Category Archives: Law: Privacy

Windows 7 Phones Home Every Time You Change Networks

Posted on May 18, 2011 by Michael Froomkin

Win 7 phones home every time it connects to to a network. Microsoft keeps records of your IP numbers. And it doesn’t poll just once, but repeatedly during a session.

The good news is that, not only can you disable the service, you can even tell it to check your own server instead. If you have a server.

But it does seem like quite a lot of work. And they know your IP address anyway every time you run windows update, so the gain of changing all this is limited.

Incidentally, there is a real legal issue here: Microsoft is collecting a huge pile of data that tells it something, more or less reliable, about where users are and how long they are there. I wonder if this is compatible with data protection law in the EU (which I know considered protecting IP numbers as far back as 2008, but I don’t know if this was actually formalized). I suspect this creates a real legal problem in Switzerland.

Posted in Internet, Law: Privacy | Comments Off on Windows 7 Phones Home Every Time You Change Networks

Wisconsin Court of Appeals Cites My ‘Death of Privacy?’ Paper

Posted on May 17, 2011 by Michael Froomkin

In State v. WALLI, 2011 WL 1775995 (Wis.App., May 11, 2011), the Wisconsin Court of Appeals, 2nd District, cites to my The Death of Privacy? article.

The case was a fairly routine-looking DUI, but the Court of Appeal decided to use it as a vehicle to settle a more general question of law:

Because the first step in this analysis requires us to review the trial court’s findings of historical facts and, in this case, those findings are based in part on a video recording of the event, this court, sua sponte, issued an order converting this appeal from a one-judge appeal to a three-judge appeal and requested the attorney general to file a supplemental brief on the appropriate standard of review. With the near ubiquitousness of squad car video cameras, surveillance cameras and traffic cameras, appellate courts will be deciding more and more cases where some of the evidence is preserved on recordings.

(footnotes omitted). Death of Privacy? got cited for the ubiquitousness point, which is fair enough, although not exactly central to the main issue the court was concerned about.

The standard of review for decisions based on recorded evidence is debatable because a reviewing court ought to be as able to review recordings as is the trial court; the same cannot be (or at least, is not) said about testimonial evidence, since the trial court sees the live witness while the reviewing court sees only the ‘cold’ written record. Traditionally Anglo-American legal systems tend to give a great deal of weight to the seeing of live witnesses by triers of fact, whether or not this in fact enhances accuracy; civil law systems, I gather, do not have the same fetish.

States differ on the appropriate standard of review in such cases, but the Wisconsin Court decided that “clearly erroneous” was indeed the test it would apply when a trial court makes an evidential determination based on a combination of testimony and recorded evidence rather then the far less deferential “de novo” standard urged by the appellant. The perhaps more interesting issue of what standard of review would apply if all the evidence were recorded is not decided in this case, at least not explicitly.

Posted in Law: Criminal Law, Law: Privacy | 2 Comments

State Cops Have a Device that Secretly Searches Cellphones

Posted on April 20, 2011 by Michael Froomkin

Wait a minute.

The American Civil Liberties Union of Michigan urged the Michigan State Police MSP today to release information regarding the use of portable devices which can be used to secretly extract personal information from cell phones during routine stops. For nearly three years, the ACLU has repeatedly asked for this information through dozens of Freedom of Information Act requests, but to date it has not been provided.

ACLU Seeks Records about State Police Searches of Cellphones via Pogo Was Right.

Michigan state cops — and thus presumably lots of other state and federal cops and TLAs — have a secret “portable devices that have the potential to quickly download data from cell phones without the owner of the cellphone knowing”? And they’ve had it for three years?

This has to be tinfoil stuff, right? Right?

Uh-Oh..

According to CelleBrite, the manufacturer of at least some of the devices acquired by MSP, the product can extract a wide variety of data from cellphones including contacts, text messages, deleted text messages, call history, pictures, audio and video recordings, phone details including the phone number and complete memory file dumps on some handsets.

CelleBrite touts itself online as a “maker of mobile forensics and data transfer solutions”.

Cellebrite’s mobile forensics products enable extraction and analysis of invaluable evidentiary data including deleted and hidden data for military, law enforcement, governments, and intelligence agencies across the world.

Among the goodies in their product line is the Cellebrite UFED Forensic System:

The Cellebrite UFED Forensic System is the ultimate standalone mobile forensic device, ready for use out in the field or in the lab.

The UFED system extracts vital information from 95% of all cellular phones on the market today, including smartphones and PDA devices (Palm OS, Microsoft, Blackberry, Symbian, iPhone, and Google Android). Simple to use even in the field with no PC required, the UFED can easily store hundreds of phonebooks and content items onto an SD card or USB flash drive.

