Owned by AT&T - Tilted Forum Project Discussion Community

cyrnel · 06-21-2006, 07:30 PM

Quote:

David Lazarus
AT&T rewrites rules: Your data isn't yours

David Lazarus

Wednesday, June 21, 2006

AT&T has issued an updated privacy policy that takes effect Friday. The changes are significant because they appear to give the telecom giant more latitude when it comes to sharing customers' personal data with government officials.

The new policy says that AT&T -- not customers -- owns customers' confidential info and can use it "to protect its legitimate business interests, safeguard others, or respond to legal process."

The policy also indicates that AT&T will track the viewing habits of customers of its new video service -- something that cable and satellite providers are prohibited from doing.

Moreover, AT&T (formerly known as SBC) is requiring customers to agree to its updated privacy policy as a condition for service -- a new move that legal experts say will reduce customers' recourse for any future data sharing with government authorities or others.

The company's policy overhaul follows recent reports that AT&T was one of several leading telecom providers that allowed the National Security Agency warrantless access to its voice and data networks as part of the Bush administration's war on terror.

"They're obviously trying to avoid a hornet's nest of consumer-protection lawsuits," said Chris Hoofnagle, a San Francisco privacy consultant and former senior counsel at the Electronic Privacy Information Center.

"They've written this new policy so broadly that they've given themselves maximum flexibility when it comes to disclosing customers' records," he said.

AT&T is being sued by San Francisco's Electronic Frontier Foundation for allegedly allowing the NSA to tap into the company's data network, providing warrantless access to customers' e-mails and Web browsing.

AT&T is also believed to have participated in President Bush's acknowledged domestic spying program, in which the NSA was given warrantless access to U.S. citizens' phone calls.

AT&T said in a statement last month that it "has a long history of vigorously protecting customer privacy" and that "our customers expect, deserve and receive nothing less than our fullest commitment to their privacy."

But the company also asserted that it has "an obligation to assist law enforcement and other government agencies responsible for protecting the public welfare, whether it be an individual or the security interests of the entire nation."

Under its former privacy policy, introduced in September 2004, AT&T said it might use customer's data "to respond to subpoenas, court orders or other legal process, to the extent required and/or permitted by law."

The new version, which is specifically for Internet and video customers, is much more explicit about the company's right to cooperate with government agencies in any security-related matters -- and AT&T's belief that customers' data belongs to the company, not customers.

"While your account information may be personal to you, these records constitute business records that are owned by AT&T," the new policy declares. "As such, AT&T may disclose such records to protect its legitimate business interests, safeguard others, or respond to legal process."

It says the company "may disclose your information in response to subpoenas, court orders, or other legal process," omitting the earlier language about such processes being "required and/or permitted by law."

The new policy states that AT&T "may also use your information in order to investigate, prevent or take action regarding illegal activities, suspected fraud (or) situations involving potential threats to the physical safety of any person" -- conditions that would appear to embrace any terror-related circumstance.

Ray Everett-Church, a Silicon Valley privacy consultant, said it seems clear that AT&T has substantially modified its privacy policy in light of revelations about the government's domestic spying program. "It's obvious that they are trying to stretch their blanket pretty tightly to cover as many exposed bits as possible," he said.

Gail Hillebrand, a staff attorney at Consumers Union in San Francisco, said the declaration that AT&T owns customers' data represents the most significant departure from the company's previous policy. "It creates the impression that they can do whatever they want," she said. "This is the real heart of AT&T's new policy and is a pretty fundamental difference from how most customers probably see things."

John Britton, an AT&T spokesman, denied that the updated privacy policy marks a shift in the company's approach to customers' info. "We don't see this as anything new," he said. "Our goal was to make the policy easier to read and easier for customers to understand."

He acknowledged that there was no explicit requirement in the past that customers accept the privacy policy as a condition for service. And he acknowledged that the 2004 policy said nothing about customers' data being owned by AT&T.

