Privacy

Articles and publications written by the CCC about Privacy.

Peretasan Pusat Data Nasional dan Pentingnya Melindungi Data Pribadi

Beberapa waktu lalu, jutaan warga Indonesia dikejutkan dengan berita diretasnya Pusat Data Nasional (PDN). Adanya kejadian tersebut menyebabkan menjadi terhalangnya berbagai layanan publik dasar dikarenakan pusat data yang tidak bisa diakses, mulai dari pembuatan paspor, proses imigrasi otomatis, hingga layanan beasiswa pendidikan. Peretas PDN tersebut juga meminta uang tebusan sebesar USD8 juta kepada pemerintah bila ingin data tersebut dikembalikan (tempo.co, 27/6/2024).

Tidak mengherankan, banyak masyarakat yang meluapkan kekesalannya kepada pemerintah yang dianggap tidak bertanggung jawab dalam menjaga data masyarakat Indonesia, baik melalui media sosial maupun media massa. Kekesalan tersebut khususnya diarahkan kepada Kementerian Komunikasi dan Informatika (Kominfo) yang dianggap abai dalam menjalankan salah satu tugasnya yang paling penting.

Adanya kejadian tersebut tidak bisa dilepaskan dari proses digitalisasi yang semakin masif di Indonesia, seiring dengan perkembangan teknologi informasi yang semakin pesat. Pembangunan PDN sendiri dimulai pada tahun 2022 lalu, terletak di Cikarang, yang digunakan untuk menyimpan berbagai data penting pemerintah dan juga masyarakat Indonesia (cnbcindonesia.com, 6/2/2024).

Tidak bisa dipungkiri, digitalisasi saat ini merupakan proses yang hampir mustahil dapat dibendung. Seiring perkembangan teknologi yang semakin pesat, proses pengubahan informasi menjadi dalam format digital saat ini sudah melingkupi berbagai hal yang tidak bisa kita lepaskan dari keseharian kita, mulai dari konten digital seperti musik dan film, informasi transaksi jual beli, dan juga informasi pribadi yang kita miliki.

Terkait dengan hal tersebut, informasi pribadi memang merupakan hal yang sangat penting untuk dijaga dengan sebaik-baiknya. Infomasi pribadi kita dalam hal ini mencakup berbagai informasi yang sangat berpotensi bisa disalahgunakan oleh pihak-pihak yang tidak bertanggung jawab, seperti alamat, nomor induk kependudukan, nomor telepon, dan lain sebagainya.

Untuk itu, perlindungan data pribadi merupakan hal yang sangat penting dan krusial, dan kelalaian pemerintah yang menyebabkan peretasan tersebut bisa terjadi merupakan hal yang sangat serius dan wajib mendapatkan perhatian dari jutaan masyarakat Indonesia. Peretasan data tersebut merupakan hal yang sangat berbahaya, di mana data masyarakat tersebut berpotensi besar akan disalahgunakan oleh pihak-pihak yang tidak bertanggung jawab.

Secara garis besar, Indonesia sendiri pada dasarnya sudah memiliki kerangka hukum yang ditujukan untuk melindungi data pribadi. Pada tahun 2022 lalu, disahkan Undang-Undang No. 27 Tahun 2022 tentang Perlidnugan Data Pribadi (UU PDP) yang ditujukan untuk menjaga keamanan data, dan juga proses mitigasinya.

Untuk melakukan hal tersebut, UU PDP mencantumkan kewajiban bagi perusahaan untuk menjaga keamanan dan kerahasiaan data pribadi. Dalam undang-undang tersebut juga diatur mengenai proses yang harus dilakukan apabila ada perusahaan yang gagal melakukan hal tersebut, misalnya terjadi peretasan, maka harus memberikan pemberitahuan kepada pengguna atau konsumen selambat-lambatnya 3 x 24 jam (hukumonline.com, 16/5/2024).

Perusahaan yang melanggar ketentuan tersebut maka akan berhadapan dengan sanksi yang tercantum di dalam aturan. Sanksinya sendiri dalam bentuk yang bermacam-macam, mulai dari sanksi administratif, sanksi perdata seperti membayar uang ganti rugi kepada konsumen, hingga sanksi pidana.

Adanya aturan undang-undang tersebut tentu merupakan hal yang sangat patut untuk diapresiasi dan didukung. Perlindungan data pribadi merupakan hal yang sangat penting bagi konsumen dan sangat rentan disalahgunakan. Tanpa adanya aturan yang secara eksplisit melindungi data pribadi, maka pihak-pihak tertentu seperti pelaku usaha yang tidak bertanggung jawab berpotensi bisa dengan bebas menyebarkan data pribadi pelanggannya yang tentunya akan membawa banyak kerugian bagi pelanggan tersebut.

Tetapi yang memprihatinkan, kejadian beberapa minggu lalu justru membuktikan bahwa ternyata pihak yang paling lalai dalam menjalankan hal tersebut adalah pemerintah itu sendiri. Yang lebih memprihatinkan, beberapa oknum di pemerintahan yang memiliki tanggung jawab untuk melindungi masyarakat justru bersikap seakan-akan hal tersebut bukan hal yang krusial, seperti menunjukkan sikap “pasrah” bila pemerintah kehilangan data berharga masyarakat (wartakota.twibunnews.com, 2/7/2024).

Sikap abai dan lalai yang ditunjukkan pemerintah dalam menjalankan tugasnya untuk melindungi data pribadi masyarakat ini tentunya bukan hanya akan membahayakan warga negara, tetapi juga akan meningkatkan citra buruk negeri di mata investor dan pelaku usaha dari luar negeri. Perlindungan data pribadi saat ini menjadi salah satu tolok ukur bagi para investor untuk menanamkan modalnya (beritasatu.com, 24/1/2023).

Tidak mengherankan bahwa, data center yang dimiliki dan dikelola oleh pemerintah memang memiliki kecenderungan lebih tidak aman. Berbeda dengan pihak swasta, pemerintah merupakan institusi yang tidak harus berhadapan dengan kompetitor, dan maka dari itu memiliki insentif yang lebih rendah untuk memberikan pelayanan terbaik, tidak seperti pihak swasta.

