TV maker unlawfully tracked viewing habits

[Homer J Simpson]

http://www.bbc.com/news/technology-38889975

[MarkS]

It shouldn't come as a surprise. You hook up a device that really shouldn't have any business being connected to the internet in the first place, a device that says quite a lot about you personally, and then are surprised when data is collected and sold.

I'm not saying it is right or wrong, but it shouldn't be a shock.

[Ampera]

Welcome to the Internet of Things! Where personal data is collected directly before your  bandwidth is harvested for a botnet and your charged with DoS based crimes and your ISP cuts your service.

But at least you can check to see if you have another bucket of chicken in the fridge right from your couch...

[Brutte]

My Samsung printer experience.

[HighVoltage]

My Samsung printer experience.

That is one reason why I am using old HP LaserJet printers 4100N and install all drivers manually.

A friend just bought a new TV set with viewer tracking but he did not care at all. So, I think most people would not care, if they knew that this tracking is going on. As long as they can watch their favorite brain washing TV shows.

 

[Sigmoid]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;
3) if they did, be surprised?

Anyway, just plain don't buy consumer IoT shit, people. It's a security issue, and the "benefits" are more gimmicks than anything else. If you want a big TV, and really ALL the options you like come with IoT / smart shite, just buy a huge monitor and a stand-alone DVB-T decoder with HDMI out - as a bonus you can also play GTA V on it or whatever.

As for the printer thing mentioned, there is simply no excuse at all to buy one of these "consumer grade" printers, ever. Regardless where you live, ebay, craigslist, their local variants, and used hardware depots are chock full to the brim with used professional office equipment sold for peanuts. You can get a full duplex, 1200dpi, shitload of pages per minute, PostScript II HP laser printer for the price of a good dinner - and you can also get third-party toner refills for those, making them immensely more economical. (It WILL probably look as if a bunch of mountain trolls have collectively barfed all over it, but that's nothing a little isopropyl alcohol and a soft rag cannot fix...)

We're engineers, let's use our heads. ;P

[Buriedcode]

To be fair, data gathering about peoples viewing habits, or use of a product has been common for a while, and is (often) stated in the user agreement.  We all enjoy the convenience of using credit cards and endless 'free' applications, which always comes with some cost - be it ads, or more specifically *targeted* ads, anonymous collection of user interaction, and giving away a small piece of our privacy.

If you don't wish to provide any of this 'big data', then you don't have to use the product/app.  Whilst I can't say I'm overly pleased about it it seems increasingly people want convenience of modern technology, but also complete privacy.  I'm sure this is possible but you can't have your cake and eat it - we all reap the rewards of 'big data' such as lower prices for consumer goods, 'loyalty cards' and modern conveniences such as voice recognition (which is essentially a massive data gathering exercise to improve voice recognition) and the price we pay is that our habits are stored, often anonymised, and used to find trends.

[vealmike]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;
3) if they did, be surprised?

1/ I've just bought a LG OLED TV, fantastic thing, great picture. I bought it because of the OLED panel and the image quality. It also streams directly from my NAS and from all the UK catchup services.
2/ Well durrrr, how can I use catchup if I don't connect it to the internet? Sorry, but your question is dumb.
3/ No surprises, the user agreement is very clear that the TV tracks what's watched and returns the info to LG.

So what? I really couldn't care that they know what I watch. The telly is visible from the road outside my house too - should I only ever watch it with the curtains drawn so that passers by can't tell what I'm watching?

psst, most of my watching is via the Sky box, so the TV manufacturer can't track what I'm watching.  Sky do instead.

[Ampera]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;
3) if they did, be surprised?

Anyway, just plain don't buy consumer IoT shit, people. It's a security issue, and the "benefits" are more gimmicks than anything else. If you want a big TV, and really ALL the options you like come with IoT / smart shite, just buy a huge monitor and a stand-alone DVB-T decoder with HDMI out - as a bonus you can also play GTA V on it or whatever.

As for the printer thing mentioned, there is simply no excuse at all to buy one of these "consumer grade" printers, ever. Regardless where you live, ebay, craigslist, their local variants, and used hardware depots are chock full to the brim with used professional office equipment sold for peanuts. You can get a full duplex, 1200dpi, shitload of pages per minute, PostScript II HP laser printer for the price of a good dinner - and you can also get third-party toner refills for those, making them immensely more economical. (It WILL probably look as if a bunch of mountain trolls have collectively barfed all over it, but that's nothing a little isopropyl alcohol and a soft rag cannot fix...)

We're engineers, let's use our heads. ;P

Not sure how you get DVB-T in the US, but for ATSC, you get 4 channels if you have a really good antenna and live right next to every single tower.

The better option is to not watch TV.

[Doc Daneeka]

Hmm, I just cannot relate. I havn't owned a TV for nearly 5 years...

[Cerebus]

So, I think most people would not care, if they knew that this tracking is going on. As long as they can watch their favorite brain washing TV shows.

What very few people realise is that these beasties (most 'smart' TVs) not only track what broadcast programmes you watch but also any media you play through DLNA and friends. Some even send clips of the video you watch back home; the manufacturer cited above was one of the ones guilty of this. Thus, they can leak compromising information about your, ahem, 'private' viewing habits, or send file names such as "XYZ takeover bid presentation.mp4" to their real masters, which if you know it came from the home of the CEO of ABC Corp is highly valuable information.

I've got an LG TV that is guilty of all of this and guilty of ignoring privacy settings, but I was wise to it so I set up a combination of firewall, DNS and redirection to a web server that I control to keep it in check but still allow me to use the built in YouTube, BBC iPlayer and other VOD apps without loss of privacy. This actually had the happy side effect of forcing me to harden my home network to 'insider' attacks, which I probably otherwise wouldn't have bothered to do.

[timb]

So, I think most people would not care, if they knew that this tracking is going on. As long as they can watch their favorite brain washing TV shows.