But Britton insisted that these elements essentially could be found between the lines of the former policy. "There were many things that were implied in the last policy." He said. "We're just clarifying the last policy."

AT&T's new privacy policy is the first to include the company's video service. AT&T says it's spending $4.6 billion to roll out TV programming to 19 million homes nationwide. The policy refers to two AT&T video services -- Homezone and U-verse. Homezone is AT&T's satellite TV service, offered in conjunction with Dish Network, and U-verse is the new cablelike video service delivered over phone lines.

In a section on "usage information," the privacy policy says AT&T will collect "information about viewing, game, recording and other navigation choices that you and those in your household make when using Homezone or AT&T U-verse TV Services."

The Cable Communications Policy Act of 1984 stipulates that cable and satellite companies can't collect or disclose information about customers' viewing habits. The law is silent on video services offered by phone companies via the Internet, basically because legislators never anticipated such technology would be available.

AT&T's Britton said the 1984 law doesn't apply to his company's video service because AT&T isn't a cable provider. "We are not building a cable TV network," he said. "We're building an Internet protocol television network."

But Andrew Johnson, a spokesman for cable heavyweight Comcast, disputed this perspective. "Video is video is video," he said. "If you're delivering programming over a telecommunications network to a TV set, all rules need to be the same."

AT&T's new and former privacy policies both state that "conducting business ethically and ensuring privacy is critical to maintaining the public's trust and achieving success in a dynamic and competitive business climate."

Both also state that "privacy responsibility" extends "to the privacy of conversations and to the flow of information in data form." As such, both say that "the trust of our customers necessitates vigilant, responsible privacy protections."

The 2004 policy, though, went one step further. It said AT&T realizes "that privacy is an important issue for our customers and members."

The new policy makes no such acknowledgment.

To begin with, I don't have a beef with them being up-front about cooperating with law enforcement. I'll ignore the current spat regarding warrantless eavesdropping since it's bigger than any one company. I have a very big problem with them stretching their agreement to suggest they own any part of customer information beyond transport and caching rights. Making the change of terms in so short a time leaves customers in a crunch: Agree or find another provider who can begin service in a few days. Not realistic for most given the predominance of cable/DSL duopolies.

What's your take? Are you in an AT&T (SBC) market? What do you think of their claiming rights to any of your personal or business information sent across their network?

a) The lawyers did it.
b) They were coerced by the DHS. Cable et al will follow suit.
c) It's an innocent but poorly worded modification
d) It's a wedge toward data mining and marketing. (note their take on bypassing cable video prohibitions)
e) all of the above
...

Edit: Forgot to link original story: http://sfgate.com/cgi-bin/article.cg....DTL&type=tech

Aurakles · 06-21-2006, 07:45 PM

No surprise. Big business either bends over backwards or are in step with the government. I'm certain that they've been monitoring people's voice and data records since shortly after 9/11. And if not then, slightly before, not after 2004.

Marvelous Marv · 06-23-2006, 03:38 PM

So would using Anonymizer, or something similar, have any impact on what they're collecting?

Dilbert1234567 · 06-23-2006, 07:26 PM

Quote:

Originally Posted by Marvelous Marv

So would using Anonymizer, or something similar, have any impact on what they're collecting?

Not one bit. All the traffic going to or from your house is monitored. I remember my days in high school I did many reports on war, weapons and the like, to think that these days I’d have Feds showing up at my door just for school research, it makes me mad. What ever happened to freedom of speech and the right to privacy?

MontanaXVI · 06-24-2006, 07:33 PM

I think it all boils down to choice D, the more information and data you have, the more power you have.

cyrnel · 06-24-2006, 08:19 PM

Quote:

Originally Posted by Marvelous Marv

So would using Anonymizer, or something similar, have any impact on what they're collecting?

Assume that even secure channels (VPNs, SSL, custom crypto, etc.) branching to or from any anonymizing service will get special attention. (If you were monitoring things, wouldn't you pay more attention?) There are ways to make traffic look innocent but making anything mass market means you destroy the method. So, unless you know someone special or create it yourself it won't likely be effective for long.