Apabila ada perusahaan swasta yang mengalami data breach atau terkena ransomware misalnya, dan tidak bisa diakses selama berhari-hari, sudah pasti pegawai yang bertanggung jawab akan segera diberi sanksi hingga dipecat. Selain itu, perusahaan tersebut juga akan dihukum oleh pasar dengan dijauhi oleh konsumen. Terkait dengan hal tersebut, keamanan cyber pemerintah sendiri juga dikonfirmasi oleh komunitas ethical hacker di Indonesia, yang menyatakan bahwa situs yang dimiliki oleh lembaga pemerintah sering dijadikan sasaran untuk para hacker baru yang masih belajar (pikiran-rakyat.com, 2/7/2024).

Terkait dengan pelibatan pihak swasta, sebenarnya hal tersebut dimungkinkan dalam bentuk kerja sama dengan pihak vendor. Sehubungan dengan hal tersebut, pemerintah sendiri sebenarnya sudah menggunakan vendor dalam rangka pengelolaan Pusat Data Nasional. Tetapi, vendor yang terlibat tersebut juga diberikan kepada anak perusahaan Badan Usaha Milik Negara (BUMN), salah satunya adalah melalui PT Telkom Indonesia melalui anak perusahannya yakni Telkomsigma (investor.id, 8/7/2024),

Selain itu, bukan tidak mungkin juga, kejadian yang sangat amat fatal ini juga dijadikan sebagai contoh yang tidak baik bagi sebagian oknum swasta tertentu di Indonesia yang tidak bertanggung jawab. Bila pemerintah saja, yang memiliki dana yang sangat besar, wewenang yang luas, dan juga sumber daya yang berlimpah, bisa bersikap demikian terhadap data yang dimiliki oleh warganya, lantas bagaimana dengan para pelaku usaha yang memiliki modal dan sumber daya yang sangat terbatas?

Sebagai penutup, perlindungan data pribadi merupakan hal yang sangat penting dan krusial seiring dengan semakin masif dan pesatnya proses digitalisasi, seiring dengan perkembangan teknologi yang sangat cepat. Untuk itu, jangan sampai kita bersikap tak acuh terhadap hal tersebut. Terlebih lagi, yang bersikap abai justru lembaga pemerintah yang memiliki kewajiban untuk melindungi data pribadi warga negara.

Originally published here

CCC Concerns Over MCMC’s Licensing Requirement for Social Media Companies

KUALA LUMPUR, 31st July 2024 — The Malaysian Communications and Multimedia Commission’s (MCMC) recent directive for social media companies to register for a license is concerning, potentially paving the way for censorship and suppression of free speech. This policy could hinder open discourse and stifle dissenting opinions, posing a significant risk to democratic principles.

“Requiring social media companies to register for licenses is a step that could limit the free exchange of ideas and opinions. We must be cautious of policies that could lead to overreach and repression,” said Tarmizi Anuwar, Malaysia Country Associate at the Consumer Choice Center.

Furthermore, the potential for increased data vulnerability is alarming. The obligation for companies to share sensitive information with the authorities raises the risk of data breaches, which could severely impact users’ privacy and financial security. The Consumer Choice Center stresses that any regulatory measures should carefully balance public security with the protection of individual freedoms.

Additional concerns include the potential burden on smaller platforms, which may struggle with the compliance costs and administrative requirements of the licensing process. This could hinder innovation and limit competition in the digital market, ultimately reducing consumer choice.

The Consumer Choice Center urges a reevaluation of this policy. We call on the MCMC and the government to engage in dialogue with all relevant stakeholders to develop a framework that upholds both security and the fundamental rights of expression and privacy. A transparent and inclusive process is essential to ensure that the policy aligns with democratic values and the needs of the digital age.

The latest troubling data hacks underscore the futility – and danger – of excessive KYC/AML rules

Three years ago, I opened a column by running through a number of damning data hacks and leaks that looked terrible at the time:

On a Monday, there is a data leak affecting half a billion Facebook accounts, by Tuesday a bot has scraped 500 million LinkedIn accounts. On Wednesday, Stanford University announces a hack that exposed thousands of Social Security numbers and financial details. Then Thursday, the world’s largest aviation IT company announces 90% of passenger data may have been accessed in a cyberattack. And so on. The cycle is endless.

This week, we’re treated to a new batch of significant compromised data, affecting a major bank and FinTech platform provider as well as an identity verification company.

Rather than making the case for a national privacy law with teeth that could put a stop to this, as I’ve articulated too often before, now is a better opportunity to ask why these companies had this information in the first place, and why the KYC/AML policies that require such data collection should be drastically reformed to better protect consumers from this happening again.

The ID leak should dim the prospects for KOSA and other bills

The first hack of the identity verification company was reportedly the result of administrative keys being exposed for over a year.

As reported by 404 Media, the Israeli security company AU10TIX somehow had the master credentials to their logging platform publicly viewable on their database directory, which “contained links to data related to specific people who had uploaded their identity documents.”

A subsequent malware attack allowed hackers to access names, dates of birth, nationalities and identification numbers, and full-resolution copies of uploaded drivers licenses and other identity documents.

Links and examples of this data were posted to various channels on Telegram, selling access to the cache of information that could likely expose the personal data of hundreds of millions of users.

The identity company was a verification service of choice for major platforms including X, Fiverr, PayPal, Coinbase, LinkedIn, Upwork, and many more, though we haven’t gotten confirmation which platform was hit the hardest.

Why is this significant?

First, the fact that this data is available out there – whether on .onion websites on the dark net or elsewhere – means that potentially hundreds of millions of Americans could be vulnerable to identity theft, extortion, or significant financial or personal harm. Even if the harm doesn’t come today, these credentials and information cost virtually nothing to store and weaponize later by bad actors.

Second, companies are required to collect and store this data in order to comply with various statues. And yet more could be on the docket.

