Nordstrom’s Pilot: Using Store Sensors To Follow Shoppers Via Smartphones

May 20, 2013 //
0

So here’s some news that might make you feel creepy if you shop in a Nordstrom store.  Back in October, Nordstrom’s launched a 17 store pilot that enables it to follow shoppers around the store.  I just learned about this pilot in stories reported by Erik Sherman on CBS MoneyWatch (www.cbsnews.com, “Retailers want to track your every move”, May 9th) and Angela Martin on CBS’ Dallas-Forth Worth affiliate (www.dfw.cbslocal.com, “Nordstrom Using Smart Phones to Track Customers Movements”).

Mr. Sherman cites Storefrontbacktalk.com, a retail trade website, for some of his information.  Both Mr. Sherman and Ms. Martin outlined what the Nordstrom pilot is doing.  Using technology from Euclid Elements, Nordstrom has installed sensors in the pilot stores.  The sensors look for shoppers whose smartphones have Wi-Fi turned on.

With the Wi-Fi on, the sensors are able to provide data reflecting how much time a shopper spends in a particular department. The sensors can’t identify the aisle in which the shopper is located or any personal information tied to the smartphone owner.  However, the technology does use the smartphone’s unique identifier which might make some Nordstrom customers uncomfortable — especially as customers don’t know this is happening.

When asked about the pilot, a Nordstrom spokesperson said the technology’s being tested in the pilot stores to help improve its customer service; and so that store executives can learn which departments  receive the most traffic.  Of course, this type of customer information, even if anonymous, is very valuable to store executives.

The 17 pilot stores weren’t identified so I can’t help there.  But here’s what I can help you with — turn off the Wi-Fi on your smartphone if you don’t want to become even anonymous data to Nordstrom about your shopping habits.

Tags , , , , , ,
Categories Uncategorized

Rep. Johnson’s Pro-Privacy Mobile Apps Bill

May 15, 2013 //
0

The recent hacking of Twitter accounts has heightened the concern many people feel about the privacy and security of mobile applications. Those concerns might have been part of the motivation for the bill introduced May 9th by Representative Hank Johnson (D-GA).  The bill, H.R. 1913, is called the “Application Privacy, Protection and Security (APPS) Act 2013.” (see Zack Whittaker’s article, “New House privacy bill will require apps to gain consent before sharing personal data”; http://www.zdnet.com).

The Congressman’s bill, if enacted, would require that application developers comply with the following:

  1. Gain explicit consent from consumers before the application is used;
  2. Gain explicit consent from consumers before gathering personal from them;
  3. Maintain the personal data that is collected in accordance with mandatory privacy policies;
  4. Display their privacy policies; and
  5. Have privacy policies that explain the following:
  • how personal data would or could be shared with, for example, third parties for advertising or marketing purposes;
  • how long the personal data will be retained; and
  • how consumers can either opt out of data collection and/or ask that their data be deleted if they stop using the application.

H.R. 1913 embodies many core privacy principles.  It’s impossible to predict any bill’s chances on the very long road to being enacted into law.  Regardless of whether it gets enacted, H.R. 1913 is very helpful in focusing greater attention on privacy and security issues associated with mobile applications.

Tags , , , , , , , , , , ,
Categories Uncategorized

Top 2 Tips To Combat Mobile Phone Bill “Cramming”

May 13, 2013 //
0

As I mentioned in my May 10th blog, I was able to attend the first panel at the Federal Trade Commission’s (FTC) May 8th “Mobile Cramming” Roundtable.  The panel’s 6 experts addressed the topic of “Understanding Third-Party Billing and Mobile Cramming”.

The experts were: Mike Altschul from the CTIA- The Wireless Association; John Breyault from the National Consumers League; Larry Bryenton, from the Canadian Competition Bureau; Jim Greenwell, from BilltoMobile; Jim Manis, from the Mobile Giving Foundation; and Kate Whelley McCabe, from the Office of the Vermont Attorney General. They represented differing perspectives on this issue which helped provide a more complete and nuanced understanding of the scope and complexity of mobile phone bill cramming.

The FTC found a critical consumer issue in the Wise Media case that it’s filed — and it’s an issue on which the panel agreed.  Many consumers don’t expect their mobile phone bills to have charges from 3rd parties. Often the charges appear in a format that’s abbreviated, unclear or doesn’t clearly identify the company from which the charges are coming.

