The IT Nerd

To be clear, I am not the least bit surprised that this could be possible. Though part of me is still a bit stunned at this story as it is an insane privacy breach if this is true. And what I am talking about is a company called Cox Media Group who claims that it can eavesdrop on your conversations, through microphones in smartphones, TVs, and smart speakers. This comes via 404 Media:

A marketing team within media giant Cox Media Group (CMG) claims it has the capability to listen to ambient conversations of consumers through embedded microphones in smartphones, smart TVs, and other devices to gather data and use it to target ads, according to a review of CMG marketing materials by 404 Media and details from a pitch given to an outside marketing professional. Called “Active Listening,” CMG claims the capability can identify potential customers “based on casual conversations in real time.”

The news signals that what a huge swath of the public has believed for years—that smartphones are listening to people in order to deliver ads—may finally be a reality in certain situations. Until now, there was no evidence that such a capability actually existed, but its myth permeated due to how sophisticated other ad tracking methods have become.

It is not immediately clear if the capability CMG is advertising and claims works is being used on devices in the market today, but the company notes it is “a marketing technique fit for the future. Available today.” 404 Media also found a representative of the company on LinkedIn explicitly asking interested parties to contact them about the product. One marketing professional pitched by CMG on the tech said a CMG representative explained the prices of the service to them. 

“What would it mean for your business if you could target potential clients who are actively discussing their need for your services in their day-to-day conversations? No, it’s not a Black Mirror episode—it’s Voice Data, and CMG has the capabilities to use it to your business advantage,” CMG’s website reads.

And:

With Active Listening, CMG claims to be able to “target your advertising to the EXACT people you are looking for,” according to its website. The goal is to target potential clients or customers based on what they say in “their day to day conversations,” the website adds.

Reading this story sent chills down my spine. Now in my case, my household is part of Team Apple. Which means the four HomePod mini’s as well as the three iPhones along with two Apple Watches that my wife and I collectively own are covered by this policy which fully lays out what data Apple collects and why along with what data they may keep and where that data goes. That made me a feel bit better. The only other device in my home that has any form of voice interface is this TCL TV which is powered by the Roku operating system. They have this privacy policy which states the following:

If you link your Roku Device to a non-Roku voice-enabled virtual assistant (e.g., Alexa and Google Assistant), you are choosing to have us disclose device data to the voice assistant provider, such as device type and name, device identifiers, its state (e.g., whether the device is powered on, whether the device is playing video), names of installed streaming service apps, and the names of your device HDMI ports. If you direct such virtual assistant to display content, we will also disclose the content to such voice provider to carry out your request.  For information about how these providers use this data, please review their privacy policies. 

I have the TV linked to Apple HomeKit. Which means that it is covered by Apple’s privacy policy. And I do have a Roku voice remote that requires me to press a button to do anything. So it’s not actively listening into anything I am doing. So I am fine there as well. Now why am I telling you all of this? Well, depending on what smart devices you have in your home, you might be fine, our you might have an issue:

CMG lists a number of other companies as its partners and publishers. These include Amazon, Microsoft, and Google. None of those companies responded to a request for comment on whether they were aware of this capability or whether it was in active use.

I would assume that if you have any Google, Amazon or Microsoft devices, then you likely have a problem. I say that because the first two are exactly the type of companies who would do anything to gather as much data on you as possible to monetize it in any way possible. The jury is still out on Microsoft. But let us assume that they are in the Google or Amazon camp for now until they prove themselves to be different.

I will be interested to see how CMG and their clients respond to this story now that this is out there. Because I think it is safe to say that this story is going to get a lot of attention. Including from regulators which I am sure that CMG and their clients do not want. Thus if they don’t respond to this with some talking points to try and defuse this, they may have bigger problems on their hands.

Internet connected cars are all the rage at the moment. And I for one will not be buying one and I will be hanging on to my Internet disconnected car for as long as I can do so. The reason being is according to a study done by Mozilla, cars collect all sorts of data about you and sends it back to the manufacturer. And the kind of data that is collected is shocking:

We reviewed 25 car brands in our research and we handed out 25 “dings” for how those companies collect and use data and personal information. That’s right: every car brand we looked at collects more personal data than necessary and uses that information for a reason other than to operate your vehicle and manage their relationship with you. For context, 63% of the mental health apps (another product category that stinks at privacy) we reviewed this year received this “ding.”

And car companies have so many more data-collecting opportunities than other products and apps we use — more than even smart devices in our homes or the cell phones we take wherever we go. They can collect personal information from how you interact with your car, the connected services you use in your car, the car’s app (which provides a gateway to information on your phone), and can gather even more information about you from third party sources like Sirius XM or Google Maps. It’s a mess. The ways that car companies collect and share your data are so vast and complicated that we wrote an entire piece on how that works. The gist is: they can collect super intimate information about you — from your medical information, your genetic information, to your “sex life” (seriously), to how fast you drive, where you drive, and what songs you play in your car — in huge quantities. They then use it to invent more data about you through “inferences” about things like your intelligence, abilities, and interests.

