis of Pennsylvania’s Luzerne County told investigators in response to their request for his password. “We both know what’s on there. It’s only going to hurt me. No fucking way I’m going to give it to you.”

A foregone conclusion

Prosecutors in the case said a legal doctrine known as the “foregone conclusion exception” permitted the compelled disclosure of Davis’s password. The doctrine, which originally applied to the compelled production of paper documents, said Fifth Amendment protections against self-incrimination don’t apply when the government already knew of the existence, location, and content of the sought-after material.

In requiring Davis to turn over his password to investigators, the lower-court agreed with prosecutors that the password demand fell under the foregone conclusion exemption. The lower court said the exception applied because, under previous US Supreme Court precedent, the password was tantamount to a key or other tangible property and didn’t reveal the “contents” of the defendant’s mind.

The majority for the Pennsylvania Supreme Court disagreed. Writing for the majority in a ruling handed down on Wednesday, Justice Debra Todd wrote:

Based upon these cases rendered by the United States Supreme Court regarding the scope of the Fifth Amendment, we conclude that compelling the disclosure of a password to a computer, that is, the act of production, is testimonial. Distilled to its essence, the revealing of a computer password is a verbal communication, not merely a physical act that would be nontestimonial in nature. There is no physical manifestation of a password, unlike a handwriting sample, blood draw, or a voice exemplar. As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one’s mind. Indeed, a password to a computer is, by its nature, intentionally personalized and so unique as to accomplish its intended purpose―keeping information contained therein confidential and insulated from discovery. Here, under United States Supreme Court precedent, we find that the Commonwealth is seeking the electronic equivalent to a combination to a wall safe—the passcode to unlock Appellant’s computer. The Commonwealth is seeking the password, not as an end, but as a pathway to the files being withheld. As such, the compelled production of the computer’s password demands the recall of the contents of Appellant’s mind, and the act of production carries with it the implied factual assertions that will be used to incriminate him. Thus, we hold that compelling Appellant to reveal a password to a computer is testimonial in nature.

https://arstechnica.com/?p=1622515

Each month, the US National Oceanic and Atmospheric Administration (NOAA) puts out an analysis of the previous month’s weather after the final tally. The most recent update covers an odd October for the US, where the month included some terrifying wildfire conditions in California. This latest analysis also provides the long-range outlook for the winter months.

October provides another good reminder to Americans that their country is not the entire planet. Courtesy of the jet stream doing its thing, the western US experienced notably cool temperatures for much of the month. A dozen states had Octobers that ranked somewhere around the 8^th coldest on record. Despite warmer temperatures along the East Coast, it was ranked as the 21^st coldest for the nation.

Looking globally, however, the western US was an outlier. Overall, it was the 2^nd warmest October on record, behind only 2015. And with most of 2019 behind us, the final number for the year is crystallizing. NOAA puts the odds of 2019 being among the five warmest years on record at more than 99.9%. (So they’re saying there’s a chance.) More specifically, there’s now about an 85% probability of coming in second behind 2016—exactly the prediction we shared in early February.

Of course, October also saw a number of fires in California, and the state was in near-constant warnings of dangerous fire conditions, which were accompanied by massive (imposed) power outages and evacuations. We saw a repeat of the ugly combination of weather that led to deadly fires in recent years—a late arrival of the rainy season and strong Santa Ana and Diablo wind events.

Many areas hit record measures for vegetation dryness, including the nearly 78,000 acres that burned in the Kincade Fire north of the Bay Area. And as high air pressure formed over the interior of the West, the ingredients were there for fast, dry, warm winds racing downslope over California mountains and toward the sea, stoking wildfires like bellows.

California wasn’t the only place feeling dry, as drought conditions extended across the Southwest, and only enough rain fell to barely help with drought in southern Texas. But again, the eastern half of the country was very different, with a great deal of precipitation lifting last month to the 8^th wettest October on record for the nation as a whole.

https://arstechnica.com/?p=1622495

The country’s largest digital advertising platform is trying to take a stand heading into the 2020 election this week, as it both limits the targeting of political ads and warns would-be political advertisers about making false claims.

