Google to Appeal 50-Million-Euro French Data Consent Fine
Google said Wednesday it would appeal a record 50-million-euro fine imposed by France’s data regulator for failing to meet the EU’s strict new General Data Protection Regulation (GDPR).
“We’ve worked hard to create a GDPR consent process for personalised ads that is as transparent and straightforward as possible, based on regulatory guidance and user experience testing,” the company said in a statement.
“We’re also concerned about the impact of this ruling on publishers, original content creators and tech companies in Europe and beyond,” it added.
“For all these reasons, we’ve now decided to appeal.”
France’s CNIL data watchdog announced the fine Monday, the first in Europe over alleged failings over the tougher data-consent policies.
The agency said Google made it too difficult for users to understand and manage preferences on how their personal information is used, particularly with regard to targeted advertising.
Its ruling followed complaints lodged by two advocacy groups last May, shortly after the landmark directive came into effect.
Even companies not based in Europe must follow the tough new rules if they want their sites and services to be available to European users.
The CNIL found that despite changes implemented by Google since last year, it was still failing to respect the spirit of the new rules.
It said the record 50-million-euro fine reflected the seriousness of the failings as well as Google’s dominant market position in France via Android.
“Each day thousands of French users create a Google account on their smartphones,” the CNIL said.
“As a result the company has a special responsibility when it comes to respecting their obligations in this domain.”
EU-Japan Deal to Protect Data Exchanges Takes Effect
The European Union and Japan on Wednesday launched the “world’s largest areas of safe data flows” after finalizing common rules to protect personal information, the EU said.
Firms can transfer data now that the executive European Commission finds that Japanese law offers “a comparable level of protection of personal data,” the commission said.
“This adequacy decision creates the world’s largest area of safe data flows,” EU justice commissioner Vera Jourova said, referring to an area of more than 600 million people.
“Europeans’ data will benefit from high privacy standards when their data is transferred to Japan,” the Czech commissioner said.
“Our companies will also benefit from a privileged access to a 127 million consumers’ market,” she added.
Jourova said the arrangement “will serve as an example for future partnerships” on data flows and set global standards.
The two sides cleared the final hurdle by agreeing on supplementary rules.
These cover “the protection of sensitive data, the exercise of individual rights and the conditions under which EU data can be further transferred from Japan to another third country,” the commission said.
Japan’s independent data protection authority (PPC) and courts can enforce these rules covering Japanese firms that import data from EU.
Tokyo gave Brussels assurances that any use of personal data for law enforcement and national security purposes would be “limited to what is necessary and proportionate.”
Access by public authorities for these reasons would be “subject to independent oversight and effective redress mechanisms,” the EU executive said.
The two sides agreed to a mechanism to investigate and resolve complaints from Europeans over data access that Japan’s independent data protection authority will run and supervise.
The decision complements the EU-Japan Economic Partnership Agreement, which takes effect next month to become the world’s biggest trade deal.
EU citizens come under the General Data Protection Regulation that took effect in May last year.
The EU has billed the GDPR as the biggest shake-up of data privacy regulations since the birth of the web, saying it sets new standards in the wake of the Facebook data harvesting scandal.
The law establishes the key principle that individuals must explicitly grant permission for their data to be used and gives consumers the “right to know” who is processing their information and what it will be used for.
France Hits Google With 50 Million Euro Data Consent Fine
France’s data watchdog on Monday announced a fine of 50 million euros ($57 million) for US search giant Google, using the EU’s strict General Data Protection Regulation (GDPR) for the first time.
Google was handed the record fine from the CNIL regulator for failing to provide transparent and easily accessible information on its data consent policies, a statement said.
The CNIL said Google made it too difficult for users to understand and manage preferences on how their personal information is used, in particular with regards to targeted advertising.
“People expect high standards of transparency and control from us. We’re deeply committed to meeting those expectations and the consent requirements of the GDPR,” a Google spokesperson said in a statement.
“We’re studying the decision to determine our next steps.”
The ruling follows complaints lodged by two advocacy groups last May, shortly after the landmark GDPR directive came into effect.
One was filed on behalf of some 10,000 signatories by France’s Quadrature du Net group, while the other was by None Of Your Business, created by the Austrian privacy activist Max Schrems.