So what can consumers do?  Here are the top 2 tips from the panel:

  1. Read your mobile phone bill carefully.  Yes that sounds obvious but the panelists said, based on their respective experiences, that consumers either skip over the details of the bill or assume that the charges are legitimate.
  2. Contact your mobile phone carrier to ask about charges that look unfamiliar and/or to contest unauthorized charges.

The 2nd point is key since the panelists said consumers often contact the FTC or the Federal Communications Commission (FCC), as they think one or both of those Federal agencies can investigate and correct the charges.  Consumers can and should report mobile phone scams to these agencies but their mobile phone carriers are the place to start to seek reimbursement of the unauthorized charges.

Tags , , , , ,
Categories Uncategorized

Old Scam/New Media: Mobile Phone Bill “Cramming”

May 10, 2013 //
0

The adage “what’s old is new again” certainly applies to scams.  The scam I’m writing about today is “cramming” unauthorized charges on phone bills.  The scam previously targeted landline phone bills.  Now that many consumers have moved to mobile phones, the scammers are moving their “cramming” schemes to this new technology via unauthorized charges for premium text messages.

How does this scam translate to mobile phones?  A consumer might, for example get a text message offering a subscription to get horoscopes or quizzes on his mobile phone.  The way the text message is written — purposively so — makes it sound as if the service is free.  What happens next is the complete opposite of free.  The consumer starts getting unauthorized, repeating charges on his mobile phone bill.  Alternatively, the consumer hasn’t responded “yes” to a text message offering a service but with the same result to his mobile phone bill.

The Federal Trade Commission (FTC) successfully brought “cramming” cases against landline scammers.  Now the FTC is moving against mobile phone bill scammers and 3 weeks ago filed its first mobile phone bill “cramming” case.  The case was filed against Wise Media, LLC, Brian M. Buckley, Winston J. Deloney and Concrete Marketing Research, LLC (the latter is alleged to have gotten ill-gotten money from the Wise Media operation).

The FTC alleges that Wise Media, Buckley and Deloney billed consumers for “premium services” that sent them text messages with horoscopes, flirting, love tips and other similar information.  In the complaint, the FTC alleges that consumers were signed up for these services seemingly randomly and were repeatedly billed $9.99 a month on their mobile phone bills without the consumers’ knowledge or consent.

The FTC complaint also states that some consumers got text messages from Wise Media indicating that the consumer had subscribed to one of the services.  That email was ignored by many consumers who thought it was spam.  But the FTC’s complaint notes that even those consumers who sent back a text message refusing the service were still charged for the service on a repeating basis on their mobile phone bills.

The FTC has asked a court for a permanent injunction to shut down Wise Media and force the defendants to return all of the money they got from their alleged “cramming” scam.  If successful, the FTC would use the funds to reimburse the scam victims.

The FTC held a May 8th “Mobile Cramming” Roundtable May 8th.  I was able to attend for the first panel where experts discussed the topic “Understanding Third-Party Billing and Mobile Cramming”.   On Monday, May 13th I’ll write about the information and insights from that panel — including their top tips for fighting back against mobile phone “cramming.”

Tags , , , , ,
Categories Uncategorized

Five Steps to Picking Your Trusted Facebook Friends

May 6, 2013 //
0

There are few things more aggravating than losing access to an online account that you use frequently.  That loss becomes especially scary when you think you’ve lost control because of a potential hacking incident.  While some applications are moving to 2 factor authentication, Facebook just announced on May 2nd their new security tool for helping Facebook users regain control over a “lost” Facebook account.

The new feature is called “Trusted Contacts” and I just read 2 excellent articles about it.  Paul Ducklin’s article contains both useful information as well as graphics (www.nakedsecurity.sophos.com; “Facebook introduces Trusted Contacts, makes you ask, “How much do I trust my friends?”); and Jared Newman’s article has additional information as well as some cautionary notes (www.csoonline.com; “Facebook Trusted Contacts lets friends bail you out of a hack attack”).

I’ve summarized from those articles the 5 steps that you’ll need to do to start using “Trusted Contacts”:

  1. Login into Facebook and go to the “Gear Wheel” drop down menu;
  2. Choose Account Settings;
  3. Go to “Security” tab and click on “Trusted Contacts”;
  4. Choose the 3 to 5 Facebook friends whom you want to choose as your “Trusted Contacts”; and
  5. Give each “trusted contact” a code.

How do you then use “Trusted Contacts”?  If you lose control of your Facebook account, you’ll have to enter all of the codes simultaneously to complete the recovery process and regain access to your account.

“Trusted Contacts” is different than the more frequently used processes for regaining account access.  In those instances, users usually have to remember the security Q’s and A’s for the account or, sometimes, have to send in a scanned copy of our driver’s license.