On Wednesday, Google made an announcement “clarifying” its advertising policy for political ads, making it clear that outright lies are theoretically not welcome. “Whether you’re running for office or selling office furniture, we apply the same ads policies to everyone; there are no carve-outs,” the company said, adding:

It’s against our policies for any advertiser to make a false claim—whether it’s a claim about the price of a chair or a claim that you can vote by text message, that election day is postponed, or that a candidate has died.

To make this more explicit, we’re clarifying our ads policies and adding examples to show how our policies prohibit things like “deep fakes” (doctored and manipulated media), misleading claims about the census process, and ads or destinations making demonstrably false claims that could significantly undermine participation or trust in an electoral or democratic process.

That said, the company adds, they can’t judge “every political claim, counterclaim, and insinuation,” so they expect the number of ads they block to be low.

Those ads will also have to be aimed at a comparatively broad segment of the population, Google said, to the dismay of campaigns on both the left and the right. While the company will allow political ads to be targeted to users based on age, gender, and postal code, it will not allow more narrow “microtargeting” to highly segmented, granular audiences such as those based on public voter records or political affiliation.

Back to you, Facebook

Google’s statement feels like a direct swipe at Facebook’s now-infamous policy, which exempts politicians and political advertising from the platform’s “community standards” and fact-checking processes.

Google is far and away the largest digital advertising platform, accounting for more than 37% of all US digital advertising spending in a given year. Facebook, however, comes in at second place, taking in about 22% of US digital advertising spending.

Facebook and its CEO Mark Zuckerberg have repeatedly defended the company’s choice to exempt political advertising from standards. “I think if you’re gonna lie, that would be bad,” Zuckerberg offered during congressional questioning last month. “I believe that people should be able to see for themselves what politicians that they may or may not vote down are saying.”

Twitter went a step farther than either Facebook or Google, saying last month it would ban all political ads globally. That policy, which has a certification process for some issue ads, went into effect today.

Twitter CEO Jack Dorsey did take an obvious swipe at Facebook when announcing the company’s policy, saying in a tweet, “It’s not credible for us to say: ‘We’re working hard to stop people from gaming our systems to spread misleading info, buuut if someone pays us to target and force people to see their political ad… well…they can say whatever they want!'”

https://arstechnica.com/?p=1622315

The Federal Communications Commission today voted unanimously to ban Huawei and ZTE equipment in projects paid for by the FCC’s Universal Service Fund (USF).

The ban initially affects future projects paid for by the USF and the use of federal funding to maintain existing equipment. But the FCC is also taking public comment on another plan to require removal of Huawei and ZTE equipment from networks that have already been built. The FCC order establishes a process for identifying other companies whose equipment should be subject to the same ban, too.

Huawei and ZTE are the first ban targets because they “have close ties to China’s Communist government and military apparatus,” FCC Chairman Ajit Pai said. “Both companies are subject to Chinese laws broadly obligating them to cooperate with any request from the country’s intelligence services and to keep those requests secret. Both companies have engaged in conduct like intellectual property theft, bribery, and corruption.”

Pai warned that “hidden ‘backdoors’ to our networks in routers, switches, and other network equipment can allow a hostile adversary to inject viruses and other malware, steal Americans’ private data, spy on US companies, and more.”

The Huawei/ZTE ban will take effect immediately after the FCC order is published in the Federal Register.

The Universal Service Fund distributes $8.5 billion a year and is paid for by Americans through fees on their phone bills. The program includes the Connect America Fund, which gives ISPs money to deploy broadband in rural areas; Lifeline, which provides discounts on phone and broadband service to low-income consumers; the E-Rate broadband program for schools and libraries; and a telecom access program for rural health-care providers.