What very few people realise is that these beasties (most 'smart' TVs) not only track what broadcast programmes you watch but also any media you play through DLNA and friends. Some even send clips of the video you watch back home; the manufacturer cited above was one of the ones guilty of this. Thus, they can leak compromising information about your, ahem, 'private' viewing habits, or send file names such as "XYZ takeover bid presentation.mp4" to their real masters, which if you know it came from the home of the CEO of ABC Corp is highly valuable information.

I've got an LG TV that is guilty of all of this and guilty of ignoring privacy settings, but I was wise to it so I set up a combination of firewall, DNS and redirection to a web server that I control to keep it in check but still allow me to use the built in YouTube, BBC iPlayer and other VOD apps without loss of privacy. This actually had the happy side effect of forcing me to harden my home network to 'insider' attacks, which I probably otherwise wouldn't have bothered to do.

You know, LG claimed that none of the data was "personalized" (that is, they collect anonymous data that cannot be tracked back to a specific person). However, part of the data they collect is your IP address, SSID name and names of other nearby SSIDs, which means (in most cases) they can actually pinpoint your address! (There are services that have databases full of SSIDs and their geographic location; they're used to enhance GPS navigation on smartphones when you're indoors or in poor coverage areas.)

So it's not anonymous at all!

[raptor1956]

There was a time when this data collection thing would have been illegal and anyone doing it would be prosecuted for it.  But, for a number of reasons those times are long gone.  First, we live in a time when corporations wield undue influence and get what they want no matter the negative consequence to there customers.  But, perhaps even more insidious is the fact that many governments around the world want access to that data and get access to it either via warrant or without a warrant and further require that the ISP's and others collecting the data keep quiet about the governments access to it.

So, we have a mutually parasitic arrangement where governments permit companies to spy on there customers so long as they get access to that information when they want to and corporations provide that information to governments as a means of insuring they get to collect and harvest that data.  The long and the short of it is that there will be no clamping down on data collection because it's profitable to the corporations AND government loves the private sector for collecting data they want and are given.

Not far from where I live is the Utah Data Center operated by the NSA.  A Forbes report indicated it had between 3.0E18 and 12.0E18 bytes of storage and would see that capacity increase as technology improves.  We are told that this is just to collect "meta data", but how does, say, 6.0E18 bytes square with the claim it's only being used to collect meta data?  With that much storage and with the capacity increasing with time it seems to me they are collecting way more than meta data.

https://en.wikipedia.org/wiki/Utah_Data_Center


Brian

[EEVblog]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;

Because stuff like Netflix is very convenient to have in the TV. My Sony TV has a Netflix button.

[james_s]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;

Because stuff like Netflix is very convenient to have in the TV. My Sony TV has a Netflix button.

Also the average consumer (which you obviously are not) simply don't know any better. They take the products at face value, assume they do what they're supposed to do and don't even realize there is potentially nefarious stuff going on under the surface.

Ever since they appeared on the market though I've maintained that the concept of a smart TV is defective by design. Yes, being able to stream Netflix is fantastic and I use it all the time, but I do so with an external device, in my case a BD player that has built in "smart" functions. I think it's idiotic to build a computer with a life cycle of a year or two into a TV that should be good for a decade or more. On top of that, the smarts built into most smart TVs are a generation behind right out of the gate. TV companies almost invariably have piss-poor software development and idiotic UI design. At least one manufacture is now displaying advertisements in the menu. 

I just want a TV with a big screen, a great picture, a bunch of inputs and nice intuitive controls. Major bonus points if those controls are on the *front* of the damn thing where I can actually see/use them rather than hidden off on the side or back requiring the remote to do anything but I don't see the form over function trend going away any time soon.

[Halcyon]

Why would anyone
1) buy one of these "smart TVs"

Have you tried buying a television recently that wasn't "smart"? About one year ago I was looking for a new display for my living room, since I run everything (including live television) through a PC running Kodi, all I wanted was a normal, dumb display without any of the bling. The only pre-requisites were that it had to be a specific size, prefered the panel to be direct back-lit (as opposed to edge lit) and the image quality had to be to my standards.

I narrowed it down to three options. My preferred choice was a Sharp Aquos LCD TV which was one of their last direct back-lit models. I was a few months off buying it when Sharp pulled out of the consumer display market in Australia. All of their stock had been exhausted and JB Hi-Fi sold out of everything, even their demo/shelf models. I couldn't even get one through a staff member working at their Australian head office in Huntingwood.

My next option was an NEC commercial display but I tested one out and the image quality was terrible compared to other leading consumer displays. It was fine if you wanted to display signage 24/7 but awful as a television. Other than that, it ticked all the boxes.

I finally settled with a Philips TV. It has an edge-lit LCD but it does a fairly even job. The image quality is excellent. It has basic "smart" functions such as YouTube and web browsing which I don't use. It runs Philips' own proprietary firmware rather than Android which seems to be the trend these days.

It was honestly the dumbest of the smart TV's I could find that met my criteria. I could have opted for those cheapo Chinese brands from Kogan or something but they are horrible by comparison. Mine is connected to the internet, but only for the purpose of downloading firmware updates when I need it to. Other than that, it has no access to the outside world or any part of my network apart from the DHCP and DNS servers. Everything on the "untrusted" side of my network is locked down with a host whitelist and port blocking. For my TV, it only has access to the Philips update server at a specific time of a particular day.

[anfang]

Oh well, tough shit eh. "Smart" TVs are for dumb people. Anyone worth their salt knows you buy a standard HD TV and plug a Roku into it.

[Halcyon]

Oh well, tough shit eh. "Smart" TVs are for dumb people. Anyone worth their salt knows you buy a standard HD TV and plug a Roku into it.

Anfang, you might like to read my previous post before making such a childish claim. It's easier said than done.