The car companies then sell this data, as it’s a revenue source for them. And opting out of this data collection isn’t an option for the most part. Consent is an illusion as simply stepping into a car with this sort of tech qualifies as consent. And finally, all car companies do this.

This to me is not cool and I hope that consumers file complaints with the relevant government agencies (In Canada that’s the Privacy Commissioner) so that all of these car companies are forced to explain why they do this which may make them reconsider if they should be doing this at all.

Last week I told you about a data leak involving The Police Service of Northern Ireland where they accidentally published the data on all their staff creating a critical incident in the process. As bad as that is, it just got worse. Here’s the details from Sky News:

The Police Service of Northern Ireland (PSNI) says it fears its officers could be targeted and intimidated after saying it believes that dissident republicans have data on staff that was accidently leaked by the force last week.

“We are now confident that the workforce dataset is in the hands of dissident republicans,” Chief Constable Simon Byrne said.

“It is therefore a planning assumption that they will use this list to generate fear and uncertainty as well as intimidating or targeting officers and staff.”

And:

Earlier, a redacted version of the leaked document that listed the names of police officers in Northern Ireland was posted on a wall facing a Sinn Fein office in Belfast.

Keep in mind that the peace in Northern Ireland is a recent thing because of the Good Friday accords. Thus this data leak doesn’t exactly help this situation which has not been in a good place for a couple of years now. This this situation illustrates that data breaches don’t just have a financial and repetitional impact, they also have a life threatening impact as is illustrated here.

The good news is that The Police Service Of Northern Ireland didn’t get pwned by hackers. But the bad news is they might as well have been. I say that because they really screwed up and accidentally published the data on all their staff creating a critical incident in the process:

The Police Service of Northern Ireland (PSNI) earlier apologised for the self-inflicted security breach after it inadvertently published the information in response to a Freedom of Information (FOI) request on Tuesday.

The breach involved the surname, initials, the rank or grade, the work location and departments of all PSNI staff, but did not involve the officers’ and civilians’ private addresses.

Alliance Party leader Naomi Long said it was a concern that a member of staff, who she understands to be “relatively junior”, had access to the sensitive data.

PSNI said its chief constable Simon Byrne is cutting his family holiday short to deal with the crisis and is expected to answer questions from politicians.

This is bad. This is very bad. Why is this bad? Here’s why:

The information, which was available online for up to three hours, revealed members of the organised crime unit, intelligence officers stationed at ports and airports, officers in the surveillance unit and almost 40 PSNI staff based at MI5’s headquarters in Holywood, the Belfast Telegraph reported.

Clearly there was no process in place to limit who has access to this data. Nor were there any checks to make sure that the data was safe to release. This is another one of those cases where heads need to roll over this because I cannot imagine what the members of this police service are going through knowing that some of their personal information is out there right now.

#EpicFail

By Ani Chaudhuri, CEO, Dasera

Beyond the usual guidelines, there are several innovative and layered approaches that parents might not have considered:

• Digital Footprint Starts at Birth: Avoid sharing identifiable information about your child on public platforms. This includes full names, birth dates, and locations. A harmless birth announcement can offer malicious actors a starting point.
• Rethink “Smart” Toys: Before purchasing, scrutinize the data handling practices of internet-connected toys. Many collect vast amounts of information, and not all have stringent security measures.
• Understand School Data Handling: Engage with your child’s school to understand how they store, use, and protect student data. Often, educational platforms have data vulnerabilities or share information with third parties.
• Voice-Activated Devices: Devices like Siri or Alexa constantly listen for activation cues. Ensure they aren’t inadvertently recording your child’s conversations or information.
• Online Gaming: Even games designed for younger children can have chat features. Ensure these are disabled or monitored. Personal information can be unintentionally shared during seemingly innocent in-game conversations.

From the moment they are born. It may sound extreme, but children have a digital identity almost from birth in our current digital era. Whether it’s hospital records, pediatrician visits, or the first photo shared on social media, their digital footprint begins immediately. Each of these instances carries data – a golden ticket for identity thieves. Protecting a child’s ID isn’t just about preventing financial fraud; it’s about safeguarding their entire digital existence and future reputation.

Child ID and privacy isn’t just about what parents should do; it’s equally about the don’ts and nevers:

• Never Use Their Name for Passwords: Using a child’s name or birthdate as a password for any online service is a glaring risk. It’s often the first thing hackers will try.
• Don’t Overlook Data Breaches: Not all data breaches make headlines. Watch for breaches involving services your child uses and act accordingly.
• Never Assume a Platform is Safe: Just because a platform is designed for children doesn’t mean it’s secure. Constantly scrutinize its data practices.
• Don’t Underestimate Word of Mouth: Children learn much from their peers. Educate them about the basics of data privacy so they can be advocates among their friends.

Protecting a child’s ID and privacy in today’s world requires vigilance, continuous education, and proactive measures. It’s not just about today’s threats but also about preventing potential risks in the future. Parents must be the first line of defense, even if it means challenging the status quo of digital interaction.