As pointed out by R Street’s Shoshana Weissman, this latest hack should once again dim the prospects for the various state and federal attempts at requiring ID verification for online services for both children and adults, whether on social media, pornography websites, or even rudimentary payment services.

Whether it’s the proposed Kids Online Safety Act (KOSA), or various state laws intended to block young people from using or accessing online services, forcing anyone to upload their photo ID and personal information just to use a website or a service demonstrably can do more harm than good.

At the cost of leaking every user’s data to the hacker-infested waters of the Internet, are measures intended to make sure young people can’t use certain websites worth the cost? We’d gather, no.

The financial hack that should undermine the KYC and AML regime

The second significant hack that likely affects not just personal identities but likely billions of dollars is the ransomware attack on Evolve Trust and Bank.

This “cybersecurity incident” of the trusted bank and partner to hundreds of FinTech services has been posted to various darknet websites, and contains social security numbers, account numbers, balances, phone numbers, addresses, and much more.

Considering the significant trove of precious financial information including even individualized transactions, this is likely one of the most costly hacks to ever occur at an American financial institution.

Why did this bank have all of this information at the ready?

Because of the various “Know Your Customer” and “Anti-Money Laundering” laws in place in the United States, financial institutions are required to collect and store this information in case the government wants to build a case against a customer.

The actual laws requiring this are numerous, and the penalties for not complying are just as steep.

The Bank Secrecy Act, PATRIOT Act, the FDIC’s Customer Identification Program, the Dodd-Frank Act, and the Corporate Transparency Act all forcibly require service providers to collect this information and have it handy to give over to authorities to conduct investigations.

The main purpose of these laws are to prevent crime, terrorism, and bad actors. But we must now ask whether the collection and storage of all this data is itself more dangerous than allowing police to do their jobs without significant data collected by private companies.

These criminally motivated and sophisticated attempts at scooping up terabytes of data containing personal and financial information – whether by criminal actors or foreign militaries – are harmful and will lead to terrible consequences.

But their availability – forced by various federal and state laws – should also inform the debate about whether they are necessary at all, and whether we should have a serious conversation about reforming KYC/AML laws in this country.

In Pursuit Of “Corporate Transparency,” A Mass Doxxing Of LLCs Puts Financial Freedom And Privacy At Risk

Beginning this year, any individual with shares in an American domiciled company will be required to submit identifying information to FinCEN. This record collection from the US Treasury Department’s Financial Crimes Enforcement Network is intended to “curb illicit finance” by requiring a national database of every “beneficial owner” of an LLC.

As stipulated by the Corporate Transparency Actpassed by Congress in 2019 and later snuck into the National Defense Authorization Act in 2020, the US Treasury will gather this information to “prevent wrongdoers from exploiting United States corporations and limited liability companies for criminal gain, to assist law enforcement in detecting, preventing, and punishing terrorism, money laundering, and other misconduct involving United States corporations and limited liability companies“.

Though President Trump vetoed the NDAA in January 2021, the Democratic-led Congress overrode his veto and ushered the CTA into law. It came into force this year.

To the uninitiated, the CTA may not seem like a big deal. Who doesn’t want to reveal all the fat cats “dodging” their taxes from Uncle Sam using tax shelters? Or those taking advantage of US corporate structures to hide money from offshore jurisdictions?

But in the name of rooting out money laundering and proceeds of crime as they make their way through the US economy, every part-owner of a pet salon, car wash, or handyman service will be required to divulge their identity and ownership percentage to FinCEN – the US’ financial intelligence agency established to combat money laundering and terrorist financing. Guilty before proven innocent.

CTA: Hitting The Little Guys

This mass doxxing of LLCs means fewer Americans will be able to safely and privately secure their assets. Those with billions or millions of dollars will have the sanctity of well-funded lawyers and various schemes to protect their wealth. The average person will not.

Single and multi-member LLCs, legal partnerships, sole proprietorships, and trusts have evolved to protect ownership and assets for countless families, individuals, and companies. Many people chose to place ownership of their home, car, or even fishing boats under limited liability companies. It’s not about hiding from the government or tax authorities. Rather, it’s about selectively revealing what can be derived from public information about our assets.

That information will be more readily available to all facets of American governmental power – much beyond the IRS – and that also makes it a substantial central repository for hackers, leakers, and abusive government officials who could weaponize it at any moment. The daily torrent of leaks and hacks with personal and financial information of millions proves this.

The CTA Treats Ordinary People Like Criminals

The “beneficial owners” of any company or LLC are ultimately those who profit from the financial activities of said company. When a corporation owns shares in an LLC, and so on, the identity of the actual individuals may not be publicly known. On the websites of state Secretaries of State and Department of Corporations, the trail for the actual individuals who own a company may prove elusive. 

A dynamic industry of registered agents in select states provide a protective layer of legal structure to families, entrepreneurs, and individuals. To law enforcement and banking authorities, this information is easily attainable. No one can open a bank account anonymously in the US.

If there is legitimate probable cause that a company or entity is linked to crime, law enforcement already has the means and power available to subpoena banks, registered agents, and legal firms. State agencies easily divulge this information when asked. Thus far, this system has balanced Americans’ financial and commercial privacy against legitimate police investigations by requiring lawfully obtained warrants and judicial orders. 

Even though states like Delaware, New Mexico, Nevada, or Wyoming may have privacy-preserving LLC registration processes, the records of the actual beneficial owners can always be obtained by getting court orders to unmask them. Whether it’s the IRS, the FBI, or even a local sheriff’s office, this is how the rule of law works in the US.

But with the Corporate Transparency Act in full force, FinCEN will now require that the all beneficial owners be completely doxxed from the outset. And this is the most troubling aspect. Legal firms that help citizens register companies, banks that serve them accounts, and even state authorities that help with licensing will be required to check whether the beneficial owner information has been reported to FinCEN. 