Dilbert, I hear you about research caution. Like most of us I've been curious about things to a fault since a young age. Anything, including some that wouldn't be popular with law enforcement. Average things that have applicability to my average life might make it to a project, and some small percentage of those make it to completion. But, knowing how the world turns, some of the other shady things could lead to problems. If someone looks at the oddball searches isolated from the rest, doesn't understand the interest or they're just casting a wide net, then I'll be the one wearing spots. It certainly makes one think twice about casual searches. Hate that.

Marvelous Marv · 06-25-2006, 10:40 AM

Forgive me if this is a repost, but someone e-mailed me this business about Echelon and Carnivore awhile back.

Here's the link:

http://www.rense.com/general66/scgh.htm

Anyone motivated to create a (much) longer tagline?

Quote:

Originally Posted by mistWalker

No surprise. Big business either bends over backwards or are in step with the government. I'm certain that they've been monitoring people's voice and data records since shortly after 9/11. And if not then, slightly before, not after 2004.

It's been around a lot longer than that. From the Wired archives:

Quote:

Cyber Safe or Gov't Surveillance?

By Declan McCullagh| Also by this reporter
10:40 AM Feb, 01, 2000

WASHINGTON -- A government plan to monitor networks for intrusions goes too far and will lead to increased surveillance and privacy violations, a civil liberties group told a Senate panel on Tuesday.

The Electronic Privacy Information Center said a memo it obtained last week shows that the Clinton administration's FIDNET proposal for "information systems protection" will result in unwarranted spying on Americans.

Documents the group received through a Freedom of Information Act request indicate the administration is considering broad access to credit card and phone records of private citizens and monitoring of government workers' computers, EPIC director Marc Rotenberg told the Senate judiciary subcommittee on technology and terrorism.

"The FIDNET proposal, as currently conceived, must simply be withdrawn. It is impermissible in the United States to give a federal agency such extensive surveillance authority," Rotenberg told the panel chaired by Jon Kyl, an Arizona Republican.

The privacy problems of FIDNET and similar government efforts are exaggerated, said Critical Infrastructure Assurance Office director John Tritak.

"FIDNET is intended to protect information on critical, civilian government computer systems, including that provided by private citizens. It will not monitor or be wired into private sector computers," Tritak said. "All aspects of the FIDNET will be fully consistent with all laws protecting the civil liberties and privacy rights of Americans."

Tritak showed up to discuss the so-called "National Plan for Information Systems Protection, Version 1.0," which the government released in January. It calls for additional government spending to thwart a "highly organized, systematic cyberattack by hostile powers or terrorist organizations."

The 199-page plan includes a chapter titled "protecting privacy and civil liberties." The chapter calls for an annual "public-private colloquium" and review of privacy practices by "appropriate authorities."

But it does not say the CIAO will reveal even summaries of its activities -- the sort of regular review required of federal prosecutors who ask for wiretaps of phone lines. "Nowhere does the Plan answer such questions as what formal reporting requirements will be established, what independent review will be conducted, and what mechanisms for public accountability and government oversight will be put in place," EPIC's Rotenberg said.

06-21-2006, 07:45 PM	#2 (permalink)
Aurakles Crazy Location: behind open eyes	No surprise. Big business either bends over backwards or are in step with the government. I'm certain that they've been monitoring people's voice and data records since shortly after 9/11. And if not then, slightly before, not after 2004. __________________ Our truest life is when we are in our dreams awake.

06-23-2006, 03:38 PM	#3 (permalink)
Marvelous Marv Cunning Runt Location: Taking a mulligan	So would using Anonymizer, or something similar, have any impact on what they're collecting? __________________ "The problem with socialism is that you eventually run out of other people's money." Margaret Thatcher

06-24-2006, 07:33 PM	#5 (permalink)
MontanaXVI Junkie Location: Go A's!!!!	I think it all boils down to choice D, the more information and data you have, the more power you have. __________________ Spank you very much