Schrems had accused Google of securing “forced consent” via its Android mobile operating software through the use of pop-up boxes online or on its apps which imply that its services will not be available unless the conditions of use are accepted.
“Also, the information provided is not sufficiently clear for the user to understand that the legal basis for targeted advertising is consent, and not Google’s legitimate business interests,” the CNIL said.
“We have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products,” Schrems said in a statement after the ruling.
“It is important that the authorities make it clear that simply claiming to be compliant is not enough.”
‘Special responsibility’
The GDPR is widely considered the biggest shake-up to data privacy regulations since the advent of the web.
Even companies which are not based in Europe must follow the tough new rules if they want their sites and services to be available to European users.
The CNIL found that despite changes implemented by Google since last year, it was still failing to respect the spirit of the new rules.
It noted for example that specifics on how long a person’s data is kept and what it is used for are spread across several different web pages.
Modifying a user’s data preferences also requires clicking through a variety of pages such as “More Options”, and often the choices to accept Google’s terms are pre-checked by default.
“This type of procedure leads the user to give global consent… but the consent is not ‘specific’ as the GDPR requires,” the regulator said.
It said the record 50-million-euro fine reflected the seriousness of the failings as well as Google’s dominant market position in France via Android.
“Each day thousands of French users create a Google account on their smartphones,” the CNIL said.
“As a result the company has a special responsibility when it comes to respecting their obligations in this domain,” it said.
It is not the first time the regulator has taken Google to task over its policies.
In 2014 it fined the company 150,000 euros — the maximum possible at the time — for failing to comply with its privacy guidelines for personal data.
And in 2016 it imposed a 100,000-euro penalty over non-compliance with the EU’s “right to be forgotten” rule, allowing people to request having references to them removed from search results.
Goole has contested the decision, saying it should apply only to its European sites, such as Google.fr, and not the global Google.com domain.
Earlier this month the advocate general for the European Court of Justice in Luxembourg sided with Google in the case, though a final ruling has not yet been announced.
Google has been fined €50 million (~$57 million) by French regulators, the first major penalty under a sweeping new European Union privacy law known as GDPR, which took effect last year.
According to the French government agency, known by the acronym CNIL, Google is still in breach of the law.
CNIL explained that Google had violated two provisions of the law: first by not making its data-collection policies easily accessible enough and second by not obtaining sufficient and specific user consent for ad personalization across each of Google’s numerous services, including YouTube, Google Maps, and more.
“It is not a one-off, time-limited, infringement,” the agency said Monday.
The two complaints were filed jointly on the day the law went into effect by the French digital advocacy group La Quadrature du Net and the group Noyb.eu, a watchdog organization started by Max Schrems. The young Austrian privacy activist has been tangling with Silicon Valley giants—notably Google and Facebook—for years.
“Following the introduction of GDPR, we have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products,” Schrems said in a statement. “It is important that the authorities make it clear that simply claiming to be compliant is not enough.”
Noyb, an English acronym for “None of your business,” has also filed related complaints against Instagram, WhatsApp, and Facebook, which remain pending.
Google did not immediately respond to Ars’ request for comment, but it told The Washington Post in a statement that it is “deeply committed to meeting those expectations and the consent requirements of the GDPR.”
https://arstechnica.com/?p=1444181
Report: Facebook’s Privacy Lapses May Result in Record Fine
Facebook may be facing the biggest fine ever imposed by the U.S. Federal Trade Commission for privacy violations involving the personal information of its 2.2 billion users.
The FTC is considering hitting Facebook with a penalty that would top its previous record fine of $22.5 million , which it dealt to Google in 2012 for bypassing the privacy controls in Apple’s Safari browser, according to The Washington Post. The story published Friday cited three unidentified people familiar with the discussions.
In an automated response, the FTC said it was unable to comment, citing its closure due to the U.S. government shutdown. Facebook declined to comment.
The potential fine stems from an FTC investigation opened after revelations that data mining firm Cambridge Analytica had vacuumed up details about as many as 87 million Facebook users without their permission.
The FTC has been exploring whether that massive breakdown violated a settlement that Facebook reached in 2011 after government regulators had concluded the Menlo Park, California, company had repeatedly broken its privacy promises .