Facebook users should learn more about “Trusted Contacts” to decide if it’s a security tool they want to use.

Tags , , , , , , ,
Categories Uncategorized

TSA Taking Public Comments About Full-Body Scanners

May 1, 2013 //
1

This is a “heads up” in case you’re interested in sharing your thoughts with TSA about the full-body scanners used for screening passengers at airports.  We all want to be safe and secure so that’s the proverbial “no brainer”.  But you might have questions or concerns that you’ve wanted to share but haven’t known how to do so.  Now you have that chance thanks to a lawsuit that was filed in the U.S. Court of Appeals for the District of Columbia Circuit (Court).

The Court ruled that TSA should have held a “notice and comment” period prior to starting to use the full-body scanners.  The Court hasn’t stopped TSA from continuing to use these scanners but has ordered them to take comments for 90 days.  The comment period began in March and ends June 24th.

So now’s your chance to share your thoughts with the TSA about the full-body scanners.  Comments are being taken online and you can do so at the following federal government website: http://www.regulations.gov.  At that site, you’ll then type in the case code: TSA-2013-0004.

The Court-ordered comment period has been written about in many publications. Here are just 2 recent articles but there are many others: T.C. Sottek’s, “Now is your chance to tell the TSA what you think of ‘nude’ full-body scanners”(www.theverge.com);and Hugo Martin’s “Public gets chance to comment on TSA’s full-body scanners” (www.latimes.com).

A final caveat: no matter how many comments it gets, TSA doesn’t have to stop using the full-body scanners.  But it will be better informed about concerns thanks to hearing from the public.

Tags , , , , , , ,
Categories Uncategorized

Twitter Testing Tighter Two-Step Authenticatioin

April 29, 2013 //
0

There were numerous reports last week about high-profile Twitter accounts being hacked (e.g., 60 Minutes, the BBC and the Associated Press).  While those are the ones being reported, any Twitter user has to be concerned about whether his or her account can, or will, be hacked.

As Matt Honan reports (www.wired.com, “Twitter Now Has a Two-Step Solution”; April 24), Twitter is appropriately concerned about these hacks and is doing something about it.  In his article, Mr. Honan reports that Twitter is now doing internal testing of a new two-step authentication process.

So what is this new approach?  The solution being tested goes by various terms — two-factor authentication or two-step authentication or multi-factor authentication.  In the security and privacy worlds these all constitute the same approach — and is an authentication approach that is stronger protection than just using only a password.

Here’s what a user will need under a two-factor authentication approach:

  1. Factor One: Something he or she knows (a password); and
  2. Factor Two: Plus something he or she has (a previously registered device).

As Mr. Honan wrote, Twitter users logging in from a new location will enter a password and a randomly generated code sent either to their device (either a text message or to a smartphone application).

When will Twitter roll out the new authentication?  It’s not certain but Mr. Honan aptly notes that Twitter will want to do this in the very near future.

There are no fool proof solutions against hacking.  However, a two-factor process is definitely better for protecting accounts than simply using a password.

Categories Uncategorized

“Siri:Tell Me How Long You’re Storing My Data?”

April 24, 2013 //
0

Many of us use Siri — with greater or lesser degrees of success, frustration or both.  But here’s one question that Siri will definitely not answer for you — just how long our various calls to her are being kept.

Now — thanks to Robert McMillan at Wired — we can know and, for me,  it falls into the “creepy” category.  Mr. McMillan and Wired were successful in getting a direct answer from Apple (www.wired.com, “Apple Finally Reveals How Long Siri Keeps Your Data”; April 19, 2013). The privacy policy for Siri is rather opaque on explaining how long personal data is retained so Mr. McMillan and Wired have done Siri users a great service.

In his article, Mr. McMillan provides the following information that Trudy Muller, an Apple spokeswoman, gave him:

  • Siri keeps users data for up to 2 years;
  • The data is turned into 2 different types of randomly generated numerical identifiers — one for the user and another for the voice files associated with that user; and
  • The data is anonymized and the voice clips are collected in order to improve Siri service.

Ms. Muller told Mr. McMillan that if Siri is turned off, then both of the numerical identifiers will be deleted immediately.

I’ll speak from personal experience.  If Apple’s retaining and using voice clips for improved Siri service, then that’s not happening. Anyone at Apple listening to my supposedly anonymized voice clips will hear me telling Siri to “forget it” since she’s either garbled my request or given me completely incorrect information.