[james_s]

At least you can usually ignore the "smart" features. If you don't connect it to the internet it's pretty hard for it to do anything nefarious. That's pretty much the only choice anymore and I don't see that changing anytime soon.

[Ampera]

I prefer HTPCs for my works. If you want to have a proper HTPC, get one with a REAL Linux installation on it. It will play anything and everything, has support for any file system on the planet, and will work a hell of a lot better than Windows for any multimedia needs. Heck if you're into it, gaming is something you can do too.

I think that companies need to be held responsible for this bullshit. If their devices get brought into a botnet, they should face criminal charges as co-conspirators to the crime. If it's discovered they are holding personal information, they should be liable to any and all damages as well as have the databases confiscated and thoroughly wiped.

Welcome to the modern world people, a few decades ago it was impossible to have so much big data harvesting, and you always had an expectation of privacy by law in your own homes.

We are in a time when everybody is trying to get a piece of you, and nobody is safe. And the worst part is, no matter how hard you try, and how paranoid you may get, it does nothing.

The best you can do is avoid red flags. Secure your machines. Don't fall for IoT. Make your own gadgets. This is an era of profound bullshit, and it's only getting thicker though history always repeats.

[Halcyon]

I'd like to think the majority of us (EEVblog members) are smart enough to work out how to put a stop to our devices spying on us or leaking information but part of that is personal responsibility (i.e.: be careful what you type and where). The same cannot be said for the majority of the planet. I'm of the firm opinion that the gap between "intelligent" and "average" people is getting wider as the population becomes lazier and stupider.

There are those who question, take the time to learn and understand how things and the world operate, then there are those who get so wrapped up in their little bubble of social media, Pokemon, selfies etc... etc... that they don't realise they themselves are the product rather than a consumer and companies are just after their data. More people just need to stop and think "Why is this thing free? What's in it for the company?". There is HUGE money in it as we can all see.

A great and very common example are websites which promote you to login with your Facebook, Google, whatever profile, instead of creating a seperate login. They promote it as being "easier to use" and not having to keep track of multiple logins. If you think they offer this to make your life easier, guess again. If you're one of those people, give yourself an upper cut and go fix it! One account -- One service.

[Sigmoid]

1/ I've just bought a LG OLED TV, fantastic thing, great picture. I bought it because of the OLED panel and the image quality. It also streams directly from my NAS and from all the UK catchup services.
2/ Well durrrr, how can I use catchup if I don't connect it to the internet? Sorry, but your question is dumb.
3/ No surprises, the user agreement is very clear that the TV tracks what's watched and returns the info to LG.

So what? I really couldn't care that they know what I watch. The telly is visible from the road outside my house too - should I only ever watch it with the curtains drawn so that passers by can't tell what I'm watching?

psst, most of my watching is via the Sky box, so the TV manufacturer can't track what I'm watching.  Sky do instead.

The question was rhetorical of course...

Anyway, what most people (apparently you included) don't quite grasp is the breadth of inferences you can make from data collected "with consent". I've been quite immersed in the academic literature around this stuff for some time.

Those fitbit things? They can potentially diagnose* mental illnesses, among other things. I'm not saying the Fitbit corporation is making these inferences, but they have the data to make them (or sell it to others who make them).
(* - Flag you as mentally ill accurately enough to be a credible basis for discrimination, if the intention is there.)

Your grocery store purchase history that you trade for some ridiculous coupon deals? Well in one contentious case, the supermarket knew that a girl was pregnant before she herself realized it.

Data mining is fucking awesome. But it's scary at the same time. As long as we don't have strict state regulation (which IS coming, at least in the EU - no wonder silicon valley corps are squealing like pigs in the slaughterhouse), it's up to each of us to keep our data safe... And while it's pretty much impossible to maintain a lockdown while actually being on-line and active, at least let's not add to our exposure unnecessarily.

Not sure how you get DVB-T in the US, but for ATSC, you get 4 channels if you have a really good antenna and live right next to every single tower.

The better option is to not watch TV.

xD I'm multi-homed... but regardless of broadcast standard used, you can pretty certainly get a decoder box for whatever you need. Satellite DVB is always a solution too.
I do agree with the second point though.

[NiHaoMike]

I think the best countermeasure against tracking is to pollute it with fake data in order to lower the SNR.

[Ampera]

The US has no real equivalent to DVB-S. All of our services are similar to Sky (DirecTV, Dish, Etc.) Paid subscriptions.

And ATSC is absolutely useless in most areas as all the major networks that people actually want to watch are on the paid services, so you only get maybe 3 local channels.

Europe has it a lot better with DVB-T and DVB-S wide, rampant, and true for most of what you'd want to watch.

There are also options like Sling, but that's not much better. Personally, I don't watch TV, if I do for something like a baseball game, I do it with my TV card on my computer (Which are actually pretty cool.)

[bson]

I agree with the ruling - people have a right to privacy in their home even if they choose not to exercise it.  I don't care myself if the whole world knows I watch local sports and GoT on HBO Go, or what have you.  But the right to privacy is important, regardless.  Just like other rights - I can go stand on a street corner and insult people all day, or make up conspiracy theories on Youtube, yet have no compelling interest to do so.  Just like the right to keep and bear arms, or run for office, or right to assemble.  I do none of those things, and see no huge reason to.  Yet the rights are important for when we DO decide to exercise them.  For collecting Nielsen-style viewer data a simple opt-in is sufficient; anyone choosing to keep their TV habits private can choose not to opt in, or can opt out later if they change their mind.  However, it shouldn't be assumed they want to opt in like it appears is done in this case today.

[vealmike]

Anyway, what most people (apparently you included) don't quite grasp is the breadth of inferences you can make from data collected "with consent". I've been quite immersed in the academic literature around this stuff for some time.

No, I honestly do get it, I'm very aware of the big data revolution and the implications of data mining. I design rack mounted storage for a living, so I'm working on the fringes of the industry. I just don't care if LG knows what TV programs I watch, I have too much other s**t to worry about.