The FTC decree, which runs through 2031, requires Facebook to get its users’ consent to share their personal information in ways that aren’t allowed by their privacy settings.
Since the Cambridge Analytica erupted 10 months ago, Facebook has vowed to do a better job corralling its users’ data. Nevertheless, its controls have remained leaky. Just last month, the company acknowledged a software flaw had exposed the photos of about 7 million users to a wider audience than they had intended.
The FTC’s five commissioners have discussed fining Facebook but haven’t settled on the amount yet, according to the Post.
Facebook’s privacy problems are also under investigation in other countries and the target of a lawsuit filed last month by Washington, D.C., Attorney General Karl Racine.
Sen. Marco Rubio wants to ban states from protecting consumer privacy
Enlarge/ Sen. Marco Rubio (R-Fla.) speaks to reporters following a closed briefing on intelligence matters on Capitol Hill on December 4, 2018 in Washington, DC.
Getty Images | Zach Gibson
US Sen. Marco Rubio (R-Fla.) has proposed a federal privacy law that would preempt tougher privacy rules issued by states.
Rubio’s announcement Wednesday said that his American Data Dissemination (ADD) Act “provides overdue transparency and accountability from the tech industry while ensuring that small businesses and startups are still able to innovate and compete in the digital marketplace.”
But Rubio’s bill establishes a process for creating rules instead of issuing specific rules right away, and it allows up to 27 months for Congress or the Federal Trade Commission to write the actual rules.
In addition, the bill text says it “shall supersede” any provision of a state law that pertains to the same consumer data governed by Rubio’s proposed federal law. That includes names, Social Security numbers, other government ID numbers, financial transactions, medical histories, criminal histories, employment histories, user-generated content, “unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation,” and other personal data collected by companies.
California last year imposed a privacy law that gives consumers more control over how their personal data is collected, used, and sold by corporations.
“We oppose any attempt to preempt California’s privacy laws,” Sarah Lovenheim, communications advisor to California Attorney General Xavier Becerra, wrote on Twitter yesterday.
Rubio’s bill based on 45-year-old law
Rubio’s bill wouldn’t do much to protect Americans’ data privacy, consumer advocacy group Public Knowledge said. The Rubio bill uses the Privacy Act of 1974 as its framework; the 1974 law applies to federal agencies, but Rubio’s bill would apply similar rules to the private sector.
“The 1974 Privacy Act is fundamentally a transparency and data accuracy law, designed well before the popularization of the Internet and cloud computing,” and not suited to today’s “constant stream of data breaches and scandals,” Public Knowledge Global Policy Director Gus Rossi said.
“It’s absurd that the bill would preempt state law and constrain the jurisdiction of specialized agencies like the FCC in exchange for very limited protections for consumers,” Rossi also said.
DOJ says 1974 law difficult to enforce
The Privacy Act of 1974 generally prohibits disclosure of data about an individual without that individual’s consent, but it contains various exceptions, and the Department of Justice says the law is difficult to interpret and enforce.
The Act “can generally be characterized as an omnibus ‘code of fair information practices’ that attempts to regulate the collection, maintenance, use, and dissemination of personal information by federal executive branch agencies,” the DOJ says in an overview last updated in 2015. “However, the Act’s imprecise language, limited legislative history, and somewhat outdated regulatory guidelines have rendered it a difficult statute to decipher and apply.”
Despite the DOJ saying the law is confusing, Rubio argued in an op-ed for The Hill that the Privacy Act of 1974 is “widely considered one of the seminal pieces of privacy law in effect today.”
“Any national privacy law must provide clear, consistent protections that both consumers and companies can understand, and the FTC can enforce. That is why my bill leans heavily on the Privacy Act framework,” Rubio wrote.
Rubio’s bill would have the FTC establish a process in which individuals can contact companies to request access to their personal data. Companies would have to either provide the data to consumers or delete the data. If a company lets an individual view the data, the company would have to correct any mistakes if the person demonstrates that the records are “not accurate, relevant, timely, or complete.” Companies would only have to delete the data if they choose not to provide it to consumers upon consumers’ requests.
Upon requests from individuals, companies would also have to tell individuals about instances in which their records have been disclosed to other parties. The FTC would be responsible for enforcing the new rules under its authority to police unfair and deceptive acts or practices.
