<http://schema.org/articleBody>
"Five years into the smartphone era, the threats to user privacy have never been higher.\r\n\r\nThe complex and mostly unregulated privacy concerns of the mobile ecosystem have driven many users to take their privacy into their own hands, whether that means deleting apps that ask for too much information or turning off location services.\r\n\r\nHowever, the fight over mobile privacy is just really starting to take shape. We wanted to get a beat on where that fight is now, and about what \u2013 if truly anything \u2013 privacy advocates think will change the future of mobile towards a more user controlled experience.\r\n\r\nFollowing a Harris Interactive study (PDF)\u00A0in 2011 that showed that \u201C98% of consumers expressed a strong desire for\u00A0better controls over how their personal information\u00A0is collected and used via mobile devices and\u00A0apps,\u201D\u00A0a recent Pew Research Center Internet &amp;amp; American Life Project\u00A0survey found that more than half (57%) of respondents had at some point either removed or decided not to install a mobile app because of the level of information that it would collect from them. This single stat tells us a lot about the current state of mobile privacy.\r\n\r\nFirst, it shows that a good number of users are concerned enough about their privacy that they are actively checking to see what information an app will collect \u2013 and if it is too much, they have no qualms in deleting or not installing the app for that purpose. Second, it points to the pervacity of apps that collect too much information in the minds of users (it\u2019s very doubtful that all 57% of those respondents had only deleted just a few select common apps).\r\n\r\nConversely, it could be that the data collected by those deleted or never installed apps were in fact much more useful to the user than the company or individual behind the app (or a third party for that matter), but as apps by and large do not say\u00A0how they will use that data, users have to assume the worst and take the appropriate measures to protect themselves from possibly being targeted, exploited, or even robbed.\r\n\r\nPew also found that 19% of respondents had turned off location services on their phones. That this number is much lower than the 57% number above, most likely points to the usefulness of location services on a smartphone \u2013 turn them off, and your maps, GPS, or local\u00A0restaurant\u00A0suggestions no longer work. Because they are so useful, users may also feel that it is worth the lowered privacy to get that kind of information, whereas other apps may simply ask for permission to access data (and the permission granularity level depends on your mobile OS) where the user cannot make a connection to how that data collection is worthwhile enough to allow.\r\n\r\nEven so, location data collection is one of the most hotly debated aspects of mobile privacy, and for good reason. Not only can our phones track us in real-time, but over time that data can be used to to predict our future locations and behaviors (albeit to varying degrees of success, but the technology is getting better all the time). Of course, once the data is collected, the possibility exists that it could be shared out to commercial third parties \u2013 or even law enforcement \u2013 and could theoretically be used to commit crimes against us. You might remember the controversial PleaseRobMe site that used Foursquare check-ins to say when people weren\u2019t at home \u2013 but of course, if you\u2019ve got a job, you are most likely not home during the day during the week, so it was never too revolutionary a concept to begin with.\r\n\r\nRegarding law enforcement: in July, in response to a Congressional inquiry, mobile carriers reported that for years they have seen requests for user data from law enforcement agencies increase to a record 1.3 million requests in 2011 alone. Obviously the growth of smartphone users with advanced technologies has increasingly led law enforcement to consider using cell phone data as a primary investigative source (though carriers can track even a basic phone without GPS by following cell tower usage,\u00A0to a less accurate degree), but just because they can do it, should they have the right to?\r\n\r\nSomewhat encouragingly was the report that carriers often did try to fight back against requests when they felt that they were unduly infringing on a users privacy, but countering that was the admission that sometimes \u2013 when law enforcement deemed it an emergency \u2013 the carriers would turn over data (usually location) to law enforcement without a\u00A0warrant, court order\u00A0or subpoena. Troubling to be sure, and as Edward J. Markey, the US Congressman that requested the report from the carriers told The New York Times,\u00A0\u201CI never expected it to be this massive.\u201D\r\n\r\nOf course, there are numerous other privacy issues at play in our mobile lives. We reached out to Rebecca Jeschke,\u00A0Digital Rights Analyst at the Electronic Frontier Foundation (EFF) in San Francisco about what the EFF considers the greatest threats to our mobile privacy (read our story about the EFF\u2019s proposed Mobile Bill of Rights), and she had this to add:\r\n\r\n\u201CWhen you use your mobile phone all your activities pass through many different service providers. The big question is how those service providers will safeguard your information. How long will your carrier keep your text messages and your voicemails and who can see them?