google

Hundreds of French academics sign letter asking for safeguards on contact tracing

A group of 471 French cryptography and security researchers has signed a letter to raise awareness about the potential risks of a contact-tracing app. A debate in the French parliament will take place tomorrow to talk about all things related to post-lockdown — including contact-tracing app StopCovid.

Among the group of researchers, 77 of them are affiliated with Inria, the French research institute that has been working on the contact-tracing protocol that will power the government-backed contact-tracing app, ROBERT. With this letter, it appears that Inria is conflicted about ROBERT.

“All those applications induce very important risks when it comes to protecting privacy and individual rights,” the letter says. “This mass surveillance could be done by collecting the interaction graph of individuals — the social graph. It could happen at the operating system level on the phones. Not only operating system makers could reconstruct the social graph, but the state could as well, more or less easily depending on the approaches.”

The letter also mentions a thorough analysis of centralized and decentralized implementations of contact-tracing protocols. It includes multiple attack scenarios and undermines both the DP-3T protocol as well as ROBERT.

Ahead of the debate in the French parliament tomorrow, researchers say that “it is essential to thoroughly analyze the health benefits of a digital solution with specialists — there should be important evidence in order to justify the risks incurred.”

Researchers also ask for more transparency at all levels — every technical choice should be documented and justified. Data collection should be minimized and people should understand the risks and remain free not to use the contact-tracing app.

Over the past few weeks, multiple groups of researchers in Europe have been working on different protocols. In particular, DP-3T has been working a decentralized protocol that leverages smartphones to compute social interactions. Ephemeral IDs are stored on your device and you can accept to share ephemeral IDs with a relay server to send them to the community of app users.

PEPP-PT has been backing a centralized protocol that uses pseudonymization to match contacts on a central server. A national authority manages the central server, which could lead to state surveillance if the protocol isn’t implemented properly. ROBERT is a variant of PEPP-PT designed by French and German researchers.

While the French government has always been cautious about the upsides of a contact-tracing app, there’s been little debate about the implementation. Inria, with official backing from the French government, and Fraunhofer released specifications for the ROBERT protocol last week.

Many (including me) have called out various design choices, as you have to trust your government that they’re not doing anything nefarious without telling you — a centralized approach requires a lot of faith from the end users as the government holds a lot of data about your social interactions and your health. Sure, it’s pseudonymized, but it’s not anonymized, despite what the ROBERT specification document says.

Moreover, ROBERT doesn’t leverage Apple and Google’s contact-tracing API that is in the works. France’s digital minister, Cédric O, has been trying to put some pressure on Apple over Bluetooth restrictions with a Bloomberg interview. Given that Apple and Google provide an API for decentralized implementations, they have little incentive to bow to French pressure.

On Sunday, Germany announced that it would abandon its original plans for a centralized architecture in favor of a decentralized approach, leaving France and the U.K. as the two remaining backers of a centralized approach.

France’s data protection watchdog CNIL released a cautious analysis of ROBERT, saying that the protocol could be compliant with GDPR. But it says it will need further details on the implementation of the protocol to give a definitive take on StopCovid.

The European Data Protection Supervisor (EDPS) also said on Twitter that the debate in front of the French parliament is particularly important. “Decisions will have an impact not only on the immediate future but as well on years to come,” they say.

France’s Inria and Germany’s Fraunhofer detail their ROBERT contact-tracing protocol

04.22.20 telecommunications

EU privacy body urges anonymization of location data for COVID-19 tracking

The European Data Protection Board (EDPB) has published guidance for the use of location data and contacts tracing tools intended to mitigate the impact of the COVID-19 pandemic.

Europe’s data protection framework wraps around all such digital interventions, meaning there are legal requirements for EU countries and authorities developing tracing tools or soliciting data for a coronavirus related purpose.

“These guidelines clarify the conditions and principles for the proportionate use of location data and contact tracing tools, for two specific purposes: using location data to support the response to the pandemic by modelling the spread of the virus so as to assess the overall effectiveness of confinement measures; [and] contact tracing, which aims to notify individuals of the fact that they have been in close proximity of someone who is eventually confirmed to be a carrier of the virus, in order to break the contamination chains as early as possible,” the EDPB writes in the document.

The European Commission and the EU parliament have already weighed in with their own recommendations in this area, including a toolbox to help guide contacts tracing app developers. The Commission has also urged Member States to take a common approach to building such apps, and has been leaning on local telcos to provide “anonymized and aggregated” metadata for modelling the spread of the virus across the EU.

