Privacy, Safety and Surveillance in the Time of Coronavirus [Encryption Digest 34]

We bring you a special report on the recent developments surrounding privacy, encryption and COVID-19. In the midst of the coronavirus crisis, we’re looking at amped up government efforts to track it via “emergency time” surveillance measures. Israel pops up with an 18-year old database nobody knew they had, full of cellphone data nobody knew they were tracking. China continues to demand Apple delete apps that offset its online censorship guidelines, many of which erase even articles of the outbreak. Facial recognition software is being employed full-force, a location-tracking start-up is in talks with the US government, and Google, Facebook and other tech entities come to the table to discuss how they can best lend their capabilities to the cause.





At a time when so many protections are being put in place, let’s make others don't get taken away. When the coronavirus crisis is over, will encryption and privacy laws still be in the hands of the free market, or will emergency COVID-19 measures, like the Homeland Security Act, forever alter the way governments interact with their citizens?

Facebook, Google and Others Partner with Gov for COVID-19 Data

What’s going on?

Governments are using whatever means available to track the spread of COVID-19, flatten the curve and provide prompt assistance. What they’re able to do is remarkable, and arguably saving lives. However, many of these surveillance-level tactics would be considered controversial in “peace times” and the issue remains—are they controversial now? However, as we’ve seen in the Cambridge Analytica scandal, so many of these companies do this anyway. It was just previously under the radar, and now it’s being put to good use. If you’re not sure how to feel about this, you’re probably not alone.
 

The Players and How They Are Proposing to Track Us

• According to the Wall Street Journal, in “task-force discussions, Facebook and Google are exploring ways to use data to help the U.S. government track outbreaks of the disease,” and Facebook is already sharing disease-migration maps.
   
• The data-mining firm that helped to find Osama Bin Laden, Palantir Inc., is helping to model the spread of the virus, and “other companies that scrape public social-media data” have contracts with the CDC and National Institutes of Health.
   
• Facial-recognition startup Clearview A.I. Inc.  is in talks with government agencies about tracking infected patients. Clearview A.I. has had its run-ins with privacy advocates before. The company “hopes it will be helpful in what’s known as ‘contact tracing’—figuring out who else might have been with a person known to have the virus.”
   
• Crimson Hexagon (now merged with Brandwatch) already contracts with governments and agencies to provide “social listening” tools, “meaning it scrapes public Facebook, Instagram and Twitter posts in part to gauge sentiment.” Former employees related to the Wall Street Journal that they were concerned that governments involved were using it for surveillance. And, in what might seem a bit of irony, Facebook itself dinged the company for “[running] afoul of [their] privacy policies.”
   
• A location-tracking startup out of Washington D.C., Camber Systems, utilizes “data, machine learning and artificial intelligence” to help with transportation and infrastructure. They are also in talks with the White House about possible bids.
   
• The Shin Bet (Internal Security Agency of Israel) has revealed a previously unknown cache of cellphone metadata that it uses to track the spread of the virus. “The use of advanced Shin Bet technologies is intended for one purpose only: saving lives,” a senior security official said. According to officials, “The Shin Bet has been quietly but routinely collecting cellphone metadata since at least 2002.”
   

Is This Legal?

While typically requiring a warrant or user consent, the U.S. government can request location data from telecom carriers or Google (think Maps and Android users) in the event of an emergency, circumventing the need for the usual permissions. “I don’t think anybody would dispute that this is an emergency,” said Al Gidari, director of privacy at Stanford Law School.
 

Who Has Opinions On This?

• “If we’re to leverage commercial technology to save lives, how do we put in the policy framework so we’re not South Korea or China or Israel?”  - Camber Systems CEO, Ian Allen
   
• “Like in every country, there are things that happen secretly, and that’s a good thing so long as there is oversight.” - Ran Sa’ar, chief executive of Maccabi Health Services, Israel’s second-largest health fund
   
• “There must be procedures to keep this information safe, to delete information once it’s no longer in use, and to ensure it isn’t used against Americans by law enforcement.” - Sen. Ron Wyden (D-OR), and one of the legislators investigating the use of tracking technologies
   
• “Even in crises of this nature, the core of civil rights in a democracy must be preserved.” -Malkiel Blass, former Israeli deputy attorney general
   
• “We understand that given we are in this crisis, that some temporary adjustment of our digital liberties may be necessary, however it’s really important that those adjustments be temporary.” - Adam Schwartz, a senior lawyer at the Electronic Frontier Foundation
   

This Begs A Few Questions

Given the bad rap privacy advocates and encryption experts (as well as the press) have given data-mining social media scrapers, is this Lex Luther joining the Justice League? Or the Greeks and their Trojan Horse? Or a little bit of both? And does this matter in a pandemic? I think the frightening thing is that it may well matter. As we border on the cusp of changes that mirror the Homeland Security Act in size and scope, it’s best to be on our feet to ensure “emergency precautions” don’t overstep into potentially permanent changes.  Health is wealth—but in today’s economy, so is Privacy.