\u2026 How about that list of friends?\u2026 Could it be subpoenaed in a divorce case or a custody battle? Right now it\u2019s really hard to enjoy the extraordinary functionality of our phones and still protect privacy.\u201D\r\n\r\nJenschke\u2019s last sentence really gets to the heart of the difficult choice (deal with the devil?) both users and privacy advocates are grappling with \u2013 is it even possible to maintain our privacy while still getting to keep that supercomputer that fits in our pockets?\r\n\r\nWhile many have given up trying to fight what may seem like the insurmountable tangled tide of the ever increasing attacks on our most private of information \u2013 from banking info, to emails; from pictures of family to text messages; from our contact lists to our personal diaries and yes, our every move \u2013 thankfully, there are a number of organizations that are working to protect our privacy everywhere we go. We\u2019ll take a look at a few of the most active, but first we should quickly cover the series of meetings being held by the a division of the US Commerce Department, the\u00A0National Telecommunications and Information Administration (NTIA) on mobile privacy.\r\n\r\nFollowing the Obama administration\u2019s larger call for a consumer bill of rights for online privacy (not to mention a sharp letter by Senator Al Franken earlier this year) the NTIA has been holding a number of meetings that include numerous participants from different sectors of the mobile ecosystem, including privacy advocates and organizations. To this point, the widely held view is that the best these meetings have accomplished has been that all of these different stakeholders are\u00A0actually talking to each other, but beyond that, the meetings have mostly comprised of how to even frame the discussion, including questions like \u201Chow is an app defined?\u201D\r\n\r\nThe privacy advocates that we spoke to for this piece echoed what Jeff Chester, the Center of Digital Democracy\u2019s executive director stated\u00A0at the last round of meetings in August. \u201CWe need to discuss what\u2019s happening now, how [the data is] being used, what does it mean for the user.\u201D In other words, they need to get moving and discuss something that actually matters. As Jules Polonetsky, director of the Future of Privacy Forum\u00A0bluntly put it to TNW over the phone, \u201Cthe NTIA process has ground to a halt.\u201D\r\n\r\nThat said, it seems that these NTIA meetings around creating a \u201Ccode of conduct\u201D to protect mobile users\u2019 privacy are currently where the best hope lies in progress being made on an industry-wide scale. As Pam Dixon, executive director\u00A0at the World Privacy Forum which has been involved in the NTIA meetings said to the TNW, \u201CI really think something is possible here,\u201D and that all of the\u00A0\u201Dreally big players in the room\u201D were \u201Cthere in good faith\u201D. And despite how the GSMA characterizes the global challenges of mobile privacy on its website, \u201Cservices and data flows are increasingly global, and geographically bound data privacy laws appear unable to keep pace.\u201D\r\n\r\nDixon said that she felt that even though the meetings were hosted by a US government agency, potential outcomes and agreements could (and most likely would) be ported globally. Beyond the NTIA reach, Dixon also mentioned that \u201Cthe multinational companies are in the best position [worldwide] to add some stability to this problem [i.e. privacy].\u201D So for now, the NTIA \u2013 while not really a battleground (more a campfire) \u2013 is where a good chunk of the action around mobile privacy is happening. \r\n\r\nAs we said, we had a chance to speak in-depth about the current state of mobile privacy with Pam Dixon of the World Privacy Forum over Skype (she is an avid user of Skype, which shouldn\u2019t be too surprising for a privacy advocate). Dixon, who is also a co-chair of the\u00A0California Privacy and Security Advisory Board and a former research fellow at the\u00A0Privacy Foundation at Denver University\u2019s Sturm School of Law, founded the World Privacy Forum, which covers a wide range of privacy issues, including medical identity theft, mobile and even cloud computing privacy issues.\r\n\r\nRegarding mobile, Dixon said that \u201Cthis has been a really challenging area for us\u2026\u00A0we were having trouble figuring out what the policy [approach should be].\u201D We pointed out the Pew Internet numbers above (57% of people had either gotten rid of an app or not installed it altogether when they learned what information the app would collect) and asked if the message should be something akin to \u201Cjust don\u2019t do it\u201D to consumers. Her response was quite funny: \u201CJust saying no doesn\u2019t work. It didn\u2019t work for drugs and it isn\u2019t going to work for privacy.\u201D\r\n\r\n\u201CMost users want control over their data,\u201D said Dixon, but there is data and then there is data: what users really care about are their personal data such as pictures, biometric info, notes, banking info, etc \u2013 they care much less about when their data is being used to target advertising to them. \u201CThere is a global\u00A0consensus\u00A0that we have rights [regarding our mobile data].