The guideline document from the EDPB — a body made up of representatives from the EU’s national data protection agencies which helps coordinate the application of pan-EU data protection law — brings additional expert steerage for those developing digital interventions as part of a public health response to the coronavirus pandemic.

“The EDPB generally considers that data and technology used to help fight COVID-19 should be used to empower, rather than to control, stigmatise, or repress individuals,” it writes. “Furthermore, while data and technology can be important tools, they have intrinsic limitations and can merely leverage the effectiveness of other public health measures. The general principles of effectiveness, necessity, and proportionality must guide any measure adopted by Member States or EU institutions that involve processing of personal data to fight COVID-19.”

Among the body’s specific recommendations are that where location data is being considered for modelling the spread of the coronavirus or assessing the effectiveness of national lockdown measures then anonymizing the data is preferable — with the EDPB emphasizing that proper anonymization is not easy.

Given the inherent complexity it also recommends transparency around the anonymization methodology used. (tl;dr: there’s no security in obscurity, nor indeed accountability.)

“Many options for effective anonymisation exist, but with a caveat. Data cannot be anonymised on their own, meaning that only datasets as a whole may or may not be made anonymous,” it notes.

“A single data pattern tracing the location of an individual over a significant period of time cannot be fully anonymised. This assessment may still hold true if the precision of the recorded geographical coordinates is not sufficiently lowered, or if details of the track are removed and even if only the location of places where the data subject stays for substantial amounts of time are retained. This also holds for location data that is poorly aggregated.

“To achieve anonymisation, location data must be carefully processed in order to meet the reasonability test. In this sense, such a processing includes considering location datasets as a whole, as well as processing data from a reasonably large set of individuals using available robust anonymisation techniques, provided that they are adequately and effectively implemented.”

On contact tracing apps — aka digital tools that are designed to map proximity between individuals, as a proxy for infection risk — the EDPB urges that use of such apps be voluntary.

“The systematic and large scale monitoring of location and/or contacts between natural persons is a grave intrusion into their privacy,” it warns. “It can only be legitimised by relying on a voluntary adoption by the users for each of the respective purposes. This would imply, in particular, that individuals who decide not to or cannot use such applications should not suffer from any disadvantage at all.”

The importance of accountability is also front and center, with the EDPB saying the controller of such apps must be clearly defined.

“The EDPB considers that the national health authorities could be the controllers for such application; other controllers may also be envisaged. In any cases, if the deployment of contact tracing apps involves different actors their roles and responsibilities must be clearly established from the outset and be explained to the users.”

Purpose limitation is another highlighted component. Apps need to have purposes that are “specific enough to exclude further processing for purposes unrelated to the management of the COVID- 19 health crisis (e.g., commercial or law enforcement purposes)”, it says.

So, in other words, no function creep — and no EU citizen mass surveillance via a pandemic backdoor.

The EDPB also writes that “careful consideration should be given to the principle of data minimisation and data protection by design and by default” — noting specifically that contact tracing apps “do not require tracking the location of individual users”.

Instead “proximity data should be used” for the contacts tracing purpose.

“Contact tracing applications can function without direct identification of individuals,” it further emphasizes, adding that “appropriate measures should be put in place to prevent re-identification”.

The guidance aligns with the coronavirus contacts tracing model devised jointly by Apple and Google — which have said they will be offering a cross-platform API for COVID-19 contacts tracing based on ephemeral proximity IDs shared via Bluetooth.

At one point the EDPB guidance appears to be leaning towards favoring such decentralized approaches to contacts tracing apps, with the body writing that “the collected information should reside on the terminal equipment of the user and only the relevant information should be collected when absolutely necessary”.

Although later on the in guidance it discussed centralized models that involve proximity data being uploaded to a server in the cloud, writing that: “Implementations for contact tracing can follow a centralized or a decentralized approach. Both should be considered viable options, provided that adequate security measures are in place, each being accompanied by a set of advantages and disadvantages.”

In Europe there is currently a big fight between different camps over whether contacts tracing apps should use a centralized or decentralized model for storing and processing proximity data — with a contacts tracing app standardization effort known as PEPP-PT that’s backed by Germany’s Fraunhofer Institute for Telecommunications and some EU governments wanting to support centralized protocols for COVID-19 contacts tracking, while a separate coalition of European academics wants only decentralized approaches on privacy grounds, and has developed a protocol called DP-3T.