Cellebrite UFED supports all known cellular device interfaces, including serial, USB, infrared, and Bluetooth. Extractions can then be brought back to the forensic lab for review and verification using the reporting/analysis tool. Cellebrite works exclusively with most major carriers worldwide including Verizon Wireless, AT&T, Sprint/Nextel, T-Mobile, Rogers Wireless – Canada, Orange France and Telstra Australia, as well as 140 others. This ensures that future devices are supported prior to retail launch.

Yikes. Does this sort of search violate the 4th Amendment? It should, but presumably the courts will treat it much like an actual search of a phone incident to a stop. Courts, such as the California Supreme Court recently, have held that such searches are allowed incident to arrest — but it doesn’t follow that a such an intrusive search would be allowed incident to a stop since there’s no way to hide a weapon in a cellphone SIM card; also not all stops are equal.

Posted in Law: Criminal Law, Law: Privacy | 3 Comments

Videosurveypanel.com’s Amazing Contractual Terms

Posted on January 28, 2011 by Michael Froomkin

I mistyped the address for Youtube.com (I left off the final letter), and got redirected to videosurveypanel.com, which managed to convince me for a considerable period of time that it was running a survey for YouTube. It wasn’t until I dug into the unbelievably one-sided contract terms that I got suspicious – it didn’t sound like Google could be this evil. And (thanks to searching on Google) I confirmed that it wasn’t.

Not only is the way they reel you in borderline deceptive — I think YouTube would have a good shot at a trademark claim since I was genuinely deceived for some time and YouTube would very likely win a UDRP action — but the contract really is an amazing piece of draftsmanship: so one-sided as to likely not be enforceable (EDIT: against the user; the user could have various claims against the company. So could the FTC.).

Here’s what you see at first:

You’ve been selected from the Miami region to take part in our annual visitor survey.
This will only take 30 seconds of your time and will enhance user experience.
Upon completion you will have the opportunity to get a free Macbook Air, Sony Vaio, or Vizio HDTV.

Even at the outset I think “get” is a bit tacky for what I presume is going to be a minuscule chance to win a drawing sometime in the far future, but hey, it’s marketing. The questions were gender, age group, number of videos watched online a week (4-10), and how much I hate ads in videos (a lot). Then on to to the register for the sweepstakes part of the show. I “chose” the flashy laptop from the option. The next screen invites me to give my email and cellphone number under a headline saying

Thank you for your response.
If you are interested, this is your opportunity to
Get your free gift

There’s that “get” again. Nothing yet about odds. Of course, I’m not going to give my phone number without seeing the Privacy Policy. And it turns out to be dire.

First, they can change it retroactively any time:

[The Company] reserves the right to revise this Privacy Policy at any time simply by posting such revision, so we encourage you to review it periodically.

Second, if I give them a cellphone number (what if I don’t have a cell? presumably I’ve violated the terms of the offer?) they will spam me with ads.

By completing and submitting a registration form you are consenting to receive SMS, wireless or other mobile offering to your cell phone. You understand that your wireless carrier’s standard charges and rates apply to these messages. To unsubscribe or discontinue SMS messages, send “STOP”, “END”, or “QUIT” to the SMS text message you have received and the SMS sender will unsubscribe you from further SMS messages within 10 days of receiving such request.

Since I don’t have a texting plan, I’ll pay for each of them until I tell them to stop. Even though they have computers, it will take the squirrel in the cage in the back room ten days to do the data entry.

Third, they will sell my data to advertisers:

When you answer “yes” or “no” to a survey question, some or all of the information that you submitted during the website registration process will be transferred to advertisers that we believe may be of interest to you without providing you with another opportunity to review the information.

When you select “yes” next to an offer, we will transfer some or all of the information that you submitted during the website registration process to the applicable advertiser without providing you with another opportunity to review the information either with our own technology or a 3rd party proxy.

Surely, by saying I want the laptop, they will say I’ve agreed to the above. And even if not, they’ve still got me:

By completing and submitting a Company registration form, you are consenting to receive marketing communications from the Company and its third party marketing partners. If, after you have shared your information with the Company, you decide that you do not want to receive marketing communications from the Company and its third party marketing partners, you can discontinue the communications and following the opt-out instructions. If you have registered or submitted information under more than one e-mail account, you must submit separate unsubscribe requests for each account.

Fourth, if all that wasn’t enough, there is a separate document called Terms on the first page of the survey, and “Terms and Conditions” at the end of the privacy policy. It turns out this isn’t a lottery at all.

It purports to be one heck of webwrap contract:

This promotion is conducted exclusively by www.videosurveypanel.com, and is subject to participation terms and conditions. Receipt of your item requires compliance with offer terms, including: age and residency requirements; registration with valid e-mail address, shipping address and phone number; completion of user survey and sponsor offers. Upon completion of all requirements, we will ship your incentive gift to your verified shipping address. Fulfillment may be delayed based on availability.