Rubio wrote that cumbersome regulations might “entrench large, incumbent corporations.”
“Facebook, Apple, Amazon, Netflix, Google (FAANG) and others would welcome cumbersome regulations that prevent start-ups and smaller competitors from challenging the FAANG’s current dominance,” he wrote.
Rubio’s bill instructs the FTC to “establish criteria for exempting certain small, newly formed covered providers from the requirements.”
Rubio justified his proposed preemption of state laws by writing that “a state-by-state patchwork of laws is simply not an effective means of dealing with an issue of this magnitude” and that “Internet data is unquestionably interstate commerce, and it is the responsibility of Congress to take appropriate action.”
Bill delays final rules for up to 27 months
Rubio’s bill would not impose privacy protections immediately upon passage. It would give the Federal Trade Commission six months to submit “detailed recommendations for privacy requirements” to Congress. Congress would have up to two years after the bill’s passage to issue actual privacy requirements. During that time, the FTC would not be able to issue final rules on its own.
If Congress fails to act within two years, the FTC would be authorized to act on its own and would be required to issue final regulations “not later than 27 months after” the bill is enacted.
Congressional Democrats recently proposed a much stricter privacy law, which could issue steep fines to companies and send their top executives to prison for up to 20 years if they violate Americans’ privacy.
https://arstechnica.com/?p=1443415
Marco Rubio Proposes New Federal Data Privacy Bill
U.S. Senator Marco Rubio (R-Fla.) introduced a bill on Wednesday designed to provide privacy legislation for the entire nation — that is, federal law. It is based on the Privacy Act of 1974, which was introduced post-Watergate to protect people from government storage and retrieval of personal data. Rubio’s American Data Dissemination Act (ADD) is designed to do similar, but is aimed at private industry’s collection of personal data.
The key point in the bill is that responsibility is handed to the FTC — who must, within 180 days — submit detailed recommendations for privacy requirements that Congress can then impose. These recommendations must be substantially similar to the requirements of the 1974 Privacy Act. In a contribution to The Hill, Rubio explained, “We should use the non-partisan expertise from the agency of jurisdiction to ensure lawmakers make informed decisions to properly protect consumers.”
If Congress fails to enact the FTC’s recommendations within a further two years, the Act gives the FTC authority to issue a final rulemaking. So, within two-and-half years of this bill becoming law, there will be a federal privacy law for the people of America. Whether it is a strong law or a weak law will depend upon the FTC. The FTC’s mandate is to prohibit “unfair or deceptive acts or practices in commerce”; but it interprets this as protection for both citizens and businesses.
There are two primary guidelines provided by Rubio. The first is to exempt start-ups. The idea is to promote competition. “Facebook, Apple, Amazon, Netflix, Google (FAANG) and others would welcome cumbersome regulations that prevent start-ups and smaller competitors from challenging the FAANG’s current dominance,” writes Rubio. Perhaps Microsoft should be added to FAANG.
The second is to give users the right to access and correct personal records that are not accurate, relevant, timely or complete as defined by the FTC, and a process for deletion of a record. It is not immediately apparent whether deletion can be applied to any record, or only those that are not accurate — such details will come out in the FTC recommendations which will ultimately take precedence over the will of Congress.
Rubio’s proposal is generally welcomed — but with several riders. The first is that as a federal law, it will, through the Constitution’s Supremacy Clause, take precedence over state laws. Consider the strong California Consumer Protection Act (CCPA) that will come into effect next year.
“Both bills seek to establish similar protections for consumers,” explains Attila Tomaschek, digital privacy expert at BestVPN.com, “but Californiaís bill is markedly more strict on businesses than Senator Rubio’s proposal in that it gives ‘personal data’ an extremely broad definition, severely limiting what data can be collected and used freely by businesses with customers in California.”
Companies like Facebook have customers both within and outside of California. These companies would be bound by the federal law and not the California law.
“Senator Rubio’s proposed national privacy regulation is a step in the right direction,” comments Anupam Sahai, VP of product management at Cavirin. “However, any law needs to provide real protection, along the lines of the EU GDPR or Californiaís Consumer Privacy Act. One issue with the proposal is that it preempts state laws which may offer more comprehensive privacy guarantees. This is a step in the wrong direction.”
