Microsoft’s big email privacy fight is over

WELCOME to Connected Rights, your twist in the sobriety of digital rights news and analysis.

MICROSOFT AGREES WITH THE US JUSTICE DEPARTMENT that their epic battle over user privacy, as it relates to emails stored on overseas servers, should be scrapped. The argument is now moot, after president Trump signed a new law (supported by Microsoft) that clearly allows US judges to issue warrants for data stored overseas – companies can still object if the request conflicts with local law in the country where the data is stored.

After Trump signed the Clarifying Lawful Overseas Use of Data (CLOUD) Act, the justice department got a new warrant under the new law. The specific case that was at issue here involved a drug-trafficking investigation and emails stored on Microsoft’s Irish servers. The argument ran for five years before the new law settled it.

APPLE HAS HIRED GOOGLE’S OUTGOING AI engineering chief, John Giannandrea, to head up its own machine learning AI strategy. These systems generally self-improve by training themselves on huge datasets, and Giannandrea will be used to having those. However, Apple isn’t Google – it doesn’t have piles of personal data to use as training fodder, and says it’s figuring out ways to achieve comparable results while still respecting people’s privacy. So Giannandrea has quite a task on his hands.

TELEGRAM IS HEADING FOR A SHOWDOWN with the Russian authorities over the encryption keys for its users’ accounts. The authorities want the keys, but Telegram points out it’s unable to hand them over. The service may end up being blocked in the country.

EUROPEAN DIGITAL RIGHTS (EDRi) is on the hunt for a new executive director. Joe McNamee is stepping down at the end of the year, after a decade’s service, and MD Kirsten Fiedler is “turning her attention to new challenges in the civil rights field.” The new executive director will apparently “mostly take over the functions of the current managing director”. Look out for the job ad soon.

To support my work, please consider visiting my Patreon page or buying my book, Control Shift: How Technology Affects You and Your Rights. Here are the links to the book’s British, American and German Amazon pages.

FACEBOOK MADE BIG CHANGES TO ITS PRIVACY AND DATA-SHARING POLICIES last week (literally just after I sent out the last Connected Rights – thanks Facebook). In short, it’s giving users a bit more control over their data (data portability and deletion of old stuff will be easier) and also removing the ability of data brokers such as Acxiom to offer targeting on Facebook’s platforms.

These are good moves and, as I predicted, a useful way for Facebook to dress up GDPR-related changes as post-Cambridge Analytica soul-searching. See also: Facebook’s changes to its Custom Audiences service, where advertisers will now have to self-certify that they got their hands on customers’ email addresses in a totally legit way.

BUT WAIT… WILL FACEBOOK ROLL OUT GDPR-grade rights for its users around the world? No, says Mark Zuckerberg.

From Reuters: “Zuckerberg told Reuters in a phone interview that Facebook was working on a version of the law that would work globally, bringing some European privacy guarantees worldwide, but the 33-year-old billionaire demurred when asked what parts of the law he would not extend worldwide.”

Facebook is writing laws now? That aside, it will be fascinating to see which bits of the GDPR the company won’t extend globally, and how that might result in systemic discrepancies across its platform. Given EU privacy regulators’ keenness for applying their rules as widely as possible, those differences had better be either minor or very exactly applied.

FORMER FCC CHAIR TOM WHEELER IS A FAN of the GDPR, and he clearly does hope the law provides benefits for people in the US and elsewhere.

Writing for The New York Times, Wheeler said: “Fortunately, the European Union’s law should indirectly help Americans somewhat. In only a few weeks, Facebook, Google and all the other internet companies that collect our private information will have to allow European customers the protections these companies have fought to deny Americans. In an interconnected world where digital code doesn’t respect the geographical or national borders, this will surely have a positive global impact.”

IS THE “FAKE NEWS” PANIC out of control? An NYT report on Malaysian fake news legislation suggests so. The law apparently offers poor definitions of the problem, and essentially allows the government to decide what constitutes the truth.

Here’s the rub: “…members of Malaysia’s political opposition say the legislation is intended to stifle free speech ahead of elections that are widely seen as a referendum on Prime Minister Najib Razak, who has been tainted by a scandal involving billions of dollars that were diverted from Malaysia’s state investment fund…. Since irregularities in the investment fund came to light three years ago, a slew of politicians, writers and even a political cartoonist have been charged with offenses such as sedition and defamation.”

If you’d like me to write articles for you about digital rights issues, speak at your event or provide privacy advice for your business, drop me an email at david@dmeyer.eu.

THIS WEEK’S DATA PROTECTION OUTRAGE is Grindr, the gay dating app, sharing its users’ HIV statuses with third-party companies. Also, their location data. All in plain text.

HERE’S SOMETHING NEW TO ADD TO THE LIST of risks around voting machines: the fact that many employees of the companies that make them have had their data leaked into the public view. As security site CSO points out, this might make the machines vulnerable, because people keep reusing the same passwords for different things.

THE CHINESE GOVERNMENT WANTS the country’s facial recognition and surveillance systems fully unified and operational by 2020. According to Radio Free Asia, that includes a surveillance platform called Sharp Eyes that can “link up public surveillance cameras and those installed in smart devices in the home, to a nationwide network for viewing in real time by anyone who is given access.” The platform will be used along with the “social credit” system that already bars people from buying train tickets if they have ever been caught “spreading false information” online.