If the FCC eventually requires ripping out existing Huawei and ZTE equipment, it’s not clear how much money the government would contribute toward that process. The FCC said it is “seek[ing] comment on how to pay for such removal and replacement.”

Problems for small ISPs

All five members of the Republican-majority commission approved the order, but Democrat Jessica Rosenworcel said she worries that the Trump administration will undermine its effectiveness. She said:

When the United States government pursues action against Huawei or ZTE, its objective should be security. But in Washington right now, I fear these issues can easily get swept up into broader trade matters. Despite our actions today, we have to grapple with the fact that at any moment the administration could trade away our security objectives for some momentary advantage in bilateral trade negotiations. I hope that does not occur, but let’s be honest, it has happened before, when this administration reversed course on banning ZTE from doing business in the United States. If it happens again, it will have serious consequences for our credibility.

Democrat Geoffrey Starks said that rural wireless Internet providers make heavy use of Huawei and ZTE equipment and that they will need significant help from the government to replace it. “These carriers are made up of hard-working men and women that serve hard-to-reach communities that the major carriers can’t or won’t serve, operating with small teams and tight budgets,” Starks said.

Republican Michael O’Rielly discussed another potential problem for small carriers, who will not be allowed to use federal funding to maintain existing Huawei and ZTE equipment.

“Our decision to prohibit the use of USF funds to maintain, modify, or support covered equipment in any way may result in some providers having to replace equipment earlier than scheduled when minor changes or repairs need to be made,” O’Rielly said. “Unfortunately, these costs will mostly affect the nation’s smaller providers, which are more likely to have covered equipment and may be relying on USF dollars to remain viable.”

As part of its evaluation of how to replace existing equipment, Pai said the FCC is requiring carriers to “submit information on their use of equipment from Huawei and ZTE as well as the potential costs associated with removal and replacement of such equipment.”

https://arstechnica.com/?p=1622459

The Department of Defense has weighed in against a proposal before the Federal Communications Commission to open the 1 to 2 Gigahertz frequency range—the L band—for use in 5G cellular networks. The reason: segments of that range of radio spectrum are already used by Global Positioning System signals and other military systems.

In a letter to FCC Chairman Ajit Pai, Secretary of Defense Mark Esper pressed for the rejection of the proposal by Ligado Networks (formerly known as Lightspeed), saying, “There are too many unknowns and the risks are far too great to federal operations to allow Ligado’s proposed system to proceed… This could have a significant negative impact on military operations, both in peacetime and war.”

The FCC has already largely brushed aside similar opposition from NASA, the US Navy, and the National Oceanographic and Atmospheric Administration, among others, over another spectrum block in the 24GHz range—which is used by weather satellites for remote monitoring of water vapor. But comments are still being collected on the Ligado plan for sharing the 1675 to 1680MHz block of the L Band. Pai has been supportive of the plan because that range is adjacent to the existing 1670 to 1675MHz block already in use for wireless services.

GPS signals use several blocks of the L band, including a primary channel centered on 1575.42MHz. GPS uses L band signals because of their ability to penetrate cloud cover, rain, and vegetation. The L band is also used by the DOD for a number of other purposes, including tactical air navigation, landing assistance telemetry, Identify Friend or Foe (IFF) signals, and missile range and aircraft telemetry—though the DOD has already had to move some of these applications further up the spectrum range to make room for previous “commercial reallocation.”

Ligado’s request for bandwidth sharing is tied to the company’s planned collaboration with satellite communications company Inmarsat, which would provide satellite coverage for Legato’s 5G network. Inmarsat currently uses L band for mobile satellite communications services, including tactical satellite communications marketed to the military around the 1.5GHz range.

In an email to Bloomberg, Ligado spokesperson Ashley Durmer criticized the DOD’s objections, citing the low power of the proposed 5G signals. “Can it really be true that our military operations are vulnerable to a 10-watt lightbulb?” she wrote. “We don’t think so. But that is what this letter suggests.”

