How ISPs can sell your Web history—and how to stop them

The legal changes all stem from the FCC’s decision in February 2015 to reclassify home and mobile ISPs as common carriers. The reclassification had numerous effects: it allowed the FCC to impose net neutrality rules, but it also stripped the Federal Trade Commission of its authority over ISPs because the FTC’s charter from Congress prohibits the agency from regulating common carriers.

.. Before the February 2015 reclassification, ISPs could have been punished by the FTC for violating customers’ privacy. But following the FTC rules wasn’t too onerous—the FTC recommends opt-in consent before selling or sharing the most sensitive information, such as Social Security numbers, the content of communications, financial and health information, information about children, and precise geo-location data.  But ISPs could use an opt-out system for everything else, including Web browsing and app usage history.

.. The most prominent example of an ISP monetizing customers’ browsing history comes from AT&T. Starting in 2013, AT&T charged fiber Internet customers at least $29 extra each month unless they opted in to a system that scanned customers’ Internet traffic in order to deliver personalized ads.

Data Is a Toxic Asset

All this makes data a toxic asset, and it continues to be toxic as long as it sits in a company’s computers and networks. The data is vulnerable, and the company is vulnerable. It’s vulnerable to hackers and governments. It’s vulnerable to employee error. And when there’s a toxic data spill, millions of people can be affected. The 2015 Anthem Health data breach affected 80 million people. The 2013 Target Corp. breach affected 110 million.

.. If data is toxic, why do organizations save it?

There are three reasons. The first is that we’re in the middle of the hype cycle of big data. Companies and governments are still punch-drunk on data, and have believed the wildest of promises on how valuable that data is. The research showing that more data isn’t necessarily better, and that there are serious diminishing returns when adding additional data to processes like personalized advertising, is just starting to come out.

The second is that many organizations are still downplaying the risks. Some simply don’t realize just how damaging a data breach would be. Some believe they can completely protect themselves against a data breach, or at least that their legal and public relations teams can minimize the damage if they fail. And while there’s certainly a lot that companies can do technically to better secure the data they hold about all of us, there’s no better security than deleting the data.

The last reason is that some organizations understand both the first two reasons and are saving the data anyway. The culture of venture-capital-funded start-up companies is one of extreme risk taking. These are companies that are always running out of money, that always know their impending death date.

.. We can be smarter than this. We need to regulate what corporations can do with our data at every stage: collection, storage, use, resale and disposal. We can make corporate executives personally liable so they know there’s a downside to taking chances. We can make the business models that involve massively surveilling people the less compelling ones, simply by making certain business practices illegal.

Peter Thiel: The Online Privacy Debate Won’t End With Gawker

Last week, The Daily Beast published an article that effectively outed gay Olympic athletes, treating their sexuality as a curiosity for the sake of internet clicks. The article endangered the lives of gay men from less tolerant countries

.. I had begun coming out to people I knew, and I planned to continue on my own terms. Instead, Gawker violated my privacy and cashed in on it.

.. Terry Bollea is better known as the wrestler Hulk Hogan ..

At first he simply requested that Gawker take down the video. But Gawker refused. It was getting millions of page views, and that was making money.

Should Border Agents Scroll Through Foreigners’ Facebook Profiles?

A proposed change to a common U.S. customs form would allow the government to vet travelers’ social media accounts.

.. The form would ask some visitors to the U.S. to write down their social-media usernames so that agents can gather more information from their public profiles and timelines.

.. “We should have said, ‘We want your social media, both your private stuff and your public stuff,’” said Stephen Lynch, a Democratic representative from Massachusetts, during a heated House committee hearing in December. “That’s entirely reasonable to ask people who are coming from countries that are known to sponsor terror.”

.. Hall was referring to an incident in 2012, when two tourists from the U.K. were refused entry to the U.S., apparently over a pair of misguided tweets. One of the travelers tweeted that he would “destroy America,” a phrase he later said was slang for his intention to party during his trip. He also tweeted that he would dig up Marilyn Monroe’s grave—this, he claimed, was a reference to Family Guy, a TV show. The travelers were turned back at the Los Angeles airport.

.. Most people’s social media presences aren’t entirely accurate reflections of themselves. Hall, for example, often tweets about satanic death-metal music—but no, he’s not a satanist. “I just find it fascinating, and I used to play in a heavy-metal band,” Hall told me. “If you read from that that I’m traveling someplace to commit some sort of ritual, you’d have a pretty bad insight into what I think is important.”

..Of those people, a whopping 28 percent had something in their profiles that raised a red flag. (And that’s among volunteers who already held security clearances.)
.. Of those people, a whopping 28 percent had something in their profiles that raised a red flag. (And that’s among volunteers who already held security clearances.)

.. Comments can only be mailed to CBP’s office in Washington, a restriction Hall says is rare. (Most proposals can be commented on electronically.)