The relevance of the 1974 act in 2018 is also questioned. “While we should celebrate our federal government’s attention to this global challenge,” Shahrokh Shahidzadeh, CEO at Acceptto told SecurityWeek, “it is worth stressing that the Privacy Act of 1974 guardrails are not sufficient and may not be the right framework for two core reasons: firstly, the validity of exemptions in 2020 compared to 1974; and secondly, the reality that the boundary-perimeter of our world has changed significantly in the last four decades.”
Shahidzadeh, like Sahai, believes a better framework would be Europe’s GDPR — and this raises a further point. American companies trading with Europe will have to comply with the Privacy Shield operating between the EU and the U.S. This in turn means that these companies will have to offer privacy comparable to GDPR.
However, during the six months in which the FTC develops its recommendations, it will be subject to extensive lobbying from FAANG. If the FTC proposals come out weaker than GDPR, then Privacy Shield (already criticized by many Europeans) will be rocked and perhaps even scrapped by Europe. The problem here is that the FTC’s recommendations will inevitably be weaker than GDPR through the requirement to exempt small, new businesses.
Rubio fears that excessive regulation will inhibit new business — and there is indeed great debate over this. In a paper published in November 2018, Jian Jia and Liad Wagman of the Illinois Institute of Technology and Ginger Zhe Jin of the University of Maryland show that European tech firms are receiving less venture funding than their U.S. counterparts; and this primarily applies to early-stage investments. Such companies “are particularly susceptible to a negative effect from GDPR,î wrote the researchers.
However, this conclusion is questionable; there are other issues at play in Europe. The ‘will she, won’t she and under what conditions’ Brexit affair has caused considerable EU-wide economic uncertainty; and investors hate uncertainty. Furthermore, the European Venture Report produced by PitchBook and published in October 2018, notes that while overall European investment has dropped, the share of capital received by software firms is higher than ever. The question whether strong legislation inhibits new business is moot.
Concerns over Rubio’s proposal, including trade with Europe and precedence over state laws, aside, it is generally accepted that the U.S. needs a single federal law for all Americans — just as GDPR is in effect a single federal law for all Europeans, taking precedence over any weaker (but not stronger) national laws. “Perhaps if Senator Rubio’s bill would allow for individual States to enforce certain provisions, instead of overriding State privacy laws and affording all jurisdiction to the FTC, the bill would be more effective for both consumers and businesses alike,” comments Tomaschek.
“With large scale data breaches occurring more commonly each year, concludes Timur Kovalev, chief technology officer at Untangle, “it is great to see a focus on data privacy with the recently proposed American Data Dissemination (ADD) Act. The ADD Act aims to create concrete rules on privacy for major commercial companies to follow within the United States. Currently, individual states are responsible for establishing their own privacy laws. The ADD Act would supersede state laws, even those states with stricter rules, which could make this Act difficult to pass. With Europe passing their own privacy rules with GDPR, data privacy is becoming a necessary conversation for governments all over the world. As hackers evolve their tactics and cybersecurity concerns continue to escalate, data privacy and consumer protection need to be top of mind for governments and businesses alike.”
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
Bug in Twitter Android App Exposed Protected Tweets
Twitter revealed on Thursday that users of its Android application may have had their supposedly protected tweets made public due to a bug.
When a new Twitter account is created, the tweets posted by the user are public by default. However, users can ensure that only approved followers can see their posts by using the “Protect my Tweets” option from the account’s “Privacy and safety” settings.
However, due to a flaw, people who used Twitter for Android may have had the protected tweets setting disabled if they made certain changes to account settings, such as modifying the associated email address.
According to the social media giant, the bug existed between November 3, 2014, and January 14, 2019, when a patch was released.
Twitter says it has notified impacted users and re-enabled the protected tweets option if it was disabled. The company claims the flaw did not impact the iOS app or the web version.
“We are providing this broader notice through the Twitter Help Center since we can’t confirm every account that may have been impacted. We encourage you to review your privacy settings to ensure that your ‘Protect your Tweets’ setting reflects your preferences,” Twitter said.
This is not the first time in recent months that Twitter has disclosed information exposure bugs. In May of last year, Twitter warned users that a bug caused plaintext passwords to be stored in its internal logs.