The unique 50-state corporate registration process that has generated so much wealth and prosperity in the United States is effectively being nationalized and centralized before our very eyes. Like many arduous KYC/AML processes in place at banks and cryptocurrency exchanges, ordinary people are now being treated like criminals in pursuit of the tiny percentage that may be linked to wrongdoing.

How LLCs Protect Our Privacy

Ordinary middle-class Americans have used the privacy-preserving features of LLCs to protect their assets, investments, and property for years. If you wanted a modicum of privacy for your home or investments, whether from stalkers, tabloid press, or spiteful ex-partners, LLCs have always been ideal. These structures have been vital in the privacy community, and for good reason.

LLCs are organized for the purpose of offering goods and services as a business, and also to shield the individuals from liability concerns in case anything goes wrong. It allows people to set up entities in order to participate in commerce, separating it from their personal assets. It’s the bedrock of American innovation, a necessary feature of free enterprise, and a stalwart tradition rooted in the rule of law.

The beneficial owners of these companies have always had to report income to the IRS and reveal their identity in order to apply for bank accounts. But this new reporting mechanism is an additional step that will open up that information for all to view, as well as introduce new opportunities for your rights to be denied or abridged by other government agencies and companies they regulate.

What’s more, as we have seen from too many data breaches and hacks, it means that the financial information of hundreds of millions of Americans will be that much easier to obtain and exploit.

Fairness, Transparency, And Distractions

The CTA was quietly pursued by Congress under the leadership of Speaker of the House Nancy Pelosi. At the time, the rhetoric about fairness in tax and regulatory policy was a major talking point. 

The actions and various media scandals of then President Trump distracted most journalists and analysts from understanding the implications of the CTA and other complex policies that were ushered into omnibus bill packages. The House version of the CTA easily passed in a vote in the fall of 2019, with only a handful of Republicans joining an almost unanimous Democratic caucus.

The Senate version of the bill was introduced by Sen. Ron Wyden, a Democrat of Oregon, normally one of the biggest Democratic champions for privacy, tech innovation, and keeping the government out of citizens’ business. For this bill, though, the party line took precedent.

Despite efforts to neuter the bill by Ohio Congressman Warren Davidson, it was packaged together by Congress and inserted into the main military funding bill, the NDAA, in late 2020, which Trump vetoed. The Democrats’ overriding of the veto, in the final month of Trump’s presidency, cast the CTA into law. Now we’re living with the consequences.

Ironically, while lobbied as an increase in transparency for corporate entities, parts of the Corporate Transparency Act read precisely as if they were ripped from the recommendations of FATF: an unaccountable, opaque intergovernmental organization setup to combat international money laundering.

FATF’s requirement is simple: every known individual with an interest in a business venture should have that information known not only to their state tax and business regulators, but also to the federal government.

Chasing The One Percent: It’s All About The Money

In a recent court filing, House Democrats on the Financial Services Committee articulated their defense of the CTA, claiming that obtaining all beneficial owner information is “crucial to combat money laundering and its attendant national security and law enforcement risks”.

But what if it only comes down to money?

Looking at the recent numbers, the US federal government is $35 trillion in debt. The debt to GDP ratio is 135%, meaning the entire productive output of the economy in a single year (roughly $28 trillion) is dwarfed by our outstanding and ever mounting debt. With total tax revenues hovering near $5 trillion per year, this means the US would need only 7 years to pay off the national debt…if it had no other expenses. But that’s fantasyland.

The last time the US federal budget was “balanced,” meaning the government spent less than it took in, was 23 years ago in 2001. Even then, that was mostly due to accounting trickery by removing unfunded liabilities from the formula. 

The truth remains that the US government is in dire need of funds, despite having the most productive and rich economy in the world. And if it can’t print its way out of oblivion, it has to raise revenues by chasing tax dollars in every nook and cranny. By unmasking beneficial owners of every company, these regulators hope they will unearth mass riches that have been kept from government coffers. But what will they destroy along the way?

Calling Out Attacks On Financial Privacy

Thankfully, a recent court decision is chipping away at the inevitability of the Corporate Transparency Act. On March 1, 2024, a judge in an Alabama District Court declared the CTA unconstitutional, halting the government from collecting information from the specific parties involved in the case National Small Business United v. U.S. Department of the Treasury.

That case is now on appeal in the Eleventh Circuit, which could nullify the bill in its entirety, or overturn the district judge’s decision. How this case proceeds will be vital to protecting financial freedom and privacy not only for Americans, but any global citizen with a stake in the American economy.

In a amicus brief shared with the court, the Cato Institute, a prominent libertarian think tank, demolished the government’s case for enforcing CTA, arguing that the forced doxxing of beneficial ownerships violates the Fifth Amendment.

The vast majority of Americans are law-abiding and follow tax laws. Further reducing the financial privacy of 350 million people to “chase” the 0.5%-1% is a perilous path, and the court should absolutely heed the warnings by Cato and the litigants. What CTA represents, among other proposals, is a slow-roll attack on financial privacy for ordinary people.

The ratcheting-up of KYCing every financial transaction or relationship – bitcoin or fiat – is part of a larger, more sinister trend. We have to be prepared to call it out wherever it originates.

Originally published here

European Threat To End-To-End Encryption Would Invade Phones

European lawmakers have been implementing a way to circumvent end-to-end encryption to address child sexual abuse material (“CSAM”) – what some activists term the “Chat Control” law. End-to-end communication guarantees that if you communicate with someone, only a receiving device will be available, and the sending device can decrypt or see the message in question. This is close to Bitcoin’s principles for spending money and financial flows – allowing you to choose who you reveal your spending to or who not to – with privacy-preserving and self-custody technologies also under attack. Freedom technology like Bitcoin and Nostr (which has recently built a proposal for end-to-end encrypted messages) and open-source tools like Signal focus on giving people digital privacy and autonomy – principles under attack from a recent proposal to scan users’ devices for content before it is encrypted.