But thanks to the inverse-square law, signals could be susceptible to even low-power signal interference, particularly those from GPS. This is why the original Lightspeed proposal for a blended satellite and 4G network in the 1.525 to 1.555 GHz range was opposed by DOD and others—GPS signals arriving from space could be overpowered by ground-based transmissions, as shown in tests performed in 2011. The tests “demonstrated there are significant detrimental impacts to all GPS applications assessed,” a report from the National Space-Based Positioning, Navigation, and Timing Systems Engineering Forum noted.

https://arstechnica.com/?p=1622329

In October, the Federal Bureau of Investigation issued a warning of increased targeting by ransomware operators of “big game”—targets with deep pockets and critical data that were more likely to pay ransoms to restore their systems. The past week has shown that warning was for good reason.

On November 18, a ransomware attack caused Louisiana’s Office of Technology Services to shut down parts of its network, including the systems of several major state agencies. These included the governor’s office, the Department of Health (including Medicare systems), the Department of Children and Family Services, the Department of Motor Vehicles, and the Department of Transportation. Louisiana Governor John Bel Edwards activated the state’s cybersecurity response team.

Today, we activated the state’s cybersecurity team in response to an attempted ransomware attack that is affecting some state servers. The Office of Technology Services identified a cybersecurity threat that affected some, but not all state servers. #lagov #lalege

— John Bel Edwards (@LouisianaGov) November 18, 2019

While some services have been brought back online—in some cases, within hours—others are still in the process of being restored. Most of the interrupted services were caused by “our aggressive actions to combat the attack,” according to Louisiana Commissioner of Administration Jay Dardenne. “We are confident we did not have any lost data, and we appreciate the public’s patience as we continue to bring services online over the next few days.”

We will Ryuk you (or DopplelPaymer you)

The state did not pay the ransom demanded by attackers, who—based on the analysis of several researchers—were using a variant of the same Ryuk ransomware used in attacks on several Louisiana school districts’ networks in July. That attack prompted Gov. Edwards to declare a state of emergency to allow for state agencies to assist local governments in their recovery from the attack. Ryuk attacks this summer also affected Georgia’s court system and at least two Florida cities.

On November 15, the Charles-Nicolle University (CHU) Hospital in Rouen, France, was hit by ransomware that spread across five sites. The hospital was forced to shut down its networks to prevent the malware from spreading, according to a report from Le Monde, and staff were forced to use paper and pencil for tracking patients. While there were reports of a demand of a ransom payment of 1,500 euros for each of the more than 6,000 computers affected at the hospital, a hospital spokesperson denied that a ransom demand had been made and said none would be paid. As of November 18, about 25% of the hospital’s applications had been restored.

Also on November 15, the government of the Canadian territory of Nunavut suffered a ransomware outbreak that affected about 5,000 computers territory-wide. That attack, according to Nunavut government spokesperson Chris Puglia, used a variant of DoppelPaymer ransomware; the same malware hit Mexico’s state-owned oil company PEMEX on November 12.

Despite documentation of the Pemex attack, company executives have continued to deny the company was affected.

📌 #Pemex🇲🇽reitera hacer caso omiso a boletines apócrifos que circulan en medios de información y redes sociales. Toda la información referente a la empresa productiva del Estado es publicada únicamente por vías institucionales y las redes oficiales.

— Petróleos Mexicanos (@Pemex) November 17, 2019

According to security researcher Vitali Kremez, both the Nunavut and PEMEX ransomware attacks used the same Tor “hidden service” Web portal. Within the portal, the actors behind the ransomware left the note rationalizing their attack: “We don’t care who you are and why this happens. No one died. That’s all.”

