Why The Massive China Police Database Hack Is Bad News For Surveillance States Everywhere

Privacy

from the are-you-sure-you-want-to-spy-on-everyone? dept

A couple of weeks ago, Techdirt wrote about how an anonymous user had put up for sale the data of an estimated one billion Chinese citizens, probably obtained from the Shanghai police.  Back then, what exactly had happened was a little unclear — not least because the Chinese authorities were shutting down any discussion of the massive and embarrassing leak.  The Wall Street Journal has written a follow-up piece on the incident that clarifies the situation and puts things in a wider context (paywall alert):

The Wall Street Journal has since found dozens more Chinese databases offered for sale, and occasionally free, in online cybercrime forums and Telegram communities with thousands of subscribers. Four of the stolen caches contained data likely taken from government sources, according to a Journal review, while several others were advertised as containing government data.

Tens of thousands more databases in China remain exposed on the internet with no security, totaling over 700 terabytes of data, the largest volume of any country, according to LeakIX, a service which tracks such databases.

An accompanying graphic shows that the volume of data exposed in China is not just greater than that in the US, but well beyond the levels of leaks in other countries around the world.  The Wall Street Journal’s Karen Hao found several people claiming to offer the dataset holding information on a billion Chinese citizens — one wanted around $200,000, another was prepared to sell for $100,000.  And the publicity surrounding the hack seems to have encouraged others to join in:

a user claiming to be a police officer from central China’s Henan province inspired by the Shanghai theft, offered the personal information of 90 million people for one bitcoin, or roughly $20,000.

A third post promoted an alleged nine million records from China’s Center for Disease Control for $2,000. A few days later, a fourth popped up selling 40,000 records of Chinese citizens’ names, phone numbers, addresses, and government ID numbers for $500.

Hao points to a key factor that is driving this flourishing trade in highly personal data on a vast scale: state employees in China are poorly paid and thus easy to bribe.  But another is the fact that the more data that is held on a database for surveillance purposes, the harder it is to control, and the easier it is to exfiltrate huge quantities in a single hack, which can be sold for large sums on the black market. It is probably no coincidence that the big leak of a couple of weeks ago came from Shanghai, which has had one of the most complete surveillance systems in the world up and running for a while:

Shanghai was among the first cities to unveil a fully integrated data platform with AI capabilities in 2019. The platform pulls in data from various government functions such as public security, public healthcare and transportation, as well as from private companies offering express and food delivery, according to a state-media interview with a Shanghai police department director.

That means there was more and richer data in Shanghai than in other locations.  All it took was one misconfigured database, or one dishonest police officer, for the privacy of a billion Chinese citizens to disappear, probably forever.

That’s terrible news for the people affected, but it does mean that the bigger and more inclusive a surveillance system becomes, the more vulnerable it will be to precisely the kind of leaks that now seem commonplace in China.  As well as harming the people whose lives are revealed in this way, it also undermines the power of central and local government by exposing large stores of sensitive data to anyone willing to pay, including foreign intelligence agencies.

Ethics or international laws are unlikely to constrain governments that spy on their own citizens.  But the fact that too much surveillance might threaten the political future of the very people who order it could act as a brake on its constant expansion.

Follow me @glynmoody on Twitter or Mastodon.

Filed Under: bribery, china, corruption, leak, privacy, shanghai, surveillance

As Expected, Facebook Is No Longer Interested In Paying News Orgs To Post News On Facebook That No One Wants

Journalism

from the what-else-did-you-expect dept

Just a few weeks we noted that this was inevitable, but Facebook has now made it official that it’s no longer interested in dumping money on news publishers.

“A lot has changed since we signed deals three years ago to test bringing additional news links to Facebook News in the U.S. Most people do not come to Facebook for news, and as a business it doesn’t make sense to over-invest in areas that don’t align with user preferences,”

This should not be a surprise. For many years now, news publishers who refused to adapt to the changing times and changing news ecosystem blamed Facebook for their own failures to adapt, and then started demanding that Facebook (and Google) just give them money. We warned, repeatedly, that this was a dangerous game that wouldn’t end well,

And, yet, all we’ve heard for years from many in the news world is that Facebook and Google needed to pay journalism organizations. Indeed, Rupert Murdoch got so focused on this that he convinced Australia to force those companies to pay — and the idea is being proposed in many other places as well.

