Browser privacy tools still lack bite, security analysts say

Browser vendors continue to implement privacy in a halfhearted way, with Internet Explorer's default use of cookie "do not track" technology being the best of a weak job, a new assessment by NSS Labs has argued.

Currently, the latest versions of all four leading browsers—IE, Firefox, Chrome, and Safari—implement Do not track - but only Internet Explorer 10 installs it switched on by default, NSS Labs' latest Comparative Analysis found.

The cookie-tracking setting can be enabled in the other three, but only by locating an option in a menu setting. The authors are especially critical of Chrome, which requires users to find and expand a nested Advanced Settings tab to enable the feature.

Even Microsoft treats the do not track as a design afterthought, burying the settings where only the most curious non-expert users might chance upon it.

NSS Labs interprets this lack of enthusiasm for the setting as revealing each vendor's "philosophical views on consumer privacy," while accepting that do not track remains ineffective as a privacy control while advertisers remain free to ignore it as they please.

browsers
"Until legislation is passed that will mandate compliance with the user intent of Do not track, the feature will remain a polite request that will be ignored by the advertising industry," write authors Randy Abrams and Jayendra Pathak.

With third-party cookies, Safari and IE are given the thumbs up, with the former blocking all by default, and IE implementing a partial block. Although Firefox and Chrome don't activate this setting by default, Firefox in particular offers granular control over a setting that is vital to automate access to many commonly used sites.

Other privacy features—the ability to control geolocation, private browsing, and tracking protection lists—all fall down to some extent.

Controlling geolocation (the ability for a site to detect a user's country location), all four browsers prompt as required, but in order to disable the setting completely Firefox forces users to access the technically demanding about:config page.

Uniquely, IE9/10 allows Tracking Protection lists from third-party vendors, essentially lists of sites for IE to block third-party cookies automatically unless the setting is overridden by the user.

Overall, then, IE comes out on top for privacy thanks to the relative simplicity of its slider controls and privacy templates, but none of the four are given a ringing endorsement.

It remains unclear to what extent browser privacy and features such as do not track are valued or even understood by users. A YouGov poll from late last year found that consumers valued ease of use more highly than the ability to block cookies, although the same survey admitted that many disliked targeted ads which follow users even when they have left sites.

Do not track has certainly upset some advertisers, with the Digital Advertising Alliance (DAA) recently lobbying a W3C discussion on how to standardize the way that not track should work.

Some privacy advocates question mobile apps agreement

A proposed code of conduct for mobile app developers intended to make them explain how user data is collected and used does not have a clear enforcement mechanism,  one privacy advocate said.

The code was negotiated this week by several trade groups and the U.S. National Telecommunications and Information Administration (NTIA). While many participants in the NTIA's mobile privacy negotiations voiced support Thursday for the transparency code of conduct, Consumer Watchdog criticized the document and the NTIA process.

Just two participants voted to fully endorse the code, while 20 supported it, 17 voted for further consideration and one objected. Participants voicing support had no obligation to adopt the code, the NTIA said.

"This is absurd Orwellian doublespeak," John Simpson, Consumer Watchdog's Privacy Project director, said in an email.  "A company can put out a press release saying it supports the transparency code, boosting its public image and then do absolutely nothing."

Several consumer and privacy groups voted to support the code, including the American Civil Liberties Union, Consumers Union, the Center for Democracy and Technology and the Electronic Frontier Foundation.

The code defines a short notice to provide consumers with information about the data collection and sharing practices of the mobile apps they use. The short notices tell consumers if the apps are collecting biometrics, browser history, contacts, financial information, health information, location, and other information.

NTIA Administrator Lawrence Strickling, called Thursday's vote a "seminal milestone in the efforts to enhance consumer privacy on mobile devices. "

Several software trade groups also praised the transparency code. The short notice will quickly and easily inform consumers about the personal information apps collect, said Jon Potter, president of the Application Developers Alliance.

"App developers know that consumer trust is critical to our industry's continuing success," Potter said in a statement. The agreement that "the model notices are ready for introduction and consumer testing is a win for both consumers and app developers."

But Jeffrey Chester, executive director of the Center for Digital Democracy, criticized the NTIA's negotiation process. Chester, who abstained from the vote, had asked the NTIA to review existing mobile and app practices to determine the extent and range of data collection, but the agency didn't do that, he said.

"The NTIA process is seriously flawed," he said in an email. "It's as if a surgeon was allowed to operate without first examining the patient. [The agency] refused to make the industry discuss all the ways mobile apps use data and target users."

The code approved Thursday "is just words on a very small screen," Chester added.

EU privacy watchdog criticizes 'Big Brother' database

A plan to set up a massive database of every non-European Union citizen entering and leaving the bloc is disproportionate, Europe's data privacy watchdog said Friday.

The European Data Protection Supervisor (EDPS), Peter Hustinx described the so-called "Smart Borders" initiative as intrusive and uneconomic, and said its aims could probably be achieved more efficiently by using already-existing databases.

