Some big Internet companies, privacy, and the government

May 1, 2013 6:43 PM

EFF's Who Has Your Back? for 2013. The Electronic Frontier Foundation has published the 2013 edition of their analysis of how well your private data is protected from the government by about a dozen big internet companies. Also available as pdf. Focused on the US, but may apply elsewhere, too.
posted by at home in my head (13 comments total)

Surprised to see AT&T get even a single gold star here, especially after, y'know ... this.
posted by RobotVoodooPower at 7:37 PM on May 1, 2013

"Micro$oft" being a far far better corporate citizen than Apple shouldn't be a surprise to anyone by now, but it's still pretty funny to see in writing.
posted by drjimmy11 at 8:07 PM on May 1, 2013 [1 favorite]

This list bugs me, because as far as I can tell Google's disclosure policy is substantially similar to Apple's but somehow Google gets a "requires warrant" star and Apple doesn't.

Anyone who wants to explain this, please do. I generally trust the EFF and value their mission.

Google:

We will share personal information with companies, organizations or individuals outside of Google if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to:

• meet any applicable law, regulation, legal process or enforceable governmental request.
• enforce applicable Terms of Service, including investigation of potential violations.
• detect, prevent, or otherwise address fraud, security or technical issues.
• protect against harm to the rights, property or safety of Google, our users or the public as required or permitted by law.

Apple:

It may be necessary − by law, legal process, litigation, and/or requests from public and governmental authorities within or outside your country of residence − for Apple to disclose your personal information. We may also disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate.

This isn't a Google vs. Apple thing, it's just one thing that looks inaccurate to me. I don't know what to think of the rest of the list.
posted by polyhedron at 8:59 PM on May 1, 2013

Perhaps that the Google one specifies an "enforceable" governmental request while Apple's says only a "request" from a governmental authority? Or maybe just a mistake.
posted by markr at 9:08 PM on May 1, 2013 [1 favorite]

Good to see my ISP (Sonic.net) on the list, with 6 stars.
posted by zsazsa at 9:08 PM on May 1, 2013 [1 favorite]

Surprised to see AT&T get even a single gold star here, especially after, y'know ... this.

DOJ Helped AT&T, Others Avoid Wiretap Act, Promised Not To Charge Them If They Helped Spy On People
posted by homunculus at 9:39 PM on May 1, 2013

Anyone who wants to explain this, please do. I generally trust the EFF and value their mission...

EFF loves bullet points?
posted by Thorzdad at 4:43 AM on May 2, 2013

This list bugs me, because as far as I can tell Google's disclosure policy is substantially similar to Apple's but somehow Google gets a "requires warrant" star and Apple doesn't.

Google: meet any applicable law, regulation, legal process or enforceable governmental request.... protect against harm ... as required or permitted by law.

Apple: We may also disclose information about you if ... disclosure is necessary or appropriate.

In other words - google will hand over your data when legally required to do so. Apple will hand over information when it feels it is 'appropriate', even when not legally bound to do so.

Of course, that could be because google wants to slurp up all your data and keep it for itself, so it doesn't mean that google is a 'better' company as such, just that google requires a warrant or other legal instrument to hand over your data to law enforcement, and apple doesn't. More specifically, they're referring to a specific test:

This category is inspired by the 2010 decision in United States v. Warshak, a case in which the Sixth Circuit Court of Appeals held that the Fourth Amendment protects emails stored with email service providers, and the government must have a search warrant before it can seize those messages. This decision is a critical victory for Internet privacy, but is the holding of one appeals court — and so is not binding legal precedent throughout the entire country.

We award stars to companies that commit to following the Warshak rule. When companies require a warrant before turning over private messages to law enforcement, they are ensuring that private user communications are treated consistently with the protections of the Fourth Amendment to the Constitution.

posted by ArkhanJG at 5:54 AM on May 2, 2013 [1 favorite]

Further to that, here're google's published legal guidelines:

What does Google do when it receives a legal request for user data?

Respect for the privacy and security of data you store with Google underpins our approach to complying with these legal requests. When we receive such a request, our team reviews the request to make sure it satisfies legal requirements and Google's policies. Generally speaking, for us to comply, the request must be made in writing, signed by an authorized official of the requesting agency and issued under an appropriate law. If we believe a request is overly broad, we'll seek to narrow it. We notify users about legal demands when appropriate, unless prohibited by law or court order.

...

Does a law enforcement agency in the U.S. have to use legal process to compel Google to provide user data or will a phone call be enough?

The government needs legal process—such as a subpoena, court order or search warrant—to force Google to disclose user information. Exceptions can be made in certain emergency cases, though even then the government can't force Google to disclose.

What kinds of emergency cases?

We'll voluntarily disclose user information to government agencies when we believe that doing so is necessary to prevent death or serious physical harm to someone. The law allows us to make these exceptions, such as in cases involving kidnapping or bomb threats.

Note the distinction between user data (your emails etc) and user information, which is information about the user, presumably IP address records and the like.

Apple doesn't publish theirs, according to the EFF, so I'm unaware of their particular process.
posted by ArkhanJG at 6:04 AM on May 2, 2013 [1 favorite]

Glad to see Twitter has 6 stars.

Google only has 5 stars because EFF doesn't like the ambiguity of "We notify users about legal demands when appropriate". I guess that's a little weasely but given the history of Google's activism in protecting users against intrusive governments, I'll give them a pass.

Yahoo is still in the dumps with 1 star, it's not clear to me why they've always been so awful. Didn't the company draw from the same talent pool of technolibertarians as the rest of the Bay Area tech companies?
posted by Nelson at 10:19 AM on May 2, 2013

I’m surprised at the LinkedIn rating. They never struck me as a company that would care too much, for no particular reason admittedly.
posted by bongo_x at 11:42 AM on May 2, 2013

Paleofuture: Predictions for Privacy in the Age of Facebook (from 1985!)
posted by the man of twists and turns at 1:18 PM on May 2, 2013

ArkhanJG, thanks for digging into it. The Warshak test must be the whole of it, although it seems to me like Google has left themselves a loophole. "Voluntary disclosure" "permitted by law" seems fairly open.
posted by polyhedron at 2:23 PM on May 2, 2013