I would never give up personal health data, or agree to a have a black box monitor my driving habits. But my TV watch habits? I really don't care.

It's not as if they are my TV watching habits that LG will be collecting anyway. I'm married and therefore not allowed to use the remote control.

[Halcyon]

As for a black box monitoring your driving habits. Why are you so confident there needs to be a black box?

There already is. Insurers are handing out OBD-II dongles that monitor every aspect of your driving. What's in it for the driver? Lower insurance premiums if they "behave".
How do I solve this? Firstly, I don't drive like a moron but secondly, I get cheaper premiums through a company who "hand pick" who they insure (Shannons). I reviewed my insurance last year and based on what I used to do for a living, my claims history and some other things, they offered me full comprehensive insurance for far cheaper than the other brands. No gimmicks, no bloody dongles, no Thailand call centres.

[Red Squirrel]

Sadly this is going to become more and more prevalent I think.  The NSA, CSIS etc are hell bent to get into every part of our lives. There are backdoors in a lot of things now including Intel cpus. Even an air gapped computer can be accessed through this backdoor as it uses 3G. For micro data transactions these companies can probably make deals with the carriers to basically get tons of access "numbers" for a very low cost then just stick the transmitters in every product they sell and it is linked to the serial number/sale. Suppose buying everything with cash will at least somewhat remove the distinction of who owns that particular serial number device but they'll figure it out via the data they get.

What's even more scary is the fact that the general public does not even seem to care about this constant war on our privacy.  They just accept it. Those same hypocrites probably also have curtains on their house windows.

[Halcyon]

The NSA, CSIS etc are hell bent to get into every part of our lives. There are backdoors in a lot of things now including Intel cpus. Even an air gapped computer can be accessed through this backdoor as it uses 3G. For micro data transactions these companies can probably make deals with the carriers to basically get tons of access "numbers" for a very low cost then just stick the transmitters in every product they sell and it is linked to the serial number/sale. Suppose buying everything with cash will at least somewhat remove the distinction of who owns that particular serial number device but they'll figure it out via the data they get.

Would you care to provide some sources as I find this very hard to believe. The technology you speak of is used in systems up to "Top Secret" level. US agencies don't have free access to everything as you might suggest.

Do I suspect a bit of "tin foil hat" happening here?

[Sigmoid]

Sadly this is going to become more and more prevalent I think.  The NSA, CSIS etc are hell bent to get into every part of our lives.

The NSA and the CSIS has nothing to do with corporate data aggregation. This is all private.

Yes the NSA does collect phone call and Internet traffic metadata, mandates that ISPs maintain logs for years, quite probably encourages the spread of backdoored elliptic curves, and similar, but that's that and this is this. Different shit, different actor, different channels.

There are backdoors in a lot of things now including Intel cpus. Even an air gapped computer can be accessed through this backdoor as it uses 3G. For micro data transactions these companies can probably make deals with the carriers to basically get tons of access "numbers" for a very low cost then just stick the transmitters in every product they sell and it is linked to the serial number/sale. Suppose buying everything with cash will at least somewhat remove the distinction of who owns that particular serial number device but they'll figure it out via the data they get.

Yea, could you provide some kind of source that isn't some fake-ass political fiction portal? This is so unfeasible on so many levels... I call 100% medical grade pure bullshit.

Yes there are ways to attack air-gapped systems, but they require some form of actual espionage effort. There are backdoors in many chips, but they need some effort to actually exploit. No, there aren't 3g radios in every bloody thing, have you seen the size and power consumption of a 3g radio? And apparently there aren't enough backdoors around, otherwise they wouldn't have had to try and force Apple to help government agencies access encrypted data on an iPhone... And if all Intel computers were backdoored, the Russian government would be a puppet of the USA, and Putin would be long gone as opposed to successfully meddling in US internal politics.

What's even more scary is the fact that the general public does not even seem to care about this constant war on our privacy.  They just accept it. Those same hypocrites probably also have curtains on their house windows.

You know, there is a fine line between being security conscious and being batshit insane. Information warfare is incredible and spectacular, there are huge gaps in the information security of most people, and there are absolutely movie-worthy attacks happening all the time... but the difference between understanding the crazy world of security and being a complete conspiracy theory loon is like the difference between understanding the wonders of modern physics and being a woo-woo homeopathy quack who spews shit about "quantum consciousness" and "frequency information stored in water".

As a warning to us all, let's remember that in his old days, Hunter S. Thompson was convinced that the groundhogs living on his estate were put there by the FBI to gather intel...

[vealmike]

Why does LG want your viewing habits? I don't have a smart TV so I haven't looked into it.

The TV is capable  of monitoring your viewing habits and making recommendations about new shows that you might like to watch.
Because I'm cynical, I presume that the recommendations are weighted and that LG get a kick back for advertising the new shows. If so, more fool the broadcaster, I do not use this feature.

I'm interested, of those here worried about a corp. collecting viewing data, how many have paid for cinema / theatre tickets with a card and how many insist on using cash?

[Sigmoid]

I'm interested, of those here worried about a corp. collecting viewing data, how many have paid for cinema / theatre tickets with a card and how many insist on using cash?

The difference is frequency, man. It's always frequency.

The power company reading your meter every month is normal fare, needed to calculate your bill. Reading your meter every millisecond allows an attacker to pretty much model your entire life with great accuracy, down to when you go to the toilet or have sex.

[vealmike]

The difference is frequency, man. It's always frequency.

The power company reading your meter every month is normal fare, needed to calculate your bill. Reading your meter every millisecond allows an attacker to pretty much model your entire life with great accuracy, down to when you go to the toilet or have sex.

Perhaps if they extracted from big data the frequency of my toilets, they could forewarn me in the event that I ever suffered from bowel cancer. 

[james_s]

As for a black box monitoring your driving habits. Why are you so confident there needs to be a black box?