Experts in cryptography and other scientists/researchers have released an open letter to discuss this proposal’s technical and policy issues. The urgency of the moment is because the legislation has a realistic chance of passing this time and, to the surprise of all, is being proposed right before the European elections. After several other attempts had been thwarted – as Bart Preneel, one of the originators of the letter explains, the Belgian presidency has advanced a new version of the Chat Control law, tweaked in two places to get more political support – the first tweak is that different services will be categorized into different levels of risk, with only “High Risk” services being scanned. However, the definition of a “High-risk” service is any that offers end-to-end encryption and real-time communications – apps like Signal and WhatsApp, used widely by so many, would fall under that definition. Services that allow for anonymous IDs (the default on the Internet) would also fall under this category.

Read the full text here

New Privacy Rights Act Exempts Government and Gives More Power to the FTC

Data privacy talk in Congress seems kind of ironic coming just a week after lawmakers rejected a proposal to make federal authorities get a warrant to search Americans’ electronic communications. But in keeping with that move, the American Privacy Rights Act—a draft data privacy bill that will be getting a hearing in the House Innovation, Data, and Commerce Subcommittee today—would exempt governments and entities dealing with data on behalf of the government from its protections.

The bill would also give more power to the Federal Trade Commission (FTC), and create an “unprecedented” private right of action to sue companies over data handling, according to Yaël Ossowski.

Ossowski is deputy director of the Consumer Choice Center, which bills itself as “an independent, non-partisan consumer advocacy group championing the benefits of freedom of choice, innovation, and abundance in everyday life.” I talked to him yesterday about the bill’s (few) benefits and its (myriad) drawbacks.

Read the full text here

Consumer Choice Center’s comment on the US government’s proposed KYC regulations for cloud servers

Earlier this year, the US Department of Commerce proposed a sweeping regulatory rule that would force cloud service providers to collect and retain personal information on their users, particularly those based outside the United States.

This regulation, prompted by President Joe Biden’s Executive Orders on the “National Emergency With Respect to Significant Malicious Cyber-Enabled Activities,” would require extensive record keeping and collection of user data for all Infrastructure as a Service (IaaS) providers, firms that offer what is commonly known as virtual machines, web servers, cloud computing and storage, Virtual Private Networks (VPNs), Bitcoin and cryptocurrency nodes, artificial intelligence models, and much more.

The intended targets are services that have customers based abroad, in order to stop malicious foreign actors and hackers, but the rule is written broadly enough that any cloud provider that doesn’t capture this information from its domestic US users would be liable for civil and criminal penalties.

The Consumer Choice Center submitted comments to oppose the Commerce Department’s proposed rule, requesting several changes and modifications to better protect data and consumer privacy.

It is found below:

Overbearing KYC Identity Requirements for Cloud Providers Put Consumers at Risk and Threaten Online Free Speech and Commerce

Dear Under Secretary Alan F. Estevez,

The Consumer Choice Center is an independent, non-partisan consumer advocacy group championing the benefits of freedom of choice, innovation, and abundance in everyday life. 

As an organization representing consumers around the country, we are deeply concerned with the proposed rule to require significant Know Your Customer (KYC) procedures for any and all Infrastructure as a Service (IaaS) providers, as detailed in Docket No. DOC-2021-0007

If these rules as they stand are brought into effect, they will have immediate consequences on consumers and online users who create, use, and deploy all manners of online services, servers, cloud systems, and virtual machines. This includes services that allow users to deploy servers to host their own private document and photo content, Bitcoin and cryptocurrency nodes, artificial intelligence models, Virtual Private Networks (VPNs), and more, in accordance with the terms of service offered by IaaS providers.

While these rules are intended to provide more immediate access to information and data on malicious foreign actors using American cloud infrastructure, they will instead result in significant risk to individual privacy, facilitate the loss or malicious use of data, and grant extraordinary powers to government agencies that are inconsistent with the US Constitution and the Bill of Rights.

We understand the intention is to target foreign hostile actors, but the requirement placed upon US service providers will inevitably require that every American provide this information as well.

The requirement that service providers maintain exhaustive personal and financial information on their customers presents not only a gross violation of privacy, but a significant risk, as the thousands of IaaS providers will be in possession of vast amounts of personal data liable to be hacked or leaked.

What’s more, law enforcement agencies already possess enough tools and authority to follow legal processes to acquire warrants and conduct information.

We believe this proposed rule goes much too far in restricting the ability for Americans to use online services they want to choose, and would limit their ability to use servers and cloud services without significant risk to their privacy and personal data.

In addition, the exhaustive information required by a service that wishes to offer users the ability to run a virtual machine, server, AI model, or more, will necessarily push most Americans to opt out of using domestic services entirely, creating economic consequences not calculated in the proposed rule’s costs of compliance.

We would recommend that this rule be revised entirely, removing the significant privacy risks that KYC collection on IaaS providers would require for domestic users, as well as the duplicative and extralegal authority that would be granted to law enforcement officers, in contravention of constitutional law.

Below, we list the two main areas of concern for US consumers.

KYC Requirements For Foreign Users Applied to Domestic Users

As noted in the Background provided in the Supplementary Information of the rule, these new powers would require service providers to segment users based upon their country of origin:

To address these threats, the President issued E.O. 13984, “Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities,” which provides the Department with authority to require U.S. IaaS providers to verify the identity of foreign users of U.S. IaaS products, to issue standards and procedures that the Department may use to make a finding to exempt IaaS providers from such a requirement, to impose recordkeeping obligations with respect to foreign users of U.S. IaaS products, and to limit certain foreign actors’ access to U.S. IaaS products in appropriate circumstances.

However, in order for IaaS providers to effectively determine the location of a user, they will be required by the force of law – and risk of civil and criminal penalties – to log, categorize, and document a user’s location and accompanying personal information regardless of their location, all in efforts of determining whether a potential user would be considered a “foreign user” or beneficial person.

This will lead to increased collection of information akin to bank accounts and financial transactions, leading to widespread “Know Your Customer” (KYC) requirements which have never been applied at this level to online services.

Beyond congressional approval, we believe this proposed regulation far exceeds the bounds of agency authority, whether from the Department of Commerce or via the mentioned Executive Orders, and would create significant areas of risk for ordinary users and customers location both abroad and within the United States.