Europe’s PEPP-PT COVID-19 contacts tracing standard push could be squaring up for a fight with Apple and Google

“The current health crisis should not be used as an opportunity to establish disproportionate data retention mandates,” the EDPB warns. “Storage limitation should consider the true needs and the medical relevance (this may include epidemiology-motivated considerations like the incubation period, etc.) and personal data should be kept only for the duration of the COVID-19 crisis. Afterwards, as a general rule, all personal data should be erased or anonymised.”

The body also recommends algorithms used in contacts tracing apps be audited and regularly reviewed by outside experts.

Again, a key criticism of the PEPP-PT initiative has been around lack of transparency — including its failure to publish code for external review. (Though it has said it will be publishing code.)

“In order to ensure their fairness, accountability and, more broadly, their compliance with the law, algorithms must be auditable and should be regularly reviewed by independent experts. The application’s source code should be made publicly available for the widest possible scrutiny,” the EDPB writes.

Another notable piece of the guidance is for a data protection impact assessment not only to be carried out but that it be published — which marks a further push for accountability via transparency in such an unprecedented moment.

“The EDPB considers that a data protection impact assessment (DPIA) must be carried out before implementing such tool as the processing is considered likely high risk (health data anticipated large-scale adoption, systematic monitoring, use of new technological solution). The EDPB strongly recommends the publication of DPIAs,” it writes.

Typically DPAs leave it up to data controllers to decide whether to publish a DPIA or not — in this case the strong push from the central authority is that these documents are made public where COVID-19 contacts tracing apps are concerned.

Having highlighted the pros and cons of centralized vs decentralized approaches to contacts tracing, the EDPB goes on to recommend that the conceptual phase of app development “should always include thorough consideration of both concepts carefully weighing up the respective effects on data protection/privacy and the possible impacts on individuals rights”.

“Any server involved in the contact tracing system must only collect the contact history or the pseudonymous identifiers of a user diagnosed as infected as the result of a proper assessment made by health authorities and of a voluntary action of the user. Alternately, the server must keep a list of pseudonymous identifiers of infected users or their contact history only for the time to inform potentially infected users of their exposure, and should not try to identify potentially infected users.”

“Putting in place a global contact tracing methodology including both applications and manual tracing may require additional information to be processed in some cases. In this context, this additional information should remain on the user terminal and only be processed when strictly necessary and with his prior and specific consent,” it adds.

You can read the full document here.

04.11.20 telecommunications

Google starts highlighting virtual care options in Search and Maps

The COVID-19 pandemic has put a spotlight on virtual care options as both doctors and patients try to reduce in-person visits for routine care as much as possible. Patients aren’t always aware of what’s available to them, though, so over the course of the next two weeks, Google will roll out new features in Search and Maps that will highlight telehealth options.

Hospitals, doctors and mental health professionals can now add details about their virtual care offerings to their Business Profile in Search and Maps, for example. When a patient then searches for them, they’ll see a “get online care” link that will take them to their provider’s website with more information.In the U.S., Google will also start showing virtual care platforms when people use search queries like “immediate care.” The search results page will now highlight both in-person and virtual care options, something that wasn’t previously the case. Uninsured users will also see more details about out-of-pocket prices for their visits.

In addition, Google will now also automatically try to surface a link to a healthcare provider’s COVID-19 page, where they can highlight their own policies for walk-in visits or updates to their operating hours, for example.

04.01.20 telecommunications

Microsoft launches Edge Zones for Azure

Microsoft today announced the launch of Azure Edge Zones, which will allow Azure users to bring their applications to the company’s edge locations. The focus here is on enabling real-time low-latency 5G applications. The company is also launching a version of Edge Zones with carriers (starting with AT&T) in preview, which connects these zones directly to 5G networks in the carrier’s data center. And to round it all out, Azure is also getting Private Edge Zones for those who are deploying private 5G/LTE networks in combination with Azure Stack Edge.

In addition to partnering with carriers like AT&T, as well as Rogers, SK Telecom, Telstra and Vodafone, Microsoft is also launching new standalone Azure Edge Zones in more than 10 cities over the next year, starting with LA, Miami and New York later this summer.