“I understand that infection and contagion and the spread of the virus must be prevented, but it is inconceivable that because of the panic, civil rights should be trampled without restraint, at levels that are totally disproportionate to the threat and the problem,” stated former deputy attorney general of Israel, Malkiel Blass.

How do we ensure sunsetting on acts, contracts, relationships and technological uses employed in the abatement of COVID-19? I guess that’s the question.

Related Posts:

• Survey Results: Consumers Skeptical of Government Backdoors
•  Why Are Governments Afraid of Encryption?
• Why Governments Should Be Wary of Encryption Backdoors

At-Home Workers: It’s Past Time to Up Your Security Game

We really, really don’t want the coronavirus. But we also really, really don’t want to lose all our money in a COVID-19 scam. Or release uber valuable health information across insecure networks. Or lose sizable chunks of our liberty to overstepped surveillance laws. We’ll be walking a tight line, and work-from-homers are the first line of defense.


If you’re not doing these by now...

• Use a VPN. Even then, “services like VPNs often don't provide reliable protection, given it's hard to verify just how secure or trustworthy service owners are.” We all remember what happened with NordVPN, although it was a third-party mistake. And that’s exactly the point. That being said, as Justin Hansen of Venafi quipped, they’re probably a lot safer now after the incident than they were before.
   

          Solution? As an employer, follow VPN best practices and do a quick check for the best ones.
 

• Stay away from scammy emails. Tell your grandparents. Tell your grandkids. I recently made it through company-wide Security Training (can’t do that enough) and I’m now pretty confident that all Venafi employees know the telltale signs of a phishing email, a malware attack and dark attachments that breed viruses.
  
  A breach could happen on any level, with most targeting the weakest links on a network and pivoting from there. With everyone from the college intern to the call-center employee working from home, now is the best time to make sure your employees’ security IQ is up to snuff.
   
• Make sure your video conference provider is secure. Last year, the Electronic Privacy Information Center (EPIC) made a complaint against a major video conferencing provider, stating that the company “intentionally designed its web conferencing service to bypass browser security settings and remotely enable a user's web camera without the knowledge or consent of the user."
  
  Just keep an eye out (and find which conferencing software is least compromising as spouses, partners and kids roam about the house).
   

A friend of mine in the healthcare industry was recently sent home with a computer, keyboard, and directions to connect to the ethernet. She lives in a housing community where the internet flows through one general provider, with only WIFI passwords separating “HideYourWifi5.0” from “muffinpants.” I just cross my fingers.
 

Related Posts:

• FBI Warns Users about Phishing Campaigns that Leverage HTTPS Websites
• 50% of Phishing Sites Display Green Padlock
• Who Do You Trust with Your Encryption Keys? [What Happened to NordVPN?]

“Coronavirus-Only” Surveillance Still Bans Encrypted Keyboard App

Ai Fen, doctor at Wuhan Central Hospital. Photograph: Renwu/Handout

If it wasn’t for Ai’s story being wiped off the internet, Chinese authorities may well have not known of the small NY-based start-up. Or, got Apple to delete it from their country.
 

Ai Fen, a doctor in the Wuhan province, went on record in China’s Ren Wu magazine as saying she was reprimanded for spreading early news of the virus. Within hours, the article was taken down. But Boom users could save it, share it, encrypt it—and downloads soared.
 

Popularity of the app spiked so suddenly that the Chinese government turned an eye towards the fledging enterprise (it was literally launched Feb 15th in specific response to even stricter censorship imposed by Chinese coronavirus-watch efforts). Apple removed the app from its Mainland App Store and cited in an email to Wang, “content that is illegal in China.” You mean encryption?

"Apple cited 'content that is illegal in China'"
 

Well, this wasn’t any type of encryption—creative entrepreneur and co-founder Wang Huiyu designed the app to encrypt messages into emoji or Japanese and Korean characters, and it can also rearrange text to scramble things even further. Cool thing—it’s a keyboard plugin, so Boom works across apps (making it different from WhatsApp or Signal) and can’t track users’ information. As Huiyu says on Medium, “Privacy matters a lot to us!”





This in a way sums up the theme of our Digest this week—the fear that well-founded (we hope) and seemingly useful advances in tracking, data analytics and geotechnology turn against us and we’re left with less than we started with. With a global pandemic that has already taken so much, it’s ironic that we have to be wary that it doesn’t take more. At an inconvenient time, we’re forced to come to a head on the encryption debate; what liberties are we willing to put on the table in time of crisis, how long will extreme measures last, and can we go back?
 

In the one situation we can control, let’s hope we choose wisely.

Related Posts:

•  China’s Encryption Law: The Gift That Keeps on Giving? [Encryption Digest 17]
• Mozilla and Google Come Down on the Side of Privacy [DarkMatter]
• Overheard In The Press: Encryption Backdoor Debate