In September, the company reported that a flaw exposed the direct messages of millions of users to third-party developers for well over a year. In December, a researcher revealed the existence of a vulnerability that resulted in Twitter apps getting more permissions than they claimed.
In mid-December, Twitter told users that it may have been targeted in a state-sponsored attack. The incident was discovered during the analysis of an information disclosure flaw affecting one of its support forums.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Woman sues T-Mobile after employees allegedly snoop on racy private video
Enlarge/ A T-Mobile logo on the window of a retail store in Washington, DC, on Thursday, Oct. 23, 2014.
A New Jersey woman has sued T-Mobile in state court last week for sexual harassment, invasion of privacy, and other counts. She claims that, when she went to trade in her iPhone 7 at a store, two male employees rifled through her photos without her consent.
The men allegedly quickly found a private naked video of the woman, referred to in the complaint as “N.E.,” and played it for themselves. The woman was mortified.
Ars contacted T-Mobile, which did not respond to our questions.
“We take customer privacy extremely seriously and are investigating the claims,” a spokesperson wrote, declining to elaborate.
Ars also contacted Lorena Ahumada, an attorney for T-Mobile, who did not respond.
Justin Sachs, the manager of this particular T-Mobile store at the Hamilton Mall in Mays Landing, just outside of Atlantic City, told Ars that he wanted to apologize to N.E.
“We know that it’s unacceptable, to be going through a customer’s private information,” he told Ars. “Any confidential information, finding out something you accidentally clicked on.”
Sachs said that he has worked for Executive Cellular Phones, the contracted company that runs this store, for five years, and is unaware of any similar incidents.
He also said that T-Mobile investigators reviewed internal surveillance video but was not able to definitively determine if the two men accessed N.E.’s phone. Since the incident, Sergio, one of men, still works at the store. Another one, Victor, resigned from the store in December to take a new job.
“How would you feel about that, if without your permission, someone was rifling through your phone?” Sachs tells new employees, underscoring that it is potentially a fireable offense.
In August 2018, a Wisconsin man who worked at a Verizon store involved in a similar criminal case was sentenced to five months in jail and three years probation.
Saved by AirPods?
In an interview with Ars, N.E. laid out her story. It began last November, just days before Thanksgiving, when she walked into the store.
She works in another part of the same mall and sought advice on a possible iPhone upgrade. Once in the T-Mobile store, N.E. saw another woman that she was acquainted with. This acquaintance, who worked in the store, directed her to two male employees.
N.E.’s phone was broken: the screen was cracked and the microphone had stopped working, so she relied constantly on her wireless AirPods.
The men seemed to be helpful at first, and one offered to do a trade-in for her, telling her that she could upgrade to a newer iPhone XR for just $90. They asked her to unlock her phone and disable Find My iPhone to begin the data transfer to a new device. She did so and stepped away to consider the various XR color options.
Then, all of a sudden, she could hear in the AirPods—the men may not have known she was wearing them, as her long hair covered the headphones—a distinct sound.
N.E. turned around and marched up to the men, grabbing her phone from one of them.
“He probably saw me coming,” she told Ars. “So I started going through all my pictures and my videos, and I replayed them. When you go to the camera roll, that video—you can spot it. There are so many squares, and there is one that you can see what it is. One video was very obvious what it was.”
N.E. described the video in general terms to Ars and acknowledged that it showed her naked. The video was only meant to be seen by one other person, her fiancé.
N.E. was mortified and left the store immediately in tears. As a recent immigrant from the Middle East, she particularly didn’t want her parents to know that she had filmed such an intimate video and, worse, had kept it on her phone where others could find it.
“I didn’t want anyone in the store to know anything was wrong,” she said. “I didn’t want to make a big deal out of it.”
But after a few moments, N.E. returned to the store and went straight to her female acquaintance and asked to simply finish her transaction. She didn’t confront the men. The transfer took some time, and she even stayed until after the store had closed until it was complete. The men didn’t approach N.E.
“It didn’t even bother them, as if I was nothing,” she continued. “I felt worthless because, hello, I’m a human being and this is something that’s very private. It’s like I’m not important. I felt powerless, because I couldn’t say anything about it in the moment.”