There already is. Insurers are handing out OBD-II dongles that monitor every aspect of your driving. What's in it for the driver? Lower insurance premiums if they "behave".
How do I solve this? Firstly, I don't drive like a moron but secondly, I get cheaper premiums through a company who "hand pick" who they insure (Shannons). I reviewed my insurance last year and based on what I used to do for a living, my claims history and some other things, they offered me full comprehensive insurance for far cheaper than the other brands. No gimmicks, no bloody dongles, no Thailand call centres.

I've never owned a car new enough to have OBD-II but I wonder how hard it would be to hack one of these insurance dongles? Just program a microcontroller to talk to it and spit out some reasonable data simulating your car. Plug the dongle in at home on your bench and tell the simulator how many miles to "drive" per day.

[vealmike]

http://forums.hexus.net/automotive/323585-telematics-box-quick-teardowns.html
Nothing more than accelerometers and a telephone connection.

[vealmike]

I'm not paranoid enough to think this actually happens. But if the data exists sooner or later someone will aggregate it and sell it.  You may not be able to stop it being collected but you can at least not give it away.

Sweat the big stuff, not the little.
There are huge societal benefits to big data. Medical is the one that's always quoted. But in this case, if TV programme makers learn through collection of dig data what programs I like and consequently make more of them (and less "X-Factor's got no bloody talent") then that's a good thing.

I'm not in the paranoid camp. There are things I'm not concerned about sharing and things that I am.

If you use google, carry a mobile, use a credit card, have a bank account, drive a vehicle or do any of a 1000 other things we consider part of modern life your data is being harvested. If you fight every one of these, then you'll have no time to live your life and lets face it, you still won't win.
Like it or not, you have to accept that this happens and we each have to set our threshold of what's acceptable and what's worth the effort of pushing back against.

Whilst I agree that a lot of this collection is underhand, I really have better things to do with my life than worry about whether LG know's that I can't stand Kirsty Allsop.

[Muttley Snickers]

Slightly off topic alert, I received a surprise letter in this weeks mail from a government department completely out of the blue pertaining to a free bowel cancer test, eligible participants must be aged fifty or over which I expect to become in a few weeks, big brother keeping tabs or do they really give a shit.

Some might argue that this is normal and at the end of the day probably in my best interest and to a certain extent I would normally agree but I personally found the submission of this document rather intrusive so accordingly out of disgust the letter went in the bin.

By the same token I probably wouldn't knock back a century letter from the queen.   

[vealmike]

Slightly off topic alert, I received a surprise letter in this weeks mail from a government department completely out of the blue pertaining to a free bowel cancer test, eligible participants must be aged fifty or over which I expect to become in a few weeks, big brother keeping tabs or do they really give a shit.

Hmmn, I wonder if LG actually are selling details of our bowel movements?

[Muttley Snickers]

PS. Go and get the letter out of the bin. It is normal and in your best interests.

Fair enough, the letter is long gone and I was pretty pissed off at the time that somebody who thinks they know what's best is keeping tabs on my movements, anyway it was probably more of a shock than anything else and I do have a stack of mates all aged over fifty and none of them ever mentioned receiving a similar letter before. It did state in the document to call a number or go to a particular web site to opt out otherwise they will automatically send out some type of kit so I'm not totally out of the program just yet, either way I'm still not happy about the intrusion.

I haven't seen a doctor in years for good reason and the last time I did was the most horrific experience I had ever endured with an almost fatal outcome, this was due to a prescribed medication that I had a known history of severe allergic reaction to, a true occurrence that still haunts me to this day hence my reservation.

[james_s]

I'm interested, of those here worried about a corp. collecting viewing data, how many have paid for cinema / theatre tickets with a card and how many insist on using cash?

The difference is frequency, man. It's always frequency.

The power company reading your meter every month is normal fare, needed to calculate your bill. Reading your meter every millisecond allows an attacker to pretty much model your entire life with great accuracy, down to when you go to the toilet or have sex.

I monitor my own power consumption with one of those Effergy wireless power monitors and for a while I was graphing the data. It's not nearly as trivial to determine what's going on as you suggest. You can tell when I run the clothes dryer because it dwarfs my regular consumption but a large percentage of the varying loads are due to automated devices. Outside lights that are on timers, the furnace and air conditioner that cycle on and off as needed, the hot tub heating and filtration cycles, etc. My interior lighting has been almost 100% LED for years and was CFL before that, it hardly even registers on the meter. Also I'm really not that interesting. If someone at the power company wants to keep tabs on when I have sex and take a piss I'm not going to lose any sleep over it.

[rrinker]

 I'm not nearly that paranoid, if I was, I'd have blackout curtains in every room of my house. Without that, you don't even need an electrical monitor to determine patterns, just watch the lights in the windows, which at least in my house you can do from the street without ever setting foot on my property. Every room in the house with the except of the basement has a window that is visible from the street somehow.

[Buriedcode]

Another rant..

Wow as this thread highlights, this sort of thing 'privacy' seems to polarize people.  With the more paranoid pointing out it may be possible to "profile" someone based on energy use, TV channels etc.. I think they are assuming that:

a) someone actually wants to find information specifically to you, the individual, and
b) its straight forward to infer personal details. 

The first is extremely unlikely - think about the man hours dedicated to track one individual. 
As we've seen over the past 16 years, government agencies probably have the capability to do so - but it takes a lot of resources so is reserved for those high on the 'threat' list.  The only instance I can think of where more private information can be 'gleaned' from big data used by google/Facebook etc.. is if someone at the company has access to this data, and is stalking someone. Where there is a will there is a way - but that doesn't mean to say someone cares enough about you to actually find this stuff.  Even then I don't think it can be done, when there are easier ways - camp outside someones house.