And, so, now Facebook is realizing that news on its platform is much more of a “nice to have” rather than a “need to have.”

Still, I guess a few giant orgs made out nicely for a few years while Facebook was effectively paying them off:

Meta spent more than $10 million on its news partnership with the Wall Street Journal, more than $3 million on its deal with CNN, and more than $20 million on its partnership with the New York Times, sources told Axios. In some cases, the partnerships also unlocked paywalled content.

Filed Under: journalism, news, paying for news
Companies: facebook, meta

Tim Hortons Doles Out Some Coffee Pocket Change In Response To Location Data Scandal

Privacy

from the i-see-u dept

We’ve noted for years how U.S. consumer location data is routinely abused by a long list of bad actors, including wireless carriers, broadband providers, app makers, adtech companies, data brokers, police, people pretending to be police, governments, and more.

It’s also, not too surprisingly, a problem in Canada.

Restaurant chain Tim Hortons was recently found to have been collecting “vast amounts of sensitive location data” in violation of Canadian privacy laws. More specifically, one report found the app tracked a user’s location over 2,700 times in less than half a year any time they left home, visited a competitors, or hit a local sports venue, and the restaurant chain mislead users into thinking the tracking would only occur when the app was in use.

Worry not though, as part of a new settlement with the company, it says it will be giving impacted customers enough money for a “hot beverage and a free baked good” with a total retail value of $8.58:

As is usually the case, the payout (accompanied with no formal admission of fault) is likely a tiny fraction of the money gleaned off of collecting user location data and then sending it to any nitwit with a nickel. Here in the States, the overturning of Roe has finally resulted in folks taking concern about the potential abuse of this data more seriously, although meaningful reform still remains difficult to come by.

Filed Under: apps, canada, location data, security, smartphone, surveillance, wireless
Companies: tim hortons

Indonesia Wields New Censorship Law To Block Yahoo, Paypal, And Several Gaming Websites

Policy

from the call-it-what-it-is dept

Early last year, Indonesia implemented a new internet regulation law. Referred to as “MR5,” the law gave the government the power to engage in widespread blocking of content. Not only did the law create intermediary liability, it required any site offering services to Indonesian representatives to register with the government. On top of that, service providers were expected to give law enforcement full access to any user content, including private communications and privately stored content.

On top of the normal sort of illegal content, service providers were supposed to proactively monitor user content to remove “prohibited information,” a catch-all term that includes such uber-vague things like content that “creates community anxiety” and blasphemy of the government’s preferred god(s). Providers are also supposed to monitor internet traffic to detect circumvention efforts, like VPN usage.

The law survived a legal challenge later that year. Indonesia’s apparently misnamed “Constitutional Court” said the law was constitutional. And it gave the government the power to pull the plug on platforms and services that did not comply with its draconian demands.

The law is finally starting to pay off for the Indonesian government. The residents of the country not so much, as this report from Reuters explains.

Indonesia has blocked search engine website Yahoo, payments firm PayPal and several gaming websites due to failure to comply with licensing rules, an official said on Saturday, sparking a backlash on social media.

[…]

Semuel Abrijani Pangerapan, a senior official at Indonesia’s Communications Ministry, said in a text message websites that have been blocked include Yahoo, PayPal and gaming sites like Steam, Dota2, Counter-Strike and EpicGames, among others.

These companies apparently called Indonesia’s bluff. But the government wasn’t bluffing. While other US companies like Meta and Alphabet engaged in some last-minute filings, these companies did not, leading to the government engaging in court-blessed plug-pulling.

While people may be able to tolerate the loss of Yahoo and access to game libraries, they’re not to tolerate losing access to their money. Blocking PayPal inevitably means separating people from funds or a source of funds. The backlash has worked… at least in terms of one of the sites blocked.

