Irreal

The EFF has published its annual Who Has Your Back? report. The idea is that they look at those technology companies that deal with our private data and rate them on the following criteria

1. Follows industry-accepted best practices
2. Tells users about government data demands
3. Discloses policies on data retention
4. Discloses government content removal requests
5. Pro-user public policy: opposes backdoors

For better or worse all but the most paranoid of us use several of these companies (7 in my case) so it’s worth knowing which ones are looking out for their users and which are selling our data or rolling over for the government.

If you’re looking for the TL;DR, the chart at the beginning of the report will tell you who the good guys are and how the others are failing. If you’re looking for a deeper dive, each company’s performance is discussed in detail later in the report. There are also links to the policies and transparency reports for each of the companies.

Most people probably aren’t going to stop using a company that doesn’t rate a perfect score but it’s useful to know who’s doing what and to adjust your behavior accordingly. It’s an interesting report and everyone should at least look at the chart. Unless, that is, you’re one of the paranoid that stays off the grid. Of course, in that case you probably aren’t reading this.

LWN.net is reporting on a Debian bug report complaining that Chromium, Google’s open source version of their Chrome Browser, was downloading a binary blob after it started. The responsible Debian maintainers did not have access to the code for the blob and had no way of knowing what it did. After a bit of investigation, it appears that the blob—called Chrome Hotword—turns on the computer’s microphone and enables audio capture.

Doubtless, this is to support Google’s OK Google feature that enables audio searching but its stealth installation and the initial absence of a way of disabling it raised serious questions. Even now, the function is enabled by default and the user has to find the—reportedly obscure—control for opting out of the system.

Google says that while the blob is installed and the microphone is turned on, no audio data is transmitted to Google unless the “OK Google” feature in explicitly turned on in the browser. That’s almost surely true too but consider: Google gets a secret warrant from some 3-letter agency and suddenly the government is listening to everything you say. Pre-Snowden that might have been considered paranoid but now we know better.

Falkvinge has a more muscular objection over at Private Internet Access. He explicitly makes the same point: after Snowden, we should trust no one with the ability to listen in on our conversations. Even if the organization providing the capability is completely trustworthy, there is no reason to believe that it won’t be coerced into spying for the government. Nor is there any guarantee that the capability won’t be exploited by criminal elements.

You’d think Google would understand all this and realize that audio searches just aren’t worth the danger to privacy that comes with them. Apparently not.