In addition, the broad application and definition of a covered service – “any product or service offered to a consumer, including complimentary or “trial” offerings, that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications” – essentially means any cloud service would be within the scope of this regulation.

The Risk of Privacy Breaches

As service providers would be required to maintain a robust Customer Identification Program, as outlined in § 7.302, this would therefore place liability on all cloud providers to collect and retain the full name, address, credit card number, virtual currency numbers, email, telephone numbers, IP addresses, and more on any potential customer of their service.

While we appreciate that private cloud providers and IaaS firms would have the latitude to determine how they structure their Customer Identification Programs, we believe that the requirement to collect this information and store it locally will constitute a high potential for that information to be accessed without authorization, either by hacks, leaks, or other malicious activity. 

Because service providers will be required to catalog this information for years on end, this will inevitably prove to be a high-value target for malicious actors, while providing minimal benefit to the law enforcement agencies that can already legally obtain this information via lawfully executed warrants.

Extraordinary and Duplicative Powers

Law enforcement agencies at the federal, state, and local level already possess the legal tools to subpoena or request data cloud providers or VPN providers with lawfully obtained warrants. 

That IaaS providers would be required to not only retain this information, but also to preemptively “notify” law enforcement without any judicial order or suspicion of a crime, violates the Fourth Amendment and the Due Process Clause as interpreted from the Fifth and Fourteenth Amendments.

Section § 7.306(d) lays out the stipulation for being exempted from the requirements as “voluntary cooperation” with law enforcement agencies, then forcing providers to enable access to “forensic information for investigations of identified malicious cyber-enabled activities”. 

We believe this would be easily abused, as it would provide a legal path for companies to divulge customer information to government authorities beyond what is necessary and lawful, and provide incentives for firms and companies to voluntarily submit information on their customers to government agencies, law enforcement agents, and more.

As written, we believe this proposed rule has been offered in haste, and will likely lead to significant harms and risks to consumers’ data, privacy, and their liberty to engage in free commerce. We would urge this rule to be rewritten with these concerns in mind.

Sincerely yours,

Yaël Ossowski

Deputy Director,

Consumer Choice Center

Experts Agree: ByteDance is Beholden to the CCP and Cannot Be Allowed to Exploit Americans’ Data

H.R. 7521, the Protecting Americans from Foreign Adversary Controlled Applications Act, is bipartisan legislation that will protect Americans by preventing foreign adversaries, such as China, from targeting, surveilling, and manipulating the American people through online applications like TikTok.  

Here’s what experts and top voices are saying about the bill: 

Speaker of the House of Representatives Mike Johnson:

“I support the bill being marked up by the Energy & Commerce committee. It’s an important bipartisan measure to take on China, our largest geopolitical foe, which is actively undermining our economy and security.”

Americans for Prosperity Chief Government Affairs Officer Brent Gardner: 

“The fact is that we live in a world where Americans’ phones are being weaponized against them by a foreign adversary, and we cannot sit back and let that happen. We would never want the U.S. federal government to have the power to censor, surveil, and manipulate Americans—we absolutely should not permit that abuse of power by the Chinese government through TikTok.” 

Deputy Director of the Consumer Choice Center Yaël Ossowski:

“Considering the CCP’s unique hold on TikTok and ByteDance, and the data privacy threats to US consumers, a forced divestiture is a balanced and reasonable solution.” 

Read the full text here

Why does Ted Cruz want to empower Biden’s radical FTC?

Data privacy is an increasing concern for consumers and tech advocates alike. Lawmakers from both the Republican and Democratic parties know this, and it’s why the Informing Consumers about Smart Devices Act, being championed by Sen. Ted Cruz (R-TX), is receiving bipartisan support.

Cruz says this bill would “inform” consumers about smart devices with “spying” capabilities, but it is just another opportunity for politicians to expand their ever-growing paternalistic role in our daily lives.

Sure, users value their privacy, but only to a certain degree. Case in point: the smartphones that roughly 310 million people voluntarily keep on their person 24/7, even while they’re in the bathroom. Does it really matter if a smart refrigerator is equipped with the same technology as the smartphone present in your pocket (especially when the refrigerator has the added bonus of assisting with food management)?

Despite what Cruz may think, consumers aren’t dumb when it comes to smart products. We don’t need a warning label for the presence of audio-video software or internet-enabled capabilities. If a device needs to connect to WiFi or an app to function, clearly it is internet-enabled. If lights, thermostats, or music can be controlled by voice commands, then of course these devices have a listening function.

Many of us have come to accept the trade-off of data collection by companies we trust in order to use certain products, services, or websites. For some time now, internet surfers and online shoppers have become acquainted with pop-ups asking to enable cookies on their browsers. Digital cookies were always there, but what changed was the notification of them due to policy pressures. Have the cookie notifications really changed online activities? I doubt it. Have more pop-ups in the name of transparency improved online experiences? Also doubtful.

Organizations gather data to know their consumer base, not to stalk us and discover our dirty secrets. In fact, I’d appreciate it if my tech-enabled Traeger grill was “spying” on me — that way, I might receive some coupons based on my grilling history or suggestions on how to improve my barbecuing skills.

Firms are well aware that their reputation hinges on the comfort level of consumers when it comes to tech use and data collection: If consumers feel a company is infringing too much upon their privacy, backlash will surely ensue. As such, government deliberation over this matter is simply unnecessary.

If passed, the proposed bill will, at best, require warning labels to be affixed to the packaging of smart products and, at worst, place the Federal Trade Commission in charge of establishing disclosure guidelines and enforcement mechanisms. Any cost a company incurs related to regulatory compliance deemed necessary by the FTC will be felt in the marketplace, and manufacturers will take into account the potential for fines from the FTC when establishing their price points.

The expense of FTC interference will be borne by all taxpayers, and the cost to companies for new packaging and labels will spill over into higher prices for consumers.