Semuel Abrijani Pangerapan, a senior official at Indonesia’s Communications Ministry, told an online briefing on Sunday the government is opening access to PayPal for five working days.

“Hopefully that is enough time for users to migrate, get their money and find other services,” he said, adding that there had been no communication yet from PayPal.

That won’t be nearly enough time. It’s unlikely every Indonesian with a PayPal account is aware of the blocking. People who’ve broken no laws (nor insulted the government’s gods) are losing access to their own money simply because the Indonesian government feels it needs to directly control foreign internet companies. And if you can show you have foreign tech behemoths comfortably under your heel, you’ll greatly reduce the amount of local dissent you’ll have to deal with.

This is how the government is spinning this move:

Authorities would unblock the websites if they comply with registration rules, Semuel said, defending the measure as protection for Indonesian internet users and the digital ecosystem.

Cutting Indonesians off from their money doesn’t really sound like “protection.” And if you’re willing to unilaterally eliminate access to services and platforms used by millions of residents, you’re not really “protecting” the “digital ecosystem.” All the government is doing is protecting itself. This move solidifies its grip on the internet and makes it clear to service providers all over the world it has no qualms about hurting its own citizens to maintain this control.

Filed Under: censorship, content blocking, content moderation, indonesia, intermediary liability, mr5
Companies: paypal

Daily Deal: Chronowatch C-Max Call Time Smartwatch

Deals

from the good-deals-on-cool-stuff dept

Bring your smartphone functionality to your wrist with the C-MAX CALL TIME. Over fourteen available features and functions on the 1.7” full color, touchscreen display. Answer calls, get message alerts, monitor your sleep, track multiple sports, and more! Also, the soft, flexible, silicone band makes C-MAX CALL TIME comfortable to wear all day, every day. There are four colors available and they’re on sale for $50.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

Study Says Trump’s Truth Social Is Much More Aggressive, And Much More Arbitrary, In Moderating Content

Content Moderation

from the the-freeze-peach-site dept

As you’ll recall, the defining moment that lead to Donald Trump creating his Truth Social Twitter clone was his being banned from Twitter for potentially egging on further violence on January 6th. Even before Truth Social was started, Trump’s most vocal and loyal… well, let’s just call them “fans,” kept insisting that what was needed was a social media site that didn’t do any moderation at all — or, at the very least, did no moderation based on viewpoint.

Of course, as we’ve explained for years now, such a thing is literally impossible. And every new social media service that pops up promising no moderation learns this the hard way, often to hilarious results. There was Parler, which promised it would only moderate based on “the FCC and the Supreme court of the United States” until it realized that’s not actually a thing, and started banning people for all sorts of things, including “posting pictures of your fecal matter.” Its former CEO also bragged about “banning leftists,” something the website seemed to do with glee.

Then, there was Gettr, another Twitter clone started by former Trump aide (and SLAPP suit filer) Jason Miller with funding from a Chinese billionaire famous for suing news organizations (not very free speechy). Gettr also positioned itself as the “free speech” site that wouldn’t moderate the way Twitter did. Then, when the site was overrun with extreme white nationalists, the site suddenly started banning them. It also would ban users for suggesting its billionaire backer was a spy.

Over and over again, we see that these sites are not only not actually about less moderation and more “free speech” but we see that they’re worse at the moderation game — a lot less principled, and just generally a mess.

Enter Trump’s Truth Social. Announced to great fanfare, and with yet another habitual suer of news organizations, Devin Nunes, put in charge. As we’ve noted, Truth Social has also found it difficult to attract users and prospective users have admitted the site just isn’t that much fun. We’ve also highlighted how, from the beginning Truth Social has quite strict terms of service, and Nunes promised aggressive content moderation (even while framing the site as being more free speech supporting).

We’ve seen some of this play out — for example in banning people for truthing about the January 6th hearings (apparently, not that kind of truth is allowed).

