Written by Natasha Lomas

Amnesty International latest to slam surveillance giants Facebook and Google as “incompatible” with human rights

Human rights charity Amnesty International is the latest to call for reform of surveillance capitalism — blasting the business models of “surveillance giants” Facebook and Google in a new report which warns the pair’s market dominating platforms are “enabling human rights harm at a population scale”.

“[D]despite the real value of the services they provide, Google and Facebook’s platforms come at a systemic cost,” Amnesty warns. “The companies’ surveillance-based business model forces people to make a Faustian bargain, whereby they are only able to enjoy their human rights online by submitting to a system predicated on human rights abuse. Firstly, an assault on the right to privacy on an unprecedented scale, and then a series of knock-on effects that pose a serious risk to a range of other rights, from freedom of expression and opinion, to freedom of thought and the right to non-discrimination.”

“This isn’t the internet people signed up for,” it adds.

What’s most striking about the report is the familiarly of the arguments. There is now a huge weight of consensus criticism around surveillance-based decision-making — from Apple’s own Tim Cook through scholars such as Shoshana Zuboff and Zeynep Tufekci to the United Nations — that’s itself been fed by a steady stream of reportage of the individual and societal harms flowing from platforms’ pervasive and consentless capturing and hijacking of people’s information for ad-based manipulation and profit.

This core power asymmetry is maintained and topped off by self-serving policy positions which at best fiddle around the edges of an inherently anti-humanitarian system. While platforms have become practiced in dark arts PR — offering, at best, a pantomime ear to the latest data-enabled outrage that’s making headlines, without ever actually changing the underlying system. That surveillance capitalism’s abusive modus operandi is now inspiring governments to follow suit — aping the approach by developing their own data-driven control systems to straitjacket citizens — is exceptionally chilling.

But while the arguments against digital surveillance are now very familiar what’s still sorely lacking is an effective regulatory response to force reform of what is at base a moral failure — and one that’s been allowed to scale so big it’s attacking the democratic underpinnings of Western society.

“Google and Facebook have established policies and processes to address their impacts on privacy and freedom of expression – but evidently, given that their surveillance-based business model undermines the very essence of the right to privacy and poses a serious risk to a range of other rights, the companies are not taking a holistic approach, nor are they questioning whether their current business models themselves can be compliant with their responsibility to respect human rights,” Amnesty writes.

“The abuse of privacy that is core to Facebook and Google’s surveillance-based business model is starkly demonstrated by the companies’ long history of privacy scandals. Despite the companies’ assurances over their commitment to privacy, it is difficult not to see these numerous privacy infringements as part of the normal functioning of their business, rather than aberrations.”

Needless to say Facebook and Google do not agree with Amnesty’s assessment. But, well, they would say that wouldn’t they?

Amnesty’s report notes there is now a whole surveillance industry feeding this beast — from adtech players to data brokers — while pointing out that the dominance of Facebook and Google, aka the adtech duopoly, over “the primary channels that most of the world relies on to engage with the internet” is itself another harm, as it lends the pair of surveillance giants “unparalleled power over people’s lives online”.

“The power of Google and Facebook over the core platforms of the internet poses unique risks for human rights,” it warns. “For most people it is simply not feasible to use the internet while avoiding all Google and Facebook services. The dominant internet platforms are no longer ‘optional’ in many societies, and using them is a necessary part of participating in modern life.”

Amnesty concludes that it is “now evident that the era of self-regulation in the tech sector is coming to an end” — saying further state-based regulation will be necessary. Its call there is for legislators to follow a human rights-based approach to rein in surveillance giants.

You can read the report in full here (PDF).

Invasive scheme spotted that foxes tracker blockers

Online privacy is facing a new challenge: A first-party tracker that appears to be unblockable with standard privacy tools such as adblockers.

The tracker in question was spotted being deployed by French national newspaper, Liberation, which in October promised subscribers an entirely tracker-free experience.

That promise garnered it a bunch of attention from privacy experts who dug around and found a first-party tracker embedded on its site which uses a subdomain (that’s mostly random) in order to redirect to a third party — thereby making it difficult to block (i.e. without also blocking Liberation’s own domain).

