Princeton Web Policy

quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese.

According to Jonathan Mayer,

Commercial supercookies, fingerprinting, and zombie cookies are tolerated
(if not permitted) under current United States law. [...] Any associated
consumer deception, however, is a violation of the Federal Trade Commission
Act and parallel state statutes. [5]

[1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/

[2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-4c82-94b5-6a1a160bbaaf

[3] https://www.privaworks.com/Details/AlertReference/PrintPreview.aspx?guid=%7Bb7a1afcf-7795-4138-9401-27272896f095%7D&p=1

[4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5484-GW-JCGx-Complaint-Summons-Civil-Case-Cover-Sheet1.pdf

[5]…

> The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust.

Sadly, there are carriers on this planet who think it's a good idea to charge ridiculous prices for mobile data (Germany) or to block hotspot functionality unless you pay up (US, see [1] for the technical background - both Apple and Google are complicit). In a world where politicians would care about their people, there would be no need for wifi hotspots to exist in the first place.

Additionally, there are certain advertising brokers such as utiq that cooperate with major phone networks to provide detailed tracking, so they and advertisers know pretty precisely who you are just because you tethered your laptop to your phone.

And finally, you can't trust your phone ISP either - Verizon got caught red-handed injecting tracking "supercookies" into their customers' traffic [2], thank God at least that vector got closed with everyone and their dog going HTTPS.

In general: anything involving residential ISPs is rife with scams.

[1] https://news.ycombinator.com/item?id=20460438

[2] http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/

Google deserves plenty of credit for Scholar. It's the best public legal research system out there.

Let's not pretend, though, that Google Scholar has "set free" court opinions or offers "open access." You're trapped in Google's ecosystem. You can't download opinions in bulk for any reason, whether it's legal practice or academic analysis. You certainly can't build your own legal research system.

The best "open access" resource I've found, oddly enough, is bulk XML from a Stanford grad student. It includes over 10 million documents in a fairly standard format.

http://webpolicy.org/2012/12/28/advancing-empirical-legal-scholarship/

http://webpolicy.org/2013/12/29/advancing-empirical-legal-scholarship-state-materials/

http://webpolicy.org/2013/05/03/advancing-empirical-legal-scholarship-federal-appellate-opinions-and-rules/

Also, it appears to be replicated on Carl Malamud's public.resource.org.

https://law.resource.org/pub/us/case/federal/

https://law.resource.org/pub/us/case/state/

The reporting on our work has been of mixed quality. Check out our actual blog-post here: http://webpolicy.org/2013/12/23/metaphone-the-nsas-got-your-number/?utm_source=rss&utm_medium=rss&utm_campaign=metaphone-the-nsas-got-your-number for more accurate details.

We used data collected from voluntary users' phone logs as our phone number data set. This means that if Joe called number X a few weeks ago and then decided to participate in our study, number X was in our database. We then used a couple techniques too see how well we could identify who number X belonged to.

We didn't put together actual profiles of users, though that is a possible next step. However, I think it is clear that putting together profiles of users is possible given how easy it is to identify who you are calling and receiving calls from.

Machine learning just on text message metadata can probably be surprisingly accurate on classifying relationships and situations like friend, lover, employee, breakup, drug dealer, prostitute.

Compare

https://www.theguardian.com/technology/2014/mar/13/phone-call-metadata-does-betray-sensitive-details-about-your-life-study

which included some manual analysis and use of telephone directories and some automated analysis. (Their data set was tiny and derived from opt-in contributions.)

http://webpolicy.org/2014/03/12/metaphone-the-sensitivity-of-telephone-metadata/

I'm still hoping to see, and maybe help bring about, better technical and legal protections for communications in my lifetime, or at least better technical protections.

In one of the major announcements for Chrome, 'Moving towards a more secure web' (2016-09-08) [1], the Chrome Security Team writes:

"Chrome currently indicates HTTP connections with a neutral indicator. This doesn't reflect the true lack of security for HTTP connections. When you load a website over HTTP, someone else on the network can look at or modify the site before it gets to you."

The word 'modify' is a hyperlink to an article titled 'AT&T Hotspots: Now with Advertising Injection' [2] (ironically, a non-HTTPS site).

[1] https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html [2] http://webpolicy.org/2015/08/25/att-hotspots-now-with-advertising-injection/