Now, Public Citizen has released a report, looking more closely at Truth Social’s content moderation practices and concluding that content moderation on the site is extremely aggressive and quite arbitrary.

“Truth Social is far from the haven of free speech that Trump promised, as even conservative viewpoints and links have been shadow-banned,” said Cheyenne Hunt-Majer, a fellow for Public Citizen and author of the report. “It’s not at all clear how Truth Social determines which content will be labled as sensitive, why some content is censored after it’s posted, and why other content seems to be preemptively blocked from appearing on the platform at all.”

The report looked at a variety of types of content. Not surprisingly (to anyone paying attention to reality), more progressive messaging was regularly silenced. Again, while Trumpists love to insist that Twitter, Facebook and others are deliberately trying to silence conservative talking points, actual evidence suggests that’s just not true. However, it appears that Truth Social has no problem suppressing content based on political viewpoints:

In June 2022, Truth Social users reported that any post containing the phrase “abortion is healthcare” would automatically be shadow banned from the platform. Much of this report describes my firsthand experience on Truth Social. When I attempted to post the phrase “abortion is healthcare,” I received the standard notification that my “truth had been posted,” which would usually signify that my post would now be visible on my personal profile and on my feed. Instead, the post was nowhere to be found. I made a video explaining that my “truth” had seemingly disappeared into a black hole that went viral on Tik Tok with over 1.2 million views to date. Five days after I initially tried to post my “truth”, after my Tik Tok video attracted such significant attention, it suddenly appeared. As a result, the first interactions with the post including comments and likes are dated five days after the date of posting.

In July 2022, I attempted to post a response to another user’s “truth,” in which he argued that only those that know everything about firearms have the right to protest gun related issues. My response read, “And if you don’t own a uterus and know everything about women’s health, you have NO right to regulate abortion or birth control. When you think they can’t get any more hypocritical, this post says, ‘yes they can.’” That post was similarly blocked and also never showed up on my profile or feed. 

It wasn’t just left-leaning content that was blocked however, The report details tons of other content, including content that would normally be welcomed in the Trump universe that was also blocked.

Users also complained that links to articles on external websites were being blocked. One user suggested that they were unable a link to a Breitbart article claiming that former President Obama was responsible for an influx of crime committed by immigrants protected by the Deferred Action for Childhood Arrivals program. When I tried to post the link, it never showed up on my profile or feed. Setting aside the merrits of the decision to deplatform the Breitbart article, it’s worth noting that the article doesn’t seem to violate any of their stated terms of service.

The report also found that when content was blocked, there seemed to be no explanation or opportunity to appeal — two other things that Trumpists often insist social media should have.

Again, it shouldn’t necessarily be surprising to anyone that Truth Social is a heavily moderated garbage dump. As we’ve explained so many times, every such website needs to have some level of moderation or they quickly become absolutely useless. It’s also not really much of a surprise that Truth Social is overly aggressive, and somewhat arbitrary in its moderation. As we’ve explained, at scale (even the very small scale of a Truth Social) content moderation is impossible to do well. And, I’d argue it’s even more difficult to be coherent if you don’t fundamentally understand content moderation/trust and safety, and it’s quite clear that this is the case with Truth Social.

However, it would be nice if all the very confident, but very wrong, people who insisted (1) that there should be no moderation at all, and (2) that Trump’s site wouldn’t have any moderation would recognize that they were wrong. And maybe, just maybe, recognize that every time they flipped out over content moderation decisions on other platforms that they didn’t agree with — it was because you’re just not going to agree with how every moderation decision is made.

Somehow, I doubt it. I expect we’ll quickly hear more unproven nonsense about how Twitter and Facebook are obviously against conservatives (they’re not) and excuses for why Truth Social’s content moderation scheme is somehow acceptable (it’s laughable). But, rest assured, if you believe (incorrectly) that content moderation is censorship, then Truth Social is a hell of a lot more censorial than Twitter.

Filed Under: arbitrary, content moderation, donald trump, shadow banning
Companies: public citizen, truth social