“To participate in this rather invasive scheme, a website operator need to make a decision to delegate the domain name alias,” explains Dr Lukasz Olejnik, independent privacy researcher and advisor, and research associate Center for Technology and Global Affairs Oxford University.

“It’s a setting where the website the user visits delegates a domain name alias to a third-party script provider. So when the user visits, the alias for the content might be, which in reality points to a site, a third-party server.

“This setting can effectively bypass third-party trackers and adblockers, especially if the domain name part contains unpredictable strings. This is because the user is visiting a website where a tracker could work in context of the first party, the visited website.”

On Liberation’s site the tracker points to the domain of a French “marketing optimization” provider called Eulerian — which sells data-driven analytics to websites. Though Liberation claims its subscribers aren’t being tracked via this method for ad targeting purposes — but only so it can gather site analytics. (Non-subscribers will be tracked for ad targeting, however.)

The newspaper’s own fact check team have reported at length on the controversy here — covering both privacy and security implications of its use of the first-party tracker scheme, and noting that privacy researchers are working on methods to defeat the technique. 

Zooming out, while the unblockable (or at least tricky to block) tracking scheme does not appear to be being used very widely as yet, there’s a chance such a technique could be taken up more widely if sites look to replace third party tracking cookies with alternatives.

This is because web browsers have been taking an increasingly proactive approach to squeezing the operation range of tracking technologies. Mozilla recently switched on third-party cookie tracker blocking by default, for example. While, this summer, WebKit announced a new tracking prevention policy that put privacy on a par with security. Google has also announced changes to how its Chrome browser handles cookies.

“Exact prevalence is unknown but it is fair to say thousands of sites subscribe to this particular scheme from the provider now under discussion, among them some very popular sites,” says Olejnik. “The technical possibility of such as scheme is not entirely new, in fact I did see it in use in 2014. There may have been less motivation to use it until now, though.”

“Focusing on forward-outlook is sometimes useful, isn’t it?” he adds.

Asked about practical ways such tracking might be defeated, Olejnik suggests tracker blockers would need to devise a “custom mode of checks to detect these specific schemes” — as they work on “slightly different principles than other ways of including third-party content”.

Perhaps more effective at skewering such tricky schemes might be a recent ruling by Europe’s top court which clarified that user consent must be obtained prior to storing or accessing non-essential cookies, and cannot be implied or assumed.

Sweden drops rape investigation into Wikileaks founder, Julian Assange

Sweden has dropped an investigation into Wikileaks founder, Julian Assange, on allegations of suspected rape.

In a statement today the country’s prosecution authority said the evidence has “weakened considerably” in the almost a decade that’s elapsed since the events in question.

“I would like to emphasise that the injured party has submitted a credible and reliable version of events. Her statements have been coherent, extensive and detailed; however, my overall assessment is that the evidential situation has been weakened to such an extent that that there is no longer any reason to continue the investigation,” said Eva-Marie Persson, Sweden’s deputy director of public prosecution.

The prosecutor had only announced in May that it was reopening an investigation into allegations of sexual offences which date back to August 2010. The investigation was earlier discontinued in 2017 but reopened at the request of the lawyer for the alleged victim following Assange’s arrested at the Ecuadorian embassy in London, after the country withdrew diplomatic immunity.

After his arrest Assange was convicted for violating bail conditions and sent to Belmarsh prison in London where he remains.

He is now facing potential extradition to the US which quickly instigated extradition proceedings against him — initially charging Assange with conspiracy to hack into a classified computer, and then additional charges under the Espionage Act.

The extradition hearing is due to take place in February 2020 after a UK judge denied a request by Assange’s lawyers to delay proceedings to give him more time to prepare his defence.

When Assange fled to the Ecuadorian embassy in 2012 it was an attempt to avoid extradition to Sweden. The Wikileaks founder claimed he would be at risk of extradition to the US. But after spending some seven years of self-imposed incarceration in Knightsbridge he faces a major legal fight to stave off the same outcome.