While they may or may not use the same type of communications with victims as opportunistic attacks—DoppelPaymer uses a Web portal similar to those used by opportunistic attacks, while Ryuk keeps its communications over email—both of these attacks were targeted rather than opportunistic. While they may use similar initial compromise methods as opportunistic attacks (phishing, automated vulnerability scanning and exploitation, or attacks using Remote Desktop Protocol), targeted attacks are the product of researching a compromised network and releasing the ransomware only after determining who the target is (and how likely they will be to pay). As a result, they require less work for attackers because they reduce the number of victims they need to communicate with.

Diminishing returns due to backups

While it’s not certain whether PEMEX did or did not pay the ransom demanded from the company, the others did not pay—largely because they had disaster recovery and backup systems in place and were able to restore functionality after it was interrupted. And that, according to senior FBI cyber officials, is a key to ending the continuing growth of targeted ransomware attacks.

In a press briefing attended by Ars Technica, senior cyber officials of the FBI speaking on background said that the only real way to stop ransomware attacks was improved “cyber hygiene.” That includes backups and software updates. As part of its effort to help raise state and local agencies’ awareness around ransomware, the FBI recently hosted a ransomware summit in Pittsburgh at Carnegie Mellon University.

But because of a number of issues, state and local agencies, as well as hospitals, have been an easy target for ransomware operators because of their reliance on legacy systems and lack of organic information security skills. This year alone, there have been more than 100 reported ransomware attacks against state and local governments.

https://arstechnica.com/?p=1621979

President Donald Trump toured Apple’s Mac Pro manufacturing facility in Austin, Texas, with CEO Tim Cook on Wednesday.

“We’re seeing the beginning of a very powerful and important plant,” Trump said during the visit. “I want to see Apple building plants in the United States. That’s what’s happening.”

Trump echoed that theme in a tweet after the tour. “Today I opened a major Apple manufacturing plant in Texas that will bring high paying jobs back to America,” he wrote.

Trump neglected to mention a couple of key facts about the facility. First, it’s technically owned by Apple contractor Flex, not Apple itself. More important, it’s not new. Apple has been building the Mac Pro at the same location since 2013.

Apple is opening a new facility in Austin—a 3 million-square-foot office complex where Apple says its employees will perform a variety of functions, including “engineering, R&D, operations, finance, sales and customer support.” In remarks at the Mac Pro plant Wednesday, Cook touted it as a $1 billion investment that will create Apple’s second-biggest site after Apple’s home base in Cupertino.

But that new facility isn’t a manufacturing plant. It will create some high-paying jobs, but they’ll mostly be white-collar jobs in areas like engineering, finance, and sales.

Tariff relief helped Apple stay in the US

Apple’s decision to keep Mac Pro manufacturing in the United States follows contentious negotiations with the Trump administration. Back in June, a Wall Street Journal story suggested that Apple was preparing to move Mac Pro manufacturing to China.

The Journal story included remarks from an Apple spokesman that didn’t dispute plans to move to China. Instead, the spokesman emphasized that “final assembly is only one part of the manufacturing process.”

Behind the scenes, Apple was seeking tariff concessions that would make it more affordable to assemble the Mac Pro in the United States. Several key components of the Mac Pro were made in China, and Apple would incur tariffs if it shipped those parts to the US for assembly.

Donald Trump took a hard line on the issue in a July tweet. “Apple will not be given Tariff waiver, or relief, for Mac Pro parts that are made in China,” he wrote. “Make them in the USA, no Tariffs!”

But then in September, Apple announced that it would continue making the Mac Pro in Austin after all—and the company credited the Trump administration for the shift.

“The US manufacturing of Mac Pro is made possible following a federal product exclusion Apple is receiving for certain necessary components,” Apple wrote in its September announcement. Despite Trump’s threats, his administration granted 10 out of 15 Apple requests for relief from Trump’s 25% tariff on Chinese imports.

https://arstechnica.com/?p=1605137

Amazon subsidiary Ring, which makes home surveillance equipment and cameras, has “partnerships” with more than 600 law enforcement agencies nationwide, allowing those police access to users’ footage. And while Ring says it sets terms around how and when it will share that footage with police, anything the police do with it afterward is entirely out of its hands, the company says.