More importantly, Siri users need to know that their requests are being retained and used by Apple. Siri will have heard me, for example, asking for an array of information (e.g., people’s phone numbers; directions to places) that are certainly personal and sometimes private in nature.

So here’s a caution if you use Siri.  She might not be giving you the information you need, but she will be keeping your requests.  Be careful about the personal and private information included in your requests to Siri.

Tags , , , , , ,
Categories Uncategorized

Protecting Children’s Privacy: SSA’s Positive Policy Proposal

April 22, 2013 //
0

There are still too many stories and cases about people stealing and misusing SSNs.  While those instances are always terrible, there are even worse consequences when it’s the SSN of a young child or teenager.  In those instances, the young child or teenager might not know for years that his identity has been stolen using this very powerful source of personal identity.

The good news is that there could be some additional relief soon specifically involving those cases where the SSN is of a child 13 years and younger.  The Social Security Administration (SSA) issued a request in February for comments on a proposed policy change to assign new SSNs specifically for children age 13 and younger (February 11, 2012, Fed. Reg., Docket No. SSA 2012-0042; “Assigning New Social Security Numbers (SSN) for Children Age 13 and Under”).

Under the proposal, SSA would assign new SSNs to children in that age category under any one of the following 3 situations:

  1. The child’s Social Security card has been stolen in transit;
  2. The child’s SSN has been incorrectly disclosed via the SSA’s publicly available “Death Master File”; and
  3. The child’s SSN has been misused by a 3rd party.

In its request for comments, SSA asked if the age cut-off is appropriate; if the 3 scenarios are appropriate; and if there are other scenarios or circumstances that would warrant assigning a new SSN to a child 13 years and younger.

Staff from the Federal Trade Commission (FTC) submitted comments on April 12th supporting the SSA’s policy proposal.  They recommended that the age group be expanded to children 17 years old and younger.  Their recommendation is based on the fact that many younger children (e.g., 13 and younger) might not know for several years that they’ve been identity theft victims. They might not learn about their victimization until they are first applying for credit or a loan or for some other transaction for which their credit status and/or SSN is needed (see, http://www.ftc.gov; “FTC Staff Comment Supports Proposed Social Security Administration Policy Change to Help Protect Children from Identity Theft”).

The FTC staff made other recommendations that would also help enhance what is already a very sound and, sadly, much needed policy proposal.  The SSA is taking a needed step to help protect children who are, or have been, victims of identity theft.

Tags , , , , ,
Categories Uncategorized

State Attorneys General and Facebook: Privacy Partnership Campaign

April 19, 2013 //
0

Facebook and the National Association of Attorneys General (NAAG) announced this week a joint privacy public awareness campaign that will include public service announcements (PSAs) and other informational resources.  The campaign is aimed at young people and teenagers using Facebook; it’s an effort to educate them more about steps they can, and should, take to stay safe on Facebook.

Zach Miners outlined several of the key components in a recent article (www.csoonline.com; “Facebook affirms its privacy commitment with national campaign”; April 15, 2013). Mr. Miners wrote that there are currently 19 Attorneys General who have signed onto this joint privacy safety program.

The privacy safety program will include the following resources:

  •  ”Ask the Safety Team” videos that provides answers to some of the most frequently asked questions the Facebook site’s received over the past few years;
  • A tip sheet outlining the top 10 tools for controlling information on the Facebook site; and
  • State-specific PSAs that will be done by the State’s respective Attorney General and Facebook Chief Operating Officer Sheryl Sandberg.

All of these resources will be found on Facebook’s Safety page; the PSAs are in the process of being finished so should be posted on the Facebook site within the next few days.  I went to Facebook’s Safety page yesterday and the PSAs were not yet posted. The Safety page does list answers to important questions under the categories of “Reporting on Facebook” and “Controlling my information on Facebook”.

The questions and answers listed on the Facebook Safety page are an important resource for everyone who uses Facebook and wants to have more control over the information posted on their Facebook page.  You can learn, for example, how to report possible misuses (e.g., hacking a personal Facebook account; instances of possible bullying) and how to better control personal information on Facebook (e.g., how to manage privacy settings to keep one’s family safe online).

The current and upcoming privacy safety resources are, and will be, helpful for anyone using Facebook.  They are particularly important resources for young and teenagers users of Facebook.  Take the time to read the Facebook Safety page and review it with any young and teenage Facebook users you know.

Tags , , , , , , , , ,
Categories Uncategorized
« Older Entries
Follow

Get every new post delivered to your Inbox.

Join 50 other followers