Multiple defendants
N.E. told her fiancé what had happened, and he was outraged. The fiancé called T-Mobile’s customer service, expressing grave concern over the violation of customer privacy and worry that this video may have been further shared without N.E.’s consent.
But after being passed on to another T-Mobile representative, Michael, the fiancé was ultimately unsatisfied as to the company’s response. T-Mobile had promised him investigate surveillance footage from the store and conduct further inquiry, but the company seems to have made no effort to do so.
“[T-Mobile was] treating it like someone had walked into the store and wasn’t greeted well,” N.E. told Ars.
Eventually, N.E. found attorneys and filed her lawsuit on January 11, 2019. In addition to T-Mobile, the case also names as defendants: Executive Cellular Phones, the company that contracts with T-Mobile to run that store; one of the two men, Victor; and the other man whose identity remains unidentified in the civil complaint.
One of N.E.’s attorneys, Christian McOmber, told Ars that it was difficult to know what the end result would be for a case like this.
“It’s difficult to give any financial estimate, because cases are settled,” he said. “In some ways this is a new frontier. Now the court systems are catching up.”
But, he noted, his firm would be aggressive.
“You can’t harass somebody who is trying to do business with you,” McOmber added. “We’re looking for significant compensation for her, because concrete doesn’t fix sidewalks. Judgements fix sidewalks. T-Mobile needs to take responsibility for their operators. They need to be responsible for their services, for the training, for the qualification, and their oversight, and here they’ve neglected to do all of that.”
https://arstechnica.com/?p=1442971
773 Million Records Amassed in Massive Data Breach Collection
A newly discovered set of compromised login details contains roughly 773 million email addresses, Australian web security expert Troy Hunt reveals.
For years, Hunt, who is a Microsoft Regional Director, has been maintaining Have I Been Pwned, a data breach search website that allows users to check whether their email addresses and passwords have been compromised in publicly known data breaches.
Today, he added information from yet another massive data breach to the website, which included a total of 2,692,818,238 rows, representing email addresses and passwords.
Named “Collection #1,” the database is made up of many different individual data breaches from thousands of different sources. The researcher identified a total of 1,160,253,228 unique combinations of email addresses and passwords in the dataset.
Because the data wasn’t properly formatted, however, much of the information was dismissed, yet a total of 772,904,991 unique email addresses were identified. The dataset also revealed 21,222,975 unique passwords (after clean-up).
“This is the headline you’re seeing as this is the volume of data that has now been loaded into Have I Been Pwned (HIBP). […] This number makes it the single largest breach ever to be loaded into HIBP,” Hunt says.
The leaked information appeared on the popular cloud service MEGA and included over 12,000 separate files and more than 87GB of data. It was also being offered on a popular hacking forum, where it was referred to as “a collection of 2000+ dehashed databases and Combos stored by topic” and said to contain 2,890 files.
Hunt warns that, although he did recognize many legitimate breaches in the list, he did not verify the origin of the data, noting that some of the services claimed to have been compromised might have not been involved in a data breach at all.
“However, what I can say is that my own personal data is in there and it’s accurate; right email address and a password I used many years ago,” he notes.
“Like many of you reading this, I’ve been in multiple data breaches before which have resulted in my email addresses and yes, my passwords, circulating in public. Fortunately, only passwords that are no longer in use, but I still feel the same sense of dismay that many people reading this will when I see them pop up again,” Hunt also notes.
Some of the passwords were stored as cryptographic hashes, but the data also contained passwords that have been cracked and converted back to plain text.
Anyone interested in learning if they might have been impacted can head over to HIBP and check whether their email address has appeared in a data breach. The website also includes a free notification service that informs users when their email address appears in a breach. According to Hunt, of the 2.2 million people subscribed to the service, 768,000 are in the new breach.
“Massive data breaches like Collection #1 create huge spikes in bot traffic on the login screens of websites, as hackers cycle through enormous lists of stolen passwords. While this is often framed as a problem for the individuals who own the passwords, any online business that has a user login web page is at risk of becoming the next breach headline,” Distil Co-founder Rami Essaid told SecurityWeek in an emailed comment.
“While it’s important that individual web users have strong, secure logins, the onus is on the businesses to detect and block malicious bot traffic before large-scale password hacks can occur,” Essaid continued.
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
