The government won’t protect your internet privacy, so here’s how to do it yourself
The big money of the internet comes from tracking and selling user data to better target ads. Do one search for “power drills” and you’ll be inundated with ads for related products across your whole web experience. Those are targeted ad dollars at work. This is at the core of Facebook and Google’s business models, and for good reason: the amount of money companies spend advertising online is set to outpace money spent on ads on television this year.
Internet service providers (ISPs) are eager to get in on the action—once existing privacy protections for users are no longer an obstacle, that is. Yesterday, by a vote of 215 to 205, the House of Representatives voted to strip privacy safeguards from people who use the internet. The measure already cleared the Senate with a narrow majority, and experts expect that President Trump will sign the bill into law. When he does so, ISPs, the companies that connect people to the internet, will be able to collect and sell information about specific users without their permission. More specifically, the bill nullifies a set of rules put in place by the FCC.
Collectively, the rules—which have been in the works in the works for months and years and are built on prior rulemaking—are newly formalized: The FCC published the final version last December, and most took effect in January, with one part coming into effect this March. Some of those protections provided by these rules are, technologically speaking, ancient—like extending 1934 privacy requirements originally written for telecommunication companies to also cover broadband internet service.
Modern additions deal more explicitly with consumer consent and privacy online. The rules mandate that ISPs do three things: Let customers know about (and opt-in or opt-out of) any sharing of their information; get affirmative consent when offering customers financial incentives in exchange for selling their data; and not offer cheaper service to people on the condition that they surrender privacy rights. Without these measures in place, ISPs will be freed up to turn user data into a lucrative business—and to do so without the users’ knowledge or consent. Nullifying these rules, after all the time it took to create and implement them, gives companies implicit permission to do exactly what the rules protect against. The Electronic Frontier Foundation, a major online privacy rights organization, describes it succinctly:
This change in rules means ISPs can profit off a captive customer base twice: first, by charging them for the service, and second, by collecting data on what users do online and selling it to a third party. “I’m concerned about their stewardship of the data,” says Shauna Dillavou, a former member of the D.C. intelligence community who now runs CommunityRED, a nonprofit that works on finding and providing secure technology tools for citizen reporters operating in journalism-unfriendly places abroad.
“We still have to pay for their service, for the most part, and a lot of the tools you’ll have to use to safeguard your privacy and your security will slow your connection down, so then you have to upgrade your service and pay even more, because ISPs are sucking your data out.” At the same time, the information an ISP can collect has a lot more depth and specificity than what Google can glean just from searches, or what Facebook can find from stuff users post to the social network.
Wider availability of an individual user’s internet footsteps could leave them more-vulnerable to security threats. “Stealing personal information is much easier if all that data is aggregated,” says Bob Gourley, co-founder of Cognitio Corp, a firm that does security consulting, and former Chief Technology Officer of the Defense Intelligence Agency. Using advanced tracking tools, artificial intelligence, and botnets, a malicious actor could “learn if an individual is going to be out of town at a certain time,” explains Gourley.
