How we survive the surveillance apocalypse
Geoffrey A. Fowler, The Washington Post Published 7:55 am
EST, Wednesday, January 1, 2020
"Go,
go gadgets" has long been the attitude in my house. Perhaps yours, too: A
smartphone made it easier to stay in touch. A smart TV streamed a zillion more
shows. A smart speaker let you talk to a smart thermostat without getting out
of bed. That's progress, right?
Now
I've got a new attitude: It's not just what I can get out of technology - I
want to know what the technology gets out of me.
For
the past year, I've been on the trail of the secret life of our data. What
happens when you put your iPhone to sleep at night? Does Amazon's Alexa eavesdrop
on your family? Who gets to know where you drive - and where you swipe your
credit card?
Trying
to get straight answers has been, literally, a full-time job. I've digested the
legal word salad of privacy policies, interrogated a hundred companies and even
hacked into a car dashboard to grab my data back. There are lots of stories
about online threats, but it feels different watching your personal information
streaming out of devices you take for granted. This year I learned there is no
such thing as "incognito." Just stepping out for an errand, I
discovered, lets my car record where I shop, what I listen to and even how much
I weigh.
Learning
how everyday things spy on us made me, at times, feel paranoid. Mostly, my
privacy project left me angry. Our cultural reference points - Big Brother and
tinfoil hats - don't quite capture the sickness of an era when we gleefully
carry surveillance machines in our pockets and install them in our homes.
With
each discovery, I've looked for ways to change my own relationship with
technology. I've stopped installing new smart-home devices that let
corporations or police log what's happening at my house. I switched web
browsers and credit cards. When possible, I use a pseudonym or a throwaway
email address.
Still,
I'm going to level with you. After a year of wrestling my data from corporate
America, I hardly feel in control. Being paranoid isn't enough to save us in
the age of surveillance.
But
no, privacy isn't dead. A path to reclaiming it - fuzzy and almost too late -
is starting to emerge. We just have to be angry enough to demand it.
-
Data is power
While
we're busy living increasingly online lives, it's hard to know what's at stake
in our data.
Most
of the headlines focus on leaks and the unintended consequences of data
collection, like hackers stealing credit card numbers. You hear about creepy
but vague violations, like when Apple and Amazon hired people to review
recordings taken from their voice assistants. In a world where so many others
are collecting our personal data, it's legitimate to worry whether they're
doing enough to protect it.
But
there's a more fundamental problem: Why is so much of our information being
collected in the first place?
When
I began my privacy project, I learned something about the now-ubiquitous Alexa
I hadn't quite understood when I first brought home an Echo speaker. Every time
Amazon's artificial intelligence activates, it keeps a recording. Amazon had
four years of my family's conversations.
There's
more: Amazon also keeps reports on appliances you connect to Alexa - in my
smart home, every flip of a light switch or adjustment on the thermostat. Last
week, Amazon reported that Alexa users received "millions" of
doorbell and motion announcements during the 2019 holiday season, "from
carolers to delivery drivers and holiday guests." Surveilling that many
homes is a thing the company brags about. (Amazon CEO Jeff Bezos owns The
Washington Post, but I review all technology with the same critical eye.)
Amazon
isn't building its dossier on you just to be creepy. It wants your voice and
your data to train its AI, the technology it hopes will rule our future
economy.
While
we've been wondering at the new capabilities of connected apps and devices,
many of them have been quietly turning our private experiences into their raw
materials. These companies act like the data belongs to them, rather than us.
Largely unhindered by law, a hidden economy of data brokers gobbles every data
morsel it can. Author Shoshana Zuboff gave this data grab a sharp name that I
hope sticks: "surveillance capitalism."
There
are lots of ways your data can, and will, be used against you. Governments
frequently compel companies to hand over what they know. Tracking your credit
card lets retailers know how much you're willing to pay. Tracking what you
watch on TV lets politicians micro-target your fears. Tracking your web surfing
lets marketers glimpse your desires - to get you to buy things you may not
really need.
These
corporations understand that data is a form of power. It's time to take ours
back.
- The
arms race
Opting
out is more easily said than done.
I
tried putting my Alexa speaker on mute, but that defeated the purpose of having
a voice-operated assistant in my house. Turning it back on, Amazon would let me
delete its recordings of my voice and smart-home activity - but only after the
fact, and if I remembered.