And the second - almost all 'big data' is owned by private firms who will not automatically roll over for a government, and it is extremely unlikely they would use 'individuals' data for their own gain.  The money is in the volume, anonymized - no-one actually cares about the individual.  Sure the data is sold, and I think those who generated the data (the public/consumers) should benefit from that.  We do.

Where there is possible risk is if the data is leaked or hacked, because one is unsure of the motives of the hacker.  But this is only for financial data (for spear phishing), and even then requires extraordinary effort to 'make use' of the personal information we give out every day.

It really does seem like those who get overly paranoid (because a little paranoia is healthy!) have a hair trigger, just waiting for stories in the news to unfold so they can justify feeling constantly scared.  We don't have 'true' privacy, because it depends on what you consider to be private, but we do reap the rewards of data mining and I suspect those who are vehemently against any form of data gathering would be unwilling to give up the convenience of cell phones, the internet, credit cards, television etc..  As others have pointed out there are ways to mitigate the 'trail' we leave behind, but if that isn't enough, then you do have the choice to not use such services.

[james_s]

The issue I have is with the valuable data. What I access online, what I search for in search engines, where I live, where I work, my phone number, what shows I watch, where I shop, what products I buy. That data is valuable to marketers and the more inter-connected it is, the more value it has. Privacy really is at stake there, and it's getting worse. I like that my smart meter allows the utility company to provide realtime monitoring of my water, gas and power consumption and billing, just a few weeks ago this allowed them to notify my mom that there was likely a leak in the water main between the meter and her house within hours and I was able to go over there and shut it off before it wasted thousands of gallons. I think the privacy risk on that particular data is minimal and is easily outweighed by the advantages but that doesn't mean our privacy is not at risk in general.

[metrologist]

Oh noes. Tax season is approaching and I am looking at TurboTax software. I know it will immediately need to connect to the internet as soon as I enter all my info into the forms. You know, it will need the right updates...

Yeah, I think there are many people and entities that see the world just like Neo. I do not believe computing can be made secure.

[Buriedcode]

The issue I have is with the valuable data. What I access online, what I search for in search engines, where I live, where I work, my phone number, what shows I watch, where I shop, what products I buy. That data is valuable to marketers and the more inter-connected it is, the more value it has. Privacy really is at stake there, and it's getting worse. I like that my smart meter allows the utility company to provide realtime monitoring of my water, gas and power consumption and billing, just a few weeks ago this allowed them to notify my mom that there was likely a leak in the water main between the meter and her house within hours and I was able to go over there and shut it off before it wasted thousands of gallons. I think the privacy risk on that particular data is minimal and is easily outweighed by the advantages but that doesn't mean our privacy is not at risk in general.

Agreed in a way.. but all that consumer data can drive down prices as companies can target smaller and smaller groups rather than waste resources blanket marketting everyone.  'What products I buy' has been recorded for many years, credit cards (which generally just track where you shop) and loyalty cards (where, what, and how).. and we have known this for decades, so why is it only an issue now? 

More recent data gathering exercises has been Google buying patient data from the UK's NHS.  This is of course anonymized, and I'm sure you might be able to find a single person based on their medical records - no-one is really interested in that, just trends and statistics. It will be interesting to see if this feed-stock for learning algorithms can make automatic medical diagnostics worth anything.

As it stands (or did stand, up until the UK's 'snooper charter') most claims were overblown - but I guess for many its not how things currently are that is the worry, it is the direction it is heading.  So more of a fear for the future.  The UK government hasn't had a good track record of using 'technology' to solve what it believes are problems, from banning all psychoactive substances (which include a bunch of flowers, and carrots) to 'assuming' that ISP's have the facility to track and record every website we visit so the government can just search for a person and find evidence of criminal behavior (ISP's can't currently do that, even if what they can record is rarely of any value).

So, yeah, I'll admit it's not getting any better any time soon, and as we give up small bits of privacy every few years, I might start getting worried.  But its hardly an 'Orwellian' state.  At least not yet.

As for a TV tracking viewing habits.. I've always assumed that any system that is two way (cable, satellite, internet) probably sends back all that.  Now if it constantly streamed audio back to servers for training voice recognition? That's too far - but also unfeasible.  I suspect recent media coverage on it was based on the poor wording in the license agreement, but no company is going to print in large block capitals 'we will monitor everything'.

[raptor1956]

I think the best countermeasure against tracking is to pollute it with fake data in order to lower the SNR.

You could disrupt the business model of a lot (most) companies if you did that, pollute with fake data.  I'll give you one guess what governments around the world would do if someone offered a devise or application to generate that fake data.


Brian

[Cerebus]

More recent data gathering exercises has been Google buying patient data from the UK's NHS.  This is of course anonymized, ...

Typical medical records supplied by the NHS to third parties for research purposes include age, race, sex [basic essential medical data] and postcode [necessary to research locality of effects. e.g. air or water pollution]. The name may have been removed, but that's not anonymous by any stretch of the imagination - I pretty sure that I'm the only white male of my age in the 20-30 houses that make up my postcode. Properly anonymizing medical data is hard, very hard and by the reckoning of some researchers impossible or very close to it. The only schemes that preserve medical privacy is where data is held in a protected silo and third parties are restricted in what searches they can make on that silo so that they cannot effectively de-anonymize that data. Handing so-called anonymized data over to third parties is the same as handing it over with the names intact, the effort to reverse the anonymization is trivial.

As it stands (or did stand, up until the UK's 'snooper charter') most claims were overblown -

Much of the Investigative Procedures Act [the "snooper's charter"] merely legalizes what GCHQ and friends were already going either illegally or with scant legality. I don't know what claims you think were overblown but I can tell you from some years of watching this from the sidelines that most claims of what domestic spying was being conducted were/are true.

...but I guess for many its not how things currently are that is the worry, it is the direction it is heading.  So more of a fear for the future.  The UK government hasn't had a good track record of using 'technology' to solve what it believes are problems, from banning all psychoactive substances (which include a bunch of flowers, and carrots) to 'assuming' that ISP's have the facility to track and record every website we visit so the government can just search for a person and find evidence of criminal behavior (ISP's can't currently do that, even if what they can record is rarely of any value).