\u00A0No one wants a contact list sucked out of their phone without their knowledge, permission and willingness,\u201D Dixon stated. But while there is global consensus that users have rights, \u201Cdefining sensitive information is culturally sensitive,\u201D which makes it harder for privacy standards and norms to be adopted worldwide.\r\n\r\nThis brought us to the NTIA meetings, which we\u2019ve detailed above. Dixon elaborated on how the World Privacy Forum is approaching these meetings and what it is trying to accomplish, at least in the short term. \u201CI believe that it\u2019s possible to start the discussion now,\u201D Dixon said when asked about the apparent roundabout way the NTIA meetings have progressed so far. \u201CThere is real limitation on screens,\u201D she explained, meaning that the industry standard privacy policy of thousands upon thousands of words (think Apple\u2019s famous 48-page Terms of Service) simply does not fit on a mobile screen in a way that users can easily digest it. As Dixon calls it, \u201Cthis is privacy shorthand,\u201D where apps and mobile websites have only 20-50 characters to spell out a privacy policy and what data will be collected and how it will be used or distributed. Fitting that kind of information into less than half the space of a tweet is no small order, and from Dixon\u2019s tone, we gathered there really isn\u2019t a firm\u00A0consensus\u00A0yet on how this will be done.\r\n\r\nShe did say that \u201Cthere should be a standard set of questions that are answered\u201D regarding how users can quickly understand what the app or mobile website is going to record about you and what it will do with that information. \u201CI really like the idea of just-in-time notifications\u2026 [and]\u00A0outside of the app, having some kind of code of contact,\u201D remarked Dixon on other alternatives to presenting a privacy policy front and center on an app.\r\n\r\nFinally, Dixon said that the privacy enhancements that both iOS and Android have continued to roll out were very encouraging, noting that iOS 6 will have many new features and privacy safeguards in place when it launches on September 19 (which also happens to be the date of the next NTIA meeting, coincidentally). She also praised Apple\u2019s sandboxing of apps as \u201Ca great thing.\u201D\r\n\r\nOverall, Dixon said that \u201Cthe privacy dialogue has had to mature on all sides\u2026\u00A0I don\u2019t know anyone that wants to give up their phones to safeguard their privacy.\u201D Regarding law enforcement activities (and the chance that innocent people might get\u00A0inadvertently\u00A0caught in a larger dragnet) one thing Dixon believes would certainly would be needed are \u201Climits on retention needs to happen, flush that data out,\u201D referring to how long a user\u2019s data is stored by an app, company or carrier.\r\n\r\nShe also said that when she travels she tries to store important data locally on her device (she says she takes notes using Penultimate for this very reason) so that it isn\u2019t sitting in the cloud and, as she put it, \u201Cfactory reset is a very good thing to have,\u201D meaning that if your device is about to get seized for whatever reason when you travel, hitting factory reset will wipe your data locally.\r\n\r\nWhen asked what the fastest and surest path might be to get to a much more solid state of mobile privacy, Dixon responded that, \u201Cthis is going to be a fruit bowl and not a piece of fruit,\u201D meaning that a number of different approaches working together are going to be required.\r\n\r\n\u201CI\u2019m not sure we\u2019re going to get to a solution without some kind of regulation.\u201D And when it comes to tracking you behind your back? \u201C[Companies]\u00A0have to make opting out very, very easy \u2013 there really can\u2019t be any secret tracking anymore \u2013 that\u2019s really old fashioned.\u201D You could still have\u00A0legitimate\u00A0tracking, however, and keep privacy, as Dixon suggested you could have \u201C[a]\u00A0health app that wouldn\u2019t opt you out of the tracking, but [that allowed you to] delete the data afterwards.\u201D And if you couldn\u2019t opt out, what could be a possible consequence? \u201CYou could possibly get your health insurance denied because of a health app that reports your health stats.\u201D\r\n\r\n\u201CIt doesn\u2019t have to be this way,\u201D said Rebecca Jeschke of EFF, talking about the numerous threats to privacy that mobile users face. \u201CWe can and should demand privacy protections from hardware and software developers that are clear and easy to understand. Something like the deal reached in California for more clear and accessible privacy policies is one step.\u201D The deal that Jeschke mentioned was reached between Apple, Google, HP, RIM, Amazon and Microsoft (Facebook also signed on after it launched its app store) and the state of California provides users a way to view an app\u2019s privacy policy before downloading. The companies will also provide education to their developers about how to live up to their obligations under California law.\r\n\r\nIn a related development in California, the state legislature this month passed a bill that was sponsored by EFF and the ACLU that would require law enforcement agencies to obtain a warrant before requesting user location data.\u00A0State Sen. Mark Leno was quoted as saying that users, \u201Care rightfully concerned about mobile privacy and the rate at which their location information is being shared with law enforcement.