The partnerships between Ring and police, and the terms of the agreements, have not been transparent to the general public. Instead, they’ve come out in bits and pieces in media reports throughout the year. Sen. Ed Markey (D-Mass.) in September demanded clearer answers from Amazon about Ring and published the company’s responses this week.

In the pair of replies (PDF 1, PDF 2), Ring repeatedly deflects responsibility for the contents of captured footage to the consumers who capture it and the police departments that acquire it.

Who else watches the watchers?

Amazon in the last week of August agreed to share publicly a list of where it has police partnerships. At that time, there were 405 such agreements. As of November 15, however, that map now boasts 630 police partnerships, a greater than 50% increase.

Customers who buy Ring systems for their homes can connect to an app called Neighbors. Police who work in partnerships with Ring have a companion app to Neighbors that allows them to request footage from users in a given geographic area when it’s pertinent to an investigation.

What police do after that, however, is a mystery in which Ring says it has no part.

“Ring does not require law enforcement to delete materials shared through a video request after a certain period of time,” the company said. Law enforcement departments set their own terms for record retention in accordance with the laws of their jurisdiction and can keep it as long as they see fit.

Amazon and Ring also do not have any minimum security requirements for the use of user footage. Partners use their own “requirements, protocols, and security measures” for protecting any Ring data they acquire. And they can share it with whomever they like: “If videos are downloaded by law enforcement, Ring does not require police departments to agree to additional restrictions,” the company said, citing potential public records law and police investigative procedures.

“Ring is constantly seeking ways to maximize transparency and user control, including adding additional information on how video footage may be used when a customer consents,” the company added.

“Volunteered” data and privacy

Amazon has repeatedly said throughout the year that Ring users must volunteer to share their footage in response to a police request. In August, the company told Ars that participating law enforcement agencies must go through Ring to request footage, adding, “Customers can choose to opt out or decline any request, and law enforcement agencies have no visibility into which customers have received a request and which have opted out or declined.”

The minimum region for requesting footage is 0.025 square miles, Ring told Sen. Markey, in order to prevent police from targeting specific individuals. The maximum region is 0.5 square miles, in order to prevent broad blanketing. The maximum time frame of data police can ask for is 12 hours, and they can only get footage less than 45 days old.

In some neighborhoods, housing may be dense enough to effectively mask the identity of someone in a radius of a few blocks. But in lower-density neighborhoods zoned for single-family homes, it could be trivial for police to figure out which residence in a 0.025-square-mile radius is using a camera, regardless of if it shares footage willingly, and which residents they may wish to talk to.

All that said, however, Ring said it believes that “state and federal procedures, regulations, and statutes serve to ensure that police departments do not open investigations or seek information for improper purposes.”

Respecting users and non-users’ privacy is also the camera owner’s problem, Amazon said.

“Ring’s Terms of Service state that users are responsible for their use of our products and services, including use in accordance with any applicable privacy laws,” the company said in response to a question about cameras pointed at public space such as municipal sidewalks that aren’t part of a homeowner’s property. “Ring includes a door/window sticker in the box with each device that is equipped with audiovisual recording capabilities” so that homeowners can prominently notify anyone in the neighborhood that they may be recorded, Amazon added. It has no oversight or compliance program in place for owners, however.

“Amazon Ring’s policies are an open door for privacy and civil liberty violations,” Markey said in a statement following Amazon’s response. “If you’re an adult walking your dog or a child playing on the sidewalk, you shouldn’t have to worry that Ring’s products are amassing footage of you and that law enforcement may hold that footage indefinitely or share that footage with any third parties.”

Especially the kids

Ring’s privacy policy says it does not knowingly collect personal information from anyone under the age of 13. But the cameras, of course, collect footage of whoever happens to be nearby. “Ring has no way to know or verify that a child has come within range of a device,” Amazon wrote. “Customers own and control their video recordings.”