Speaking as a man who was architect of no less than three ISPs networks I can assure you that any ISP who wants to can "track and record every website we visit", it's just that no sane ISP would want to or want to pay for the kit or storage to be able to do it for every customer. The thing is that by now, or very soon, all the big UK ISPs will have been served a "technical capability" notice under the IP Act requiring them to put the infrastructure in place to do exactly that for all of their customers.

If forcing ISPs to keep records of all web-browsing and email isn't Orwellian, then I really don't know what is. Are you holding off on calling it Orwellian until you've got exactly the situation Orwell described -  a TV with a camera attached that you're required to keep on 24 hours a day by law?

[Buriedcode]

If forcing ISPs to keep records of all web-browsing and email isn't Orwellian, then I really don't know what is. Are you holding off on calling it Orwellian until you've got exactly the situation Orwell described -  a TV with a camera attached that you're required to keep on 24 hours a day by law?

Yes. Otherwise by changing the definition you could call any society 'Orwellian'.  If you consider this to be 'Orwellian' now..  then what would you call it if we lose more privacy? Its all very Daily Mail to immediately claim that 'all privacy has gone' before it has even happened. And if you felt this strongly, surely you would never use email for anything private? It is currently very far from 1984, and I don't see it getting that way in my lifetime. It is very easy to post on a forum about it (as I'm doing) but those who are genuinely worried would curb their internet usage and emails, or start a petition.  Those who don't do that clearly don't really care that much. 

Just to be clear, I am not agreeing with the snooper charter here, just that responses should be proportional.  Unfortunately we live in a world where it is common for people to see things in 'black and white', so at what point do you go from 'perfect privacy' to 'we are just numbers!' ? And if GCHQ has been gathering this data (and regularly using it against citizens, source?) for years - why now is it a problem?  I'm asking for perspective here.  If one spent much of their life researching, it could very well lead them to think 'we are all completely controlled!' but within a country of over 50 million people, do you really think you are significant enough for businesses/governments to track your every move? or trawl though massive amounts of NHS data to find out more personal details?

[Red Squirrel]

The NSA, CSIS etc are hell bent to get into every part of our lives. There are backdoors in a lot of things now including Intel cpus. Even an air gapped computer can be accessed through this backdoor as it uses 3G. For micro data transactions these companies can probably make deals with the carriers to basically get tons of access "numbers" for a very low cost then just stick the transmitters in every product they sell and it is linked to the serial number/sale. Suppose buying everything with cash will at least somewhat remove the distinction of who owns that particular serial number device but they'll figure it out via the data they get.

Would you care to provide some sources as I find this very hard to believe. The technology you speak of is used in systems up to "Top Secret" level. US agencies don't have free access to everything as you might suggest.

Do I suspect a bit of "tin foil hat" happening here?

That's the thing it's top secret, so a lot of it is speculation, but after the Snowden leaks, you kind of have to read between the lines and realize the true lenghts these people go, and we would be naive to think that corporate/government spying do not cross hands.  Corporations spy on us for advertisers and such, and more then likely also provide the NSA the info, and perhaps even vise versa. 

As for the Intel backdoor this is a rather secretive thing as well that some people have found but there's little to no info on how it works or how to disable it.  There's lot of info if you search it, but it's all based on speculations.  I would not put it past the government to actually implement something like this though.

http://www.techrepublic.com/article/is-the-intel-management-engine-a-backdoor/

This talks more about the 3G part: http://www.tomshardware.com/forum/id-1816242/secret-intel-chip-snoops-backdoor-access.html

[Halcyon]

I still find it a little hard to believe. If Intel implemented a 3G module in their CPUs, wouldn't it be easy enough to detect its presence each time it "talks" to a nearby cell tower? Just seems like a lot of speculation and Chinese whispers.

[Red Squirrel]

I still find it a little hard to believe. If Intel implemented a 3G module in their CPUs, wouldn't it be easy enough to detect its presence each time it "talks" to a nearby cell tower? Just seems like a lot of speculation and Chinese whispers.

Most people probably don't have access to the test gear like spectrum analyzers required for that.  It would definitely be interesting to have someone set something up though with different CPUs/setups.  Chances are these don't talk very often so it would need to be monitored over a long period of time.  My guess is that it's not streaming data constantly, it's probably just sending keep alive packets to a central server.  If they want info on a specific person then they can remote the machine and get the data they want.  I think this is still too new but I imagine someone will figure out how to detect it.  Ex: if it needs to read your ram while your main cpu is operating then they either have to take turns or something, so there would be a certain lag profile that might be detectable in software.  Especially with mechanical hard drives as now you have two CPUs trying to get the head to go to two different locations at the same time.  I presume they would have a way to know that the computer is not actively being used as they could read the interupts, USB bus etc to detect mouse/keyboard movement.   I'd also guess the 3G is a last resort thing, it may even be disabled as soon as the computer is connected to a network.   If every single computer was streaming data to the cell towers then that would perhaps cause a noticeable amount of traffic that the telcos would not be happy with.

[Cerebus]

If forcing ISPs to keep records of all web-browsing and email isn't Orwellian, then I really don't know what is. Are you holding off on calling it Orwellian until you've got exactly the situation Orwell described -  a TV with a camera attached that you're required to keep on 24 hours a day by law?

Yes. Otherwise by changing the definition you could call any society 'Orwellian'.  If you consider this to be 'Orwellian' now..  then what would you call it if we lose more privacy? Its all very Daily Mail to immediately claim that 'all privacy has gone' before it has even happened.

Please don't put words into my mouth, I never said anything of the kind.