It is unclear why members of the Republican Party would want to expand the regulatory mandate of the FTC, given that Chairwoman Lina Khan has proven her position as an anti-business ideologue ever since she was appointed by President Joe Biden. Our independent purchase decisions do not need to create an economic burden for all taxpayers nor serve as a means for furthering the FTC’s inquisition against corporate America.

At the end of the day, it is important to remember that every individual consumer has authority over what tech products are used within his or her home. Rather than increase the power of the regulatory state over our consumption habits, consumers concerned about their appliances having spyware capabilities should simply shop accordingly, and any nefarious activities should be handled by the court system.

The “Internet of Things” is meant to predict wants, persuade actions, and improve consumer experiences. Some in-home smart devices can even be literal lifesavers. Thanks to advancements in wearable tech and telehealth, real-time assessments can be transmitted to healthcare providers to allow for independent living at home. Take WalkWise, a smart mobility aid attachment benefiting those in need of senior care. Devices such as these shouldn’t be bogged down by FTC interference or government oversight.

Products that advance our well-being, and that we buy according to our preferences with our own money, should not be vilified by politicians and used to grow the nanny state. Although Cruz claims this bill to be “common sense legislation,” that assumes you (the consumer) have no common sense of your own.

Originally published here

Technological neutrality is the best mechanism of cyber security and protects consumer data privacy

KUALA LUMPUR, 26 th June 2023 – The Consumer Choice Center (CCC) emphasizes the
importance of governments supporting and maintaining technological neutrality in putting in
place the best mechanisms for cybersecurity systems and consumer data protection.

Representative of the Malaysian Consumer Choice Center, Tarmizi Anuwar said: “Technology
changes very quickly and faster than amendments or changes in laws. In this regard, laws that
are friendly to innovation and technology or so-called neutral technology need to be prepared so
that healthy competition between private companies becomes the best method of determining
the mechanism in data privacy regulations.”

In addition, Tarmizi commented on the recommendation of the Minister of Communications and
Digital that the private sector makes investments related to aspects of cyber security and data
privacy according to the appropriateness of their respective operational levels which is
considered positive. However, it is necessary to remain consistent and not put an excessive
burden on the private sector.

“The recommendation can be considered good because the enforcement of interoperability
standards can be prepared and implemented by the firm that handles the data, and is not
necessarily determined by law. This will also give space to start-up companies to operate at a
cost that matches their capabilities.”

“Basically, every company has its own interest in protecting the cyber security or privacy data of
their consumers. Excessive legal stipulations such as imposing specific software will cause an
increase in business costs and subsequently increase prices for consumers”, he said.

Explaining Malaysia’s efforts to collaborate with Southeast Asian countries in creating a data
sharing protocol to become a regional data processing hub, he said the government must make
the concept of industry-based data portability as the main standard.

“In order to become a regional data processing hub, the government needs to use industry
standards as the main policy and strategy. This standard is a faster and more efficient way and
is able to coordinate the differences in laws in each country to enforce and regulate portability
over the law.” he concluded.

COMMENT ÉCHAPPER À LA CENSURE GOUVERNEMENTALE ?

Un outil se démocratise qui permet d’accéder à plus de contenus… tant que l’Etat ne s’en mêle pas directement. 

De plus en plus de consommateurs utilisent des VPN sur leurs appareils qui accèdent à Internet. Ce qui était autrefois une technique plutôt obscure permettant d’accéder à des sites différents par l’intermédiaire de serveurs virtuels est devenu un outil de plus en plus courant, qui a suscité l’intérêt des utilisateurs d’internet et des autorités de régulation.

Un VPN (Virtual Private Network), en français RPV (réseaux privé virtuel) permet à ses utilisateurs de se connecter à un serveur différent de celui où ils se trouvent actuellement. A travers diverses techniques cryptographiques, le VPN masque l’adresse IP de l’utilisateur et lui donne accès à d’autres contenus.

Déménager sans bouger

Il existe différentes utilisations d’un VPN : l’une d’entre elles, très courante, est l’accès à des contenus vidéo en streaming. En effet, alors qu’une nouvelle émission de télévision populaire peut être disponible aux Etats-Unis, il n’est pas possible de la regarder depuis la France. En connectant votre VPN à un serveur situé à New York, vous aurez accès au contenu qui peut être vu de l’autre côté de l’Atlantique, depuis le confort de votre propre maison.

Les fournisseurs de services de streaming tels que Netflix ou Amazon Prime n’aiment pas cette pratique, car ils craignent d’avoir des problèmes avec la réglementation sur les droits d’auteur. La raison pour laquelle certains contenus télévisés ne sont pas distribués en France est que ces chaînes n’ont pas acquis les droits pour ces émissions dans l’Hexagone – parfois en raison du prix, parfois parce qu’elles ne pensent pas qu’une certaine émission suscitera beaucoup d’intérêt en France, par rapport aux Etats-Unis.

Cela dit, l’utilisation des VPN dépasse de loin les avantages qu’il y a à regarder Game of Thrones sur son canapé. En masquant votre adresse IP, ils réduisent considérablement les risques de piratage ou de surveillance lorsque vous vous connectez à un réseau Wi-Fi public. Au fur et à mesure que les VPN sont devenus plus populaires, les fournisseurs de services VPN ont trouvé d’autres moyens de protéger vos données lorsque vous êtes en public.

Certains services VPN proposent également une fonction appelée « Internet Kill Switch ». Dans le cas où votre connexion VPN est interrompue ou déconnectée, cette fonction protège votre appareil et ses données des regards indiscrets. Elle bloque tout le trafic Internet vers votre appareil jusqu’à ce que la connexion avec votre VPN soit rétablie.

Quand l’Etat adopte les VPN

Les VPN sont également un bon moyen d’échapper à la censure gouvernementale. Bien que cela soit moins problématique dans de nombreux pays européens, les VPN sont couramment utilisés par les consommateurs en Autriche pour contourner les réglementations gouvernementales. Pendant longtemps, Wikipédia n’a pas été accessible en Turquie sans l’utilisation d’un VPN. Les VPN sont également très utilisés dans les dictatures, car les utilisateurs accèdent à des services d’information internationaux qui seraient bloqués dans leur pays.