In February the European Commission proposed setting up a Registered Traveler Programme (RTP) aimed at frequent business travelers or those with relatives in the E.U.; and an Entry/Exit System (EES). The RTP would make use of automated border control systems such as automated gates for pre-screened visitors, while the EES would digitally record the time and place of entry and exit of third-country nationals and issue an alert to national authorities when there is no exit record by the expiry time. The current practice when checking a third-country national wanting to cross the E.U.'s external borders is based mainly on the stamps in the travel document.

But, Hustinx said Friday, "There is no clear evidence that the Commission proposals will fulfil the aims that it has set out." Even the Commission's own assessments fail to prove that it will be sufficiently efficient to justify the expense and intrusions into privacy, he added.

He also expressed concern that there is an increasing number of databases related to border management, including VIS, SIS, CIS and EURODAC, and that there is a dangerous trend to give law enforcement authorities access to individual data within them. He pointed out that many third countries do not offer the same level of data protection as the E.U.

Members of the European Parliament Ska Keller and Jan Philipp Albrecht have set up a campaign against the proposals called Smashborders.EU urging citizens to fight against the creation of yet another large-scale IT database to store massive amounts of personal information. Albrecht likened it to "Big Brother surveillance".

The Parliament, as well as member states, will have to approve the plans which the Commission hopes to see come into force in 2017 or 2018.

Privacy advocates call on government to rein in NSA

A U.S. government board focused on privacy and civil rights should push Congress to rein in the National Security Agency’s mass collection of telephone records and Internet communications, privacy advocates said Tuesday.
The U.S. Privacy and Civil Liberties Oversight Board, established by Congress in 2004 to be a watchdog of government antiterrorism efforts, should also demand that the NSA and other government agencies be more transparent about the data they collect, said privacy advocates speaking at a board meeting in Washington, D.C.

While two former government officials defended the NSA’s collection of U.S. phone records and overseas Internet communications, other speakers told the board the agency has exceeded its legal authority, particularly when collecting U.S. records. Recent revelations about NSA data collection and surveillance show a lack of congressional and court oversight, said Jameel Jaffer, a lawyer with the American Civil Liberties Union.

Congress needs to limit what information the NSA and law enforcement agencies collect because internal privacy safeguards won’t work, Jaffer said. “You don’t know what the privacy safeguards are going to look like three years from now, five years from now” when there may be another terrorist attack, he said.

Board member Patricia Wald, an appeals court judge, asked if the NSA should be able to collect large amounts of data about U.S. residents, then have data minimization rules that limit what the agency can do with the data.
“Minimization is one of the great euphemisms of our time,” said James Robertson, a former Foreign Intelligence Surveillance Court judge who’s criticized current surveillance practices. “No one knows what it means.”
The surveillance court now appears to be issuing opinions on policy in addition to approving surveillance requests, Robertson said. The policy rulings are not in the court’s authority, he and other privacy advocates told the board.
Asked if the NSA could protect privacy through technological safeguards on the use of the data collected, some participants suggested a technology solution wasn’t enough. Technology can only implement policy, said Steven Bellovin, a computer science professor at Columbia University.
As the NSA collects more and more data, it will find new ways to use it, said Marc Rotenberg, president of the Electronic Privacy Information Center (EPIC). “A threshold is crossed once the data is collected,” he said. “There’s no guarantee the safeguard will remain over time.”
But the NSA and other agencies are already collecting massive amounts of data, said Daniel Weitzner, director of the Decentralized Information Group at the Massachusetts Institute of Technology’s Computer Science and Artificial Intelligence Laboratory. It would be useful for privacy advocates to work both on changing U.S. policies and on implementing technological limits on what the NSA can do with the data it collects, said Weitzner, a former deputy CTO in President Barack Obama’s administration.

“All the useful data has been collected,” he said.
The surveillance court and the NSA should be more transparent about the data collected, and the court should publish some of its orders, some panelists said. Part of the reason for concern about the surveillance is that the “searches are done in secret,” said Kate Martin, director of the Center for National Security Studies, a civil liberties watchdog group.
But it makes sense that the NSA doesn’t broadcast the targets of its surveillance, said Kenneth Wainstein, a former White House homeland security adviser. The surveillance court process, which doesn’t include a lawyer arguing against the surveillance, mirrors criminal wiretap requests, he said.
“We trust judges” to scrutinize surveillance requests, he said.
Still, Wainstein said there may be some merit in creating a new role for a public advocate during the surveillance court’s process because it may restore some public confidence in the process, Wainstein said.
Wainstein and Steven Bradbury, formerly with the U.S. Department of Justice’s Office of Legal Counsel, defended the surveillance efforts, saying they are necessary to protect the U.S. from terrorism. Despite the recent uproar about the programs prompted by leaks from former NSA contractor Edward Snowden, the U.S. shouldn’t significantly limit the surveillance because of some “speculative concerns down the road,” Wainstein said.
Bradbury questioned the suggestion to include a public advocate in the surveillance court process. The current process is “workable,” he said.

Board member James Dempsey, vice president for public policy at the Center for Democracy and Technology, called on privacy advocates to propose concrete ideas for fixing the surveillance process and on defenders to engage in the debate.
“It can’t be that everything is perfect,” he said to Wainstein and Bradbury. “It can’t be that no changes can be made.”
Follow me on Twitter @sajilpl