Around
every corner in my connected life lay one of these traps. Data-collecting
companies, especially when they're trotted in front of lawmakers, like to say
they give us "control." But often it's a false choice between
forgoing some new capability vs. letting them mine your life. That's not how
technology has to work.
In my
privacy project, I found that every swipe or tap of a credit card lets as many
as a half-dozen kinds of companies grab information about what, where and how
much we spend. Since I can't live without a credit card, I switched most of my
purchases to the new Apple Card, which restricts its bank, Goldman Sachs, from
selling customer data.
That's
good, but Apple didn't do anything to stop data collection by the Mastercard
network its card runs on, or by retailers and point-of-sale system operators.
Sometimes companies say they protect our privacy, but I find they often use a
narrow definition of privacy. Same for your smartphone: Apple brags, "What
happens on your iPhone stays on your iPhone," but doesn't stop app makers
from sending your personal information to third-party tracking companies.
Facebook,
Google and lots of other data-collecting companies offer privacy control panels
that hardly anybody ever uses. I don't blame anyone for keeping away: I've
tried adjusting the terrible default settings for Google, Facebook and Amazon,
but the companies keep changing the controls and the types of information they
collect. Using a virtual private network, or VPN, doesn't do much to stop them
from grabbing data from a device you use while logged in to one of their
services.
The
arms race is exhausting. After I discovered how much Google's Chrome let
tracking cookies ride shotgun while I browsed the web, I switched to Mozilla's
Firefox, which has default cookie-tracking protection. But even it struggles to
defeat a newer, more pernicious form of tracking called fingerprinting, already
used on a third of the most-popular sites.
The
truth is, most of us don't have the time or expertise to defend ourselves from
the smartest minds in Silicon Valley, many of whom say they want to improve the
world but hooked their own financial success onto grabbing as much data as
possible.
-
Data co-pilots
We
won't regain our privacy if we leave it up to individuals. If we're going to
survive the age of surveillance, we're going to need help.
That
starts with laws. Privacy isn't just an individual right. It's a public good
that, when done right, keeps everyone safe, whether they're paying attention or
not. This ought to be obvious: Our data shouldn't have a secret life.
America
doesn't have a broad privacy law, like Europe's General Data Protection
Regulation, or GDPR. But after years of U.S. lawmakers just talking about data,
we're starting to see some action. So far, that has come mostly in the form of
regulatory fines. We should demand laws that not only require companies to come
clean about what they're taking but also place some limits on it.
Starting
in January, California will bring us closer to a general data law with its new
California Consumer Privacy Act, or CCPA. It treats our data like we own it,
and gives California residents new powers to demand that companies show us what
they've collected and who they share it with. It might force some (but not all)
of the companies I investigated in my privacy project to open up.
Transparency
means that vigilant citizens - and pushy journalists - can hold companies
accountable through public debate about what sorts of data collection are
acceptable. Transparency is also good for business: It helps consumers trust
what's happening behind the digital curtains.
But
better seeing our data gets us only so far. My inbox is already flooded with
updated privacy policies and data disclosures from companies rushing to comply
with the CCPA. Managing all the data I generate is more than even I can handle.
When
we're sick, we go to a doctor. To keep our computers safe, we install
anti-virus software. We rely on professionals to help out with lots of complex
aspects of modern life: Why not have professionals help with data, too? Call
them your privacy co-pilot.
A
fledgling privacy service called Jumbo shows what's possible. From your phone,
it logs into Google, Facebook, Amazon and others and spruces up your privacy on
your behalf. In clear language and colorful illustrations, it explains the real
choices we have and makes recommendations like you'd get from a really clued-in
friend. It's my favorite app of the year.
The
first time I used Jumbo, I was shocked that it identified a half-dozen privacy
settings for Facebook and Google that even I had missed. Now the app goes in on
a regular basis and deletes my Alexa recordings, Google data and Twitter posts,
reducing the data trail I leave behind me.
Right
now Jumbo is tiny and faces an uphill battle when it adds a paid version in the
coming months. But the privacy co-pilot market is burgeoning with new ideas,
joining the likes of password managers and security-focused WiFi routers.
California's new law smartly carves out protection for third parties to manage
our data for us.
I
don't know exactly how this will evolve. But we're more likely to win when
there are laws that stop data collection from being a secret - and when we have
companies fighting to protect our privacy, not just exploit it.
Comments
Post a Comment