Toutefois, bon nombre de ces Etats se sont ralliés à cette tendance. Il est légal d’utiliser un VPN en Chine, mais le gouvernement impose de nombreuses restrictions. Les VPN nationaux doivent être approuvés par le gouvernement et ceux qui ne le sont pas sont interdits. Les citoyens peuvent faire l’objet de sanctions, contrairement aux étrangers, qui peuvent rester impunis s’ils sont pris en train d’utiliser des VPN non autorisés. Evidemment, vous pouvez vous imaginer que les VPN locaux chinois sont contraints de ne pas débloquer du contenu interdit par le parti communiste.

En Europe, l’utilisation des VPN n’est pas limitée. Cela dit, le monde occidental a connu des textes législatifs susceptibles d’enfreindre l’utilisation des VPN.

Par exemple, un projet de loi récemment proposé aux Etats-Unis dont le but principal est d’interdire l’utilisation de TikTok fait vaguement référence à la possibilité pour les utilisateurs de contourner cette interdiction. Bien que la loi ne mentionne pas les VPN en tant que tels, Reason Magazine explique que « cette formulation laisse encore plus de place à la loi RESTRICT pour toucher un large éventail d’activités. Peut-être qu’un tribunal finirait par la juger inutilisable contre des personnes essayant simplement d’échapper à une interdiction de TikTok, mais cela ne signifie pas que les procureurs n’essaieraient pas, ni que les autorités n’utiliseraient pas des mesures de surveillance invasives pour essayer de détecter une telle évasion. »

Des services inégaux

Il y a un dernier point dont les consommateurs doivent être conscients. Si les VPN garantissent une plus grande sécurité en ligne, ils sont loin d’être une panacée. De nombreux VPN populaires vous promettent que vous pourrez « surfer sur le web de manière anonyme » ou que vous serez « complètement à l’abri de la surveillance gouvernementale ». Malheureusement, le simple fait de payer pour un VPN ne vous mettra pas totalement à l’abri de la surveillance et des menaces de piratage.

L’anonymat complet en ligne est très difficile à atteindre, car il nécessite une vaste gamme d’appareils et de logiciels de brûlage qui vont bien au-delà de votre utilisation quotidienne.

Lors de la mise en place d’un VPN, il est important de s’informer sur le produit que vous achetez. Il est également conseillé de s’abstenir d’utiliser des VPN « gratuits ». Si le VPN est gratuit, vos données sont le produit. L’utilisation d’un VPN devrait devenir un comportement banal en ligne, mais elle continuera à exiger que vous fassiez vos propres recherches.

Originally published here

Generational Endgame: The government needs to avoid repeated MySejahtera data leaks

KUALA LUMPUR, 6th March 2023 – The Consumer Choice Center (CCC) voiced concerns
over the implementation of the generational endgame and urged the government to drop the
generational endgame from the Tobacco and Smoking Products Control Bill.

According to Tarmizi Anuwar, the Malaysian Consumer Choice Center representative, he
believes that the Minister of Health is hasty in wanting to implement generation endgame
and is not consistent with the statement at the beginning that wants to implement it
incrementally and in stages.

It is even more worrying when the Ministry of Health wants to implement it in the next year,
which is 2024. However, until today it is still not clear what mechanism will be used to
ensure that the implementation process is not misused or pose other risks to consumers.
Recently, the Deputy Health Minister, Lukanisman mentioned that the government intends to
make the MySejahtera application as a national public health management tool or digital
public health super apps.

“If the government uses the MySejahtera application or any similar form of application to
implement the generational endgame, this may bring other risks to consumers such as
breach of information or personal data.”

“This is clear in the Auditor General’s Report 2021 Series 2 has revealed that 3 million
Malaysians’ personal data in the MySejahtera application was downloaded by the super-
admin account between 28 October to 31 October 2021,” he said.
In addition, according to Tarmizi, it is more worrying when the Deputy Health Minister’s
answer in parliament contradicts to the response given by the Ministry of Health to the
National Audit Department.

“The statement of consumer details downloaded by the super admin as part of security
measures against attempts to hack the application is contrary to the response given by the
Ministry of Health to the Auditor General’s Department.”

“In the report, the Ministry of Health’s response clearly states that there is an element of
misuse by the super admin account and a police report has been made.”
“The government needs to be more realistic in drafting and implementing laws so as not to
put consumers’ personal data at risk.”

Commenting further on the implementation of the finishing generation in the Tobacco and
Smoking Products Control Bill, he said, “The government needs to drop the generational
endgame and adopt more practical practices; harm reductions such as the United Kingdom
or the Philippines.

“Instead of a full ban these two countries recognize harm reduction as one of the methods
to reduce smoking in their countries.”

In addition, Tarmizi emphasized that the discussion about fundamental rights or individual
freedom in this matter must take into account various opinions and not just one school of
thoughts. He referred to the statement of Tun Zaki, Former Chief Justice, regarding the
generational endgame can be considered to be discriminatory and violate Article 8 of the
Federal Constitution.

“The law must operate equally on all people in fair conditions for all generations and every
group of society. The law cannot give only one advantage to one generation and deprive it
from another.”

en_USEN

Follow us

WASHINGTON

712 H St NE PMB 94982
Washington, DC 20002

BRUSSELS

Rond Point Schuman 6, Box 5 Brussels, 1040, Belgium

LONDON

Golden Cross House, 8 Duncannon Street
London, WC2N 4JF, UK

KUALA LUMPUR

Block D, Platinum Sentral, Jalan Stesen Sentral 2, Level 3 - 5 Kuala Lumpur, 50470, Malaysia

OTTAWA

718-170 Laurier Ave W Ottawa, ON K1P 5V5

© COPYRIGHT 2025, CONSUMER CHOICE CENTER

Also from the Consumer Choice Center: ConsumerChamps.EU | FreeTrade4us.org