Lions and Tigers and Bears, OH MY! (Data Security, app bans, and National Security)

Once again, the current US President (No 45, in this case) is making a mountain out of a molehill.

Just, in this case, not much of one, and for one of the small number of instances in his tenure as El Prez, he's actually hitting on a genuine (NOT FAKE! WOW!) issue. 

A Judge in the USA has issued a 'stay' order, preventing the US Government (USG) from denying US internet users the ability to download certain Social Media (SM) platforms, these being of Chinese origin - in this case, specifically WeChat.

Boiled down, the USG has said that the Chinese-operated SM platform, which also routinely censors information that the Chinese Government does not like (such as information on SARS-CoV-2, or COVID-19), threatens US National Security through its "malicious" behaviour of seeking out and downloading user data of many forms, such as network activity, location data, and browsing and search histories.

OK, then can we expect bans for FB, Twitter, Instagram, and all the other SM platforms that apparently regularly dive into user data with apparent freedom?! No? Quelle surprise, mon ami.

Many applications (and there's another misuse of language that I'll get into in another post before long! Watch this space 😉 ) note user data, and it's not just limited to network activity, location data, and browsing and search histories; they'll look for telephone logs, activities, who you're talking to that very moment, your contact lists, and so much more besides.

For YEARS, security analysts and companies have advised users of these packages that they MUST examine the 'permissions' that these things demand access to, in order to allow users to actually use the packages, and deny those that try to overreach the amount of permission that actually need in order to operate. You really should be asking why they need access to all this information, folks. Taking a photo should not generally need, for example, access to your contact listings. Point made?

Now, while acknowledging that There Ain't No Such Thing As A Free Lunch (a.k.a. "TANSTAAFL"), these 'apps' also often allow 'in-app purchases', sometimes only offering the use of a credit/debit card payment system, instead of, for example, GooglePay, or PayPal, or similar (which omission also tends to breach their agreements with the major operator platforms such as Apple and Google, but that's another story).

So, by allowing these prying 'apps' access to your inside leg measurement, you're also giving them the keys to your bank as well. Really smart. Not. Remember, there have been documented cases of peoples bank accounts being plundered by rogue 'apps' (do a search on your preferred internet search engine if you want to see examples of this). Always check those permissions, people. If they are asking for odd and extensive 'permissions', you really MUST be asking "WHY?".

From a National Security angle (and I've been both a Reservist and a Civil Servant in the employ of Her Majesty's Government, so I know whereof I speak), government employees should be required to adhere to a kind of SM limitation agreement, in the form of either requirements under primary law (which we have in the UK with the Official Secrets Act), or Non Disclosure Agreements (NDAs) (which is the only option in the USA, due to the 1st amendment rights to freedom of speech). The idea that users personal data being used by the Chinese is some form of national security issue is not much of a stretch of credulity, but it is a stretch, none the less.

A more realistic threat to US National Security would be those SM users with access to classified information. Far better, I think, to require people with clearances that the USG is concerned about, to restrict them from using SM as much as they do. Enforceable Usage Policies (and specific NDAs for those forms of access) in return for clearances seems to be the best way to approach this: The willing surrender of certain privileges/speech rights in return for access seems to be a fair deal, to me.

So, while the USG and El Prez are doing a Chicken Little, and it actually is an issue, it's just not much of a National Security issue comparatively speaking, and a wholly preventable one if people use a little common sense, by having SM users engaging a few brain cells and asking if an 'app' actually needs those odd and extensive permissions.

Of course, that's another issue too: Common Sense.

Yeeeaaaah. Let's not go there today, eh? 😉

Kindle on Android - new permissions? Why? (Updated)

The following is an email that I just sent to Amazon Kindle support. It's self explanatory.

Dear Sir or Madam,

I have been a customer of Amazon for some time; I have also been a Kindle app user on my mobile phone for a while as well.

However, your recent update to the software is putting both of these in jeopardy of losing me as a customer, as they appear to be purely aimed at dredging out data and personal information to which you have no legitimate right.

Therefore, please specify why you need all the following application permissions for me to read e-books that I have paid for?

• Device & app history - why do you need to know what applications are running on the phone in addition to the Kindle App?
• Wi-Fi connection information - why do you need to view Wi-Fi connections? The phone can handle those quite effectively already.
• Device ID & call information - Why do you need to see this personal information that has nothing to do with you? (read phone status and identity)

Thanks you for your time in this matter.

Here's the thing: It's a massive privacy invasion. Why? Because they're trawling for information that they appear not to have any legitimate need to know. The number of anyone you're talking to, for example "read phone status and identity").

They surely don't need to know the details of any wifi network you're on - suppose it belongs to someone else, and you're using it with the owners permission - does Amazon need to know this? Of course not.

Likewise, they don't need to know if you've been playing Angry Birds, or using a satnav, or whatnot.

Frankly, it's a symptom of several app producers over the last couple of years; those that haven't responded have found me no longer using their apps - I delete them. Those that reply, or state why they need addition app permissions on their Android Play pages generally keep my patronage.

The key here is openness. And Amazon have, to date, been remarkably closed about why they want these new permissions.

The only explanation that jumps to mind, is that they want to know everything about you, and as they haven't got a legitimate reason for asking for it, just add new permissions to the app, in the hope that you'll let them see your inside leg measurement without a second to review the new permissions.

I'll keep you updated on this once I receive an answer.

UPDATE

Well, Amazon replied while I was at work, so here's their reply. I've underlined the important bits, and my comments are below it.

Hello,

We sincerely apologize about, first about these requirements when updating your Kindle app for Android, and second for all the inconvenience this may cause you. I fully understand your displeasure and I hope your satisfaction is our highest concern.

I know that this very disappointing to you but please be assured that we will not store any personal information from you nor get this information by agreeing to these requirements. The Kindle app just need to get access on these (Device and app history, Identity, Photo's/Media/Files, WiFi connection and information and Device ID and Call Information) so it will function well. These are the settings that mostly affect the app and we would like to ensure that the app will work best by requesting access to these.

As we've introduced this update, we are currently working on this Kindle app for easy access and better improvement of functions, thanks for bringing this to our notice. Please be assured that we will keep your account private and we will never get information from your phone----we value privacy highly above all else.

We are grateful to hear about this feedback that would help us improve the Kindle experience. Please be assured that we're continuously working hard to improve the Kindle apps.

Now your feedback about this was forwarded to the Kindle Development Team with the hope that their action on this concern will elicit a change in Kindle app update--I know they'll want to hear about your experience regarding this.

As with all of our products, we continue to make Kindle apps better for customers with regular software updates. As we've introduced a new software update recently, we are currently working on this update for easy access and better improvement of functions, as soon as this feature becomes available on the next software update, we will definitely let you know about this by emailing you or through our website.

Customer feedback like yours helps us in our endeavor to improve the service we provide, and we're glad you took time to write to us.

Thanks again for giving us the opportunity to improve. We look forward to see you again soon.

Please let us know if there is anything further we can do for you in the meanwhile.

Thanks for using Kindle.

Best regards,

OK. So as you can see, the meat of their reply is in the second paragraph, where they undertake not to access or store personal information and/or data.


The interesting upshot of this is that the Android Operating System appears to have some stability issues, if they need permissions like this to make a simple e-book application run with more reliably.

It'll be interesting to see how the yet-to-be-announced successor to Android KitKat fares.

In the mean time, I'm satisfied by both the speed of the Customer Services response, and the content of it, so I'll be updating my copy of the Kindle Android application.

It would have been MUCH better had they said this in the blurb for the app on the Google Play website, and hopefully, they're going about doing this as I write this, but at least the point has been made.