Oh-oh: “completion of user survey and sponsor offers”. Typically that means jumping through a nearly endless series of hoops. If you find a single question too intrusive – no prize. If you miss a single complex detail designed to make you fail on a tight deadline – no prize. If you can’t prove you jumped through all the hoops – no prize.

By now I’m really puzzled: I expected better from Google. (And indeed, this turns out to have nothing to do with Google, so that’s one good thing about this.)

But let’s soldier on through the Terms & Conditions and see what they say.

It doesn’t start well:

PLEASE READ THESE TERMS & CONDITIONS CAREFULLY BEFORE USING THIS WEBSITE. BY USING THIS WEBSITE, YOU AGREE TO BE BOUND BY, AND TO COMPLY WITH, THESE TERMS & CONDITIONS UNLESS YOU OFFER DIFFERENT TERMS THAT ARE ACCEPTED IN WRITING BY www.videosurveypanel.com . IF YOU DO NOT ACCEPT THESE TERMS & CONDITIONS, YOU ARE NOT AUTHORIZED TO ACCESS OR USE THIS WEBSITE FOR ANY PURPOSE.

Leaving aside that webwrap contracts are almost certainly not enforceable if the user isn’t forced to read and acknowledge them, taken literally this language means I can’t even read the Terms & Conditions unless I agree with them. Or that by reading them, I’m agreeing to them. Sloppy and mean. And not founded in law.

The next paragraphs is no better. It seems I’m acknowledging that I love them:

By registering on this website, you are certifying you have read, understand and agree to these Terms & Conditions, as well as our Privacy Policy. Our Privacy Policy can be accessed and reviewed here. You also acknowledge that this website provides valuable rewards to consumers who respond to and complete the specified number of advertiser offers and that you are accessing this website solely for this purpose.

Note the ominous but undefined “specified number of advertiser offers” they intend to try to make customers sign on to.

But don’t worry: if it looks like you might win a valuable prize, videosurveypanel.com reserves the right to give you a single piece of bubblegum instead:

www.videosurveypanel.com reserves the right, in its sole discretion, to revise these Terms & Conditions at any time, for any reason, without notice. www.videosurveypanel.com also reserves the right, in its sole discretion, to change the methods through which future rewards are earned. This may include changing the approval requirements necessary to receive future rewards by increasing or decreasing the number of advertiser offers that must be completed to qualify, and adding or decreasing the amount of steps to confirm that you have a legitimate account. www.videosurveypanel.com may also add or remove any product or service listed as a reward at any time. If www.videosurveypanel.com replaces a reward, the new reward may not be of equal value.

Note that by now we don’t even have a contract, since they haven’t actually promised anything at all. But if you don’t like it, well, you’ve violated the terms of service:

Please check these Terms & Conditions periodically for changes. Your use of this website following any such modification constitutes your agreement to follow and be bound by the Terms & Conditions as modified. The last date these Terms & Conditions were revised is set forth below. IF YOU BREACH ANY OF THESE TERMS & CONDITIONS YOUR RIGHT TO USE THIS WEBSITE WILL TERMINATE AND YOUR ACCOUNT WILL BE DISQUALIFIED.

(Bold in original)

And it gets worse. The “rewards” are not actually rewards.

To qualify for the reward on this particular website, you may be required to complete reward offers from the Silver, Gold, and Platinum Offer Pages. Please refer to the requirements of each reward carefully.

*Please note that available reward offers will vary. Some reward offers require a purchase. Credit card offers may require you to activate the card by making a purchase, transferring a balance or taking a cash advance.

Got that? It’s going to be a very bad deal. But you can’t back out when you want to:

(1.) Your account/reward eligibility will expire 60 days from the date you register on this website. Upon expiration, you will no longer be eligible to receive the reward.

(2.) There is no way to cancel an account. If you no longer wish to remain a part of this website, you should refrain from accessing your account.

Yes a very very bad deal indeed. A couple of pages into the (very long) document, we finally get some hints of what is in store:
Continue reading →

Posted in Law: Everything Else, Law: Internet Law, Law: Privacy | 5 Comments

Recommended Reading

Posted on January 21, 2011 by Michael Froomkin

Christopher Soghoian, The History of the Do Not Track Header.

Posted in Law: Internet Law, Law: Privacy | Comments Off on Recommended Reading

While You Were Out

Posted on November 22, 2010 by Michael Froomkin

Reality-based Christopher Soghoian writes in the aptly-named slight paranoia blog that the DOJ has granted itself new surveillance powers.

Then he documents it.

Posted in Law: Privacy | 1 Comment