And yet Ring itself seems to have no compunction about showing children under 13 in footage if it’s good for their marketing. For example: 15.8 million Ring doorbells rang in the 24 hours of Halloween, the company said in a blog post.

The company shared some harmless data about all those trick-or-treaters. (Peak time on the East Coast was around 6:30pm, while West Coast kids peaked about 20 minutes later, apparently.) But the company also released a promotional video using captured Halloween footage, including several very clear images of children both with and without their parents present.

Website Mashable asked Ring whether parents consented to their children’s appearance in the advertisement video, but the company did not respond.

Ring’s terms of service allow for it, BuzzFeed pointed out earlier this year:

You hereby grant Ring and its licensees an unlimited, irrevocable, fully paid and royalty-free, perpetual, worldwide right to re-use, distribute, store, delete, translate, copy, modify, display, sell, create derivative works from and otherwise exploit such Shared Content for any purpose and in any media formats in any media channels without compensation to you.

All your face are belong to us

Markey also pressed Ring several times about the use of facial-recognition technology. The company responded that it does not use any facial recognition yet but may do so in the future.

A sentence in its privacy policy to the effect that Ring may “obtain certain facial feature information about the visitors you ask your Ring product to recognize” refers to “a contemplated, but unreleased feature,” the company said. “If our customers want these features in Ring security cameras,” it added, “we will only release these features with thoughtful design including privacy, security, and user control; and we will clearly communicate with our customers as we offer new features.”

What Ring users choose, however, affects not just homeowners who buy the systems but also anyone who gets close enough to their house for any reason.

“Connected doorbells are well on their way to becoming a mainstay of American households, and the lack of privacy and civil rights protections for innocent residents is nothing short of chilling,” Markey said in his statement—a sentiment echoed by civil liberties organizations and advocates.

“Through consumer products like Ring, Amazon is collecting footage and all the data needed to build a nationwide surveillance network,” Fight for the Future deputy director Evan Greer said in a statement.

“They leverage government relationships to promote their own products, gain consumer trust, and secure their position in the market. This is an unprecedented assault on our security, constitutionally protected rights, and communities,” Greer added, calling on Congress to launch an investigation.

The American Civil Liberties Union and Electronic Frontier Foundation have also both repeatedly expressed concerns about Ring, about facial recognition, and about both of them together.

Staff attorney Mohammad Tajsar of the ACLU of Southern California told the Associated Press that the potential for facial recognition in Ring products raised significant concerns. “Even if you don’t sell data or provide data to law enforcement, you’re creating a mechanism whereby people can express latent biases and racism and classism in a portal that encourages it,” he said.

We’re not through

A group of senators, including Markey, found Amazon’s response insufficient. Senators Ron Wyden (D-Ore.), Chris Van Hollen (D-Md.), Chris Coons (D-Del.), and Gary Peters (D-Mich.) joined Markey in a new letter (PDF) dated today asking pointed follow-up questions, particularly about Amazon’s handling of consumer data.

“Ring’s emphasis on safety and security has not always extended to the massive amount of data it amasses, retains, and shares,” the senators wrote, referring to a vulnerability that sent WiFi network passwords in plaintext.

Additionally, the senators wrote, Amazon has reportedly sent footage to contractors in Ukraine and apparently is still doing so. “Please describe the process by which Americans’ data is accessed by employees or contractors in Ukraine or any other country” outside the United States, the letter asks.

Amazon is also told to provide data on how many consumers own Ring devices; what kind of encryption Ring uses for the data; what data retention or deletion policy is used on the data; what employees, and where, have access to what content, and why; what consumer-identifying data might be included in that content; and what the company plans to do about facial recognition in the future.

Amazon has until January 6 to respond to the latest round of questions.

https://arstechnica.com/?p=1604635