And if you felt this strongly, surely you would never use email for anything private? It is currently very far from 1984, and I don't see it getting that way in my lifetime. It is very easy to post on a forum about it (as I'm doing) but those who are genuinely worried would curb their internet usage and emails, or start a petition.  Those who don't do that clearly don't really care that much. 

Most people don't have a clue that this is happening. The TV news has had close to zero coverage, the newspapers scant more. Most of the significant parliamentary activity around this went on to the background of the all singing and dancing Brexit show filling the news.

I know about this stuff because I've been keeping an eye on it for years, since the days when the Regulation of Investigatory Powers Act 2000 (RIPA) was a green paper, so a long time. Back then, it was clear that the Home Office was just going to keep pushing the boundary and grabbing as many surveillance powers as they could. I've spent a lot of time in public meetings, private meetings, industry meetings and even in the pub, talking to the Police, Home Office, Cabinet Office, even spooks (if you meet an 'official' discussing national level policy and they don't have a business card then there's only one group they're likely to be from) and colluding with people from civil society groups, individuals, members of Parliament and the House of Lords. One of whom has since been sidelined from worrying about growing surveillance by being appointed Minister for Brexit. Prior to which he was suing the Government over excessive telephone records retention (DRIPA) but withdrew from the case when he got a ministerial job. The case went on without him but the European Court still found against the UK Government.

Just to be clear, I am not agreeing with the snooper charter here, just that responses should be proportional.  Unfortunately we live in a world where it is common for people to see things in 'black and white', so at what point do you go from 'perfect privacy' to 'we are just numbers!' ? And if GCHQ has been gathering this data (and regularly using it against citizens, source?) for years - why now is it a problem?  I'm asking for perspective here.  If one spent much of their life researching, it could very well lead them to think 'we are all completely controlled!' but within a country of over 50 million people, do you really think you are significant enough for businesses/governments to track your every move? or trawl though massive amounts of NHS data to find out more personal details?

The government have forced, or shortly will force your ISP to keep a record of all your web browsing and all the emails you've sent and received; your telephone provider already keeps a log of your mobile position and all calls received and sent, and a record is kept by the police of your car registration every time it passes an ANPR camera. This is all indisputable fact. If you think that's a proportionate way to treat citizens who are under no suspicion whatsoever and don't think it's appropriate to invoke the word Orwellian until it exactly matches the scenario in 1984 then there is little I think that I could say to convince you.

The risk isn't simply what some theoretic future despotic government will do with all this, it's what your average criminal will do when your ISP or telco has been hacked and they've got all your data to use for identity theft, blackmail, fraud, insider trading, whatever. Data breaches are in the news every day, ransomware is currently running rife, still feel so safe with all that data recorded ready to be stolen?

This isn't about tinfoil hats, it's about practising civic hygiene. If the data isn't there to be abused, then there's no potential for abuse. Back before the 2nd world war, the Dutch government kept (paper) records on the religion of every citizen. There was no real need for this data, somebody just thought it would be helpful to collect. Then the Nazis invaded. Fortunately some seriously brave civil servants set to systematically destroying these records before the Germans could get to them and draw up a list of Jews for 'treatment'. Had these been modern centrally held electronic records they would probably have been stolen ahead of the invasion by either hacking or insider espionage; it's not likely that demographic records like this would have 'military grade' protection.

[Halcyon]

I still find it a little hard to believe. If Intel implemented a 3G module in their CPUs, wouldn't it be easy enough to detect its presence each time it "talks" to a nearby cell tower? Just seems like a lot of speculation and Chinese whispers.

Most people probably don't have access to the test gear like spectrum analyzers required for that.  It would definitely be interesting to have someone set something up though with different CPUs/setups.  Chances are these don't talk very often so it would need to be monitored over a long period of time.  My guess is that it's not streaming data constantly, it's probably just sending keep alive packets to a central server.

No, the average person probably wouldn't but given all the "info" about it and the popularity of the processors, it would be easy for someone to test that had access to the gear. You wouldn't even need to prove that there is data transfer, if it's a normal 3G modem, it would re-associate with the cell tower at regular intervals like every other mobile device. If that was to happen in a test set up with no other phones nearby, it pretty much proves/disproves its existance? What about in facilities where mobile phones need to be switched off (think radio telescopes and space tracking stations). Surely by now someone would have noticed something.

[tronde]

More recent data gathering exercises has been Google buying patient data from the UK's NHS.  This is of course anonymized, and I'm sure you might be able to find a single person based on their medical records - no-one is really interested in that, just trends and statistics.

Many people have jobs making them a target for black-mailing. Politicians and business managers for instance. If the wrong people get hold of their medical history they can cause some really great damage.

Insider trading of stocks, or short trading can be very profitable, and if you can leak sensitive information about top level managemet at the right time, you can make a lot of money.

It might be your peronal information is of no interest to anyone, but that is not the same as nobody will put a lot of effort into de-anonymising care.gov. The damage potentional of leaked health data can be really huge if you look a little further away from yourself.

Some reading about NHS and sharing of data:

https://www.theguardian.com/society/2014/feb/21/nhs-plan-share-medical-data-save-lives


The data will be "pseudonymised" before release to any applicant company, with postcodes, names, and birthdays removed. But re-identifying you from that data is more than possible. Here's one example: I had twins last year (it's great; it's also partly why I've been writing less). There are 12,000 dads with similar luck each year; let's say 2,000 in London; let's say 100 of those are aged 39. From my brief online bio you can work out that I moved from Oxford to London in about 1995. Congratulations: you've now uniquely identified my health record, without using my name, postcode, or anything "identifiable"

[neil t]

None of this is surprising, our movements can be tracked by cell phone movement/number plate recognition, our spending habits are tracked by debit card and loyalty cards, it's long been known that web cams can be switched on remotely(all of ours are covered).Not to be a tin foil  hat wearer but we take as many precautions as we can not to be tracked, I would have thought that was common place. personal security is personal . I personally change names dob subscriptions passwords and the like regularly.

regards Neil