\u201D\r\n\r\nWe asked Jeschke what the EFF considers to be the weakest link in the mobile ecosystem chain and her answer wasn\u2019t all that encouraging (especially considering progress is obviously being made in California at least, which could hopefully, one would think, become a model for the rest of the country):\r\n\r\n\u201CThey are all weak links, I\u2019m afraid. Developers should go the extra mile and actually engineer in strong privacy protections from the start. We should not have to give up the cool new tools of the future in order to protect our privacy. I don\u2019t want a future where if I\u2019m not constantly super-vigilant, then I lose all my privacy and it\u2019s my fault. Right now, users seem to be cutting back on apps because of privacy concerns [she cited the Pew Internet report here] \u2013 there is a real market for privacy-protective technologies, and start-ups should rush in and fill it.\u201D\r\n\r\nOne such upcoming technology that might appeal to many users is encryption service spearheaded by the creator of PGP, Phil Zimmerman (along with the co-founder of the PGP Corporation, and a couple of ex-Navy Seals who happen to be privacy advocates as well). The service \u2013 called Silent Circle (sounds very appropriate for a company co-founded by ex-Seals, doesn\u2019t it?) portends to encrypt all communications over mobile phones, and even works if only one user has the software installed. That user\u2019s data will be encrypted as far as Silent Circle\u2019s servers, which could be especially beneficial for people such as overseas military personnel that are in hostile environments \u2013 which is actually exactly the use case that the project started out trying to solve.\r\n\r\nWe\u2019ll have to wait to see how well it works, but considering Zimmerman\u2019s reputation (he\u2019s in the Internet Hall of Fame), it\u2019s a pretty good bet it will work as advertised. Here\u2019s the intro video they have on the site:\r\n\r\nAs we mentioned, we spoke with\u00A0Jules Polonetsky, director of the\u00A0Future of Privacy Forum\u00A0(Polonetsky is also a former politician and was chief privacy officer at both AOL and Doubleclick) who told us that \u201Cgiven the number of developers and the data available, [developers on the whole] are actually doing a good job\u201D of staying on top of privacy issues. He said, however, that unlike other industries where privacy is something corporations strive to ensure because of compliance (i.e. the lawyers tell them to do it), mobile developers and companies are looking at privacy as a way to protect a valuable asset: user data. In other words, they have a business motivation to protect users\u2019 data so that those users will not only keep their apps on their phones, but also by promoting that the data is secure and in the control of the user, the developers may not have to limit what data their app collects.\r\n\r\n\u201CDrawing the policy lines take generations to develop,\u201D Polonetsky told us, saying that the speed of technology change \u201Cputs\u00A0societal\u00A0norms under strain.\u201D He pointed out that a century ago, Teddy Roosevelt temporarily banned Kodak cameras from parks in Washington DC because he was shocked that just anybody could walk around with a camera and violate people\u2019s privacy. When we asked Polonetsky if society would ever get ahead of technology privacy concerns, he responded, \u201CI think we are going to fall further behind \u2013 the pace of change has limited society\u2019s ability to catch up\u2026 we\u2019re [still]\u00A0struggling to catch up to social media and what supercomputers can do,\u201D never mind newer emerging technologies. However, he did offer a glimmer of hope: \u201CI think that [kids that are growing up with smartphones] get that technology changes\u2026 the adoption curve is getting quicker.\u201D\r\n\r\nWhich brought us to our final question for Polonetsky, Dixon of the World Privacy Forum, and\u00A0Jeschke of the EFF:\u00A0For the most part, mobile phones are a well known quantity at this\u00A0point, but what about wearable mobile connected devices such as fitness\u00A0monitors, watches, and even as yet-to-be-in-the-public devices such as\u00A0Google\u2019s Project Glass?\r\n\r\nJeschke of the EFF had this to say:\r\n\r\n\u201CThe same issues are at play here. When we carry technology around with us, more and more intimate details of our life are gathered and aggregated. When you use a connected device at a particular location, you are disclosing not only where you are, but what you are thinking about while you are there. These are very telling details that many of us want to keep private.\u201D\r\n\r\nPolonetsky of the Future of Privacy Forum told us that \u201Cmobile is showing us the way to other devices,\u201D while Dixon of the World Privacy Forum told us, somewhat in awe, \u201CI\u2019m equally horrified and facisinated by [Google\u2019s Project] Glass\u2026\u00A0this kind of technology will\u00A0irrevocably\u00A0change the world\u2026 it\u2019s going to be like going from buggies and whips to Fords.\u201D And if that doesn\u2019t make you take pause about what our future world of mobile privacy will be, Dixon\u2019s final statement most certainly will:\r\n\r\n\u201CYou could seriously hurt someone\u2019s reputation [with a device like Project Glass]\u2026 the law is so, so beyond even catching up with this one.\u201D\r\n\r\n"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/magazine/2012/09/25/issue-v0-9-meet-superheroes-fighting-right-mobile-privacy/>