“For the last few decades, carriers and operators have pioneered how we connect with each other, laying the foundation for telephony and cellular,” the company notes in today’s announcement. “With cloud and 5G, there are new possibilities by combining cloud services, like compute and AI with high bandwidth and ultra-low latency. Microsoft is partnering with them bring 5G to life in immersive applications built by organization and developers.”

This may all sound a bit familiar, and that’s because only a few weeks ago, Google launched Anthos for Telecom and its Global Mobile Edge Cloud, which at first glance offers a similar promise of bringing applications close to that cloud’s edge locations for 5G and telco usage. Microsoft argues that its offering is more comprehensive in terms of its partner ecosystem and geographic availability. But it’s clear that 5G is a trend all of the large cloud providers are trying to tap into. Microsoft’s own acquisition of 5G cloud specialist Affirmed Networks is yet another example of how it is looking to position itself in this market.

As far as the details of the various Edge Zone versions go, the focus of Edge Zones is mostly on IoT and AI workloads, while Microsoft notes that Edge Zones with Carriers is more about low-latency online gaming, remote meetings and events, as well as smart infrastructure. Private Edge Zones, which combine private carrier networks with Azure Stack Edge, is something only a small number of large enterprise companies would likely to look into, given the cost and complexity of rolling out a system like this.

Google Cloud goes after the telco business with Anthos for Telecom and its Global Mobile Edge Cloud

Microsoft acquires 5G specialist Affirmed Networks

04.01.20 Credit Cards

YouTube sellers found touting bogus coronavirus vaccines and masks

YouTube has been criticized for continuing to host coronavirus disinformation on its video sharing platform during a global health emergency.

Two US advocacy groups which campaign for online safety undertook an 18-day investigation of the video sharing platform in March — finding what they say were “dozens” of examples of dubious videos, including videos touting bogus vaccines the sellers claimed would protect buyers from COVID-19.

They also found videos advertising medical masks of unknown quality for sale.

There have been concerns about shortages of masks for front-line medical staff, as well as the risk of online scammers hawking a low grade kit that does not offered the claimed protection against the virus.

Google said last month that it would temporarily take down ads for masks from its ad network but sellers looking to exploit the coronavirus crisis appear to be circumventing the ban by using YouTube’s video sharing platform as an alternative digital shop window to lure buyers.

Researchers working for the Digital Citizens Alliance (DCA) and the Coalition for a Safer Web (CSW) initiated conversations with sellers they found touting dodgy coronavirus wares on YouTube — and were offered useless ‘vaccines’ for purchase and hundreds of masks of unknown quality.

“There was ample reason to believe the offers for masks were dubious as well [as the vaccines], as highlighted by interactions with representatives from some of the sellers,” they said.

Their report includes screen grabs of some of the interactions with the sellers. In one a seller tells the researchers they don’t accept credit cards — but they do accept CashApp, PayPal, Google or Amazon gift cards and Bitcoin.

The same seller offered the researchers vaccines priced at $135 each, and suggested they purchase MMR/Varicella when asked which one is “the best”. Such a vaccine, even if it functioned for MMR/Varicella, would obviously offer no protection against COVID-19.

Another seller was found to be hawking “COVID-19 drugs” using a YouTube account name “Real ID Card Fake Passport Producer.”

“How does a guy calling himself ‘Real ID Card Fake Passport Producer’ even get a page on YouTube?” said Eric Feinberg, lead researcher for CSW, in a statement accompanying the report. “It’s all too easy to get ahold of these guys. We called some of them. Once you contact them, they are relentless. They’ll call you back at all hours and hound you until you buy something. They’ll call you in the middle of the night. They are predators looking to capitalize on our fear.”

A spokesman for the DCA told us the researchers compiled the report based on content from around 60 videos they identified hawking coronavirus-related ‘cures’ or kit between March 6-24.

“There are too many to count. Everyday, I find more,” added Feinberg.

The groups are also critical of how YouTube’s platform risks lending credibility to coronavirus disinformation because the platform now displays official CDC-branded banners under any COVID-19 related material — including the dubious videos their report highlights.

“YouTube also mixes trusted resources with sites that shouldn’t be trusted and that could confuse consumers — especially when they are scared and desperate,” said DCA executive director, Tom Galvin, in a statement. “It’s hard enough to tell who’s legitimate and who’s not on YouTube.”

The DCA and CSW have written letters to the US Department of Justice and the Federal Trade Commission laying out their findings and calling for “swift action” to hold bad actors accountable.

“YouTube, and its parent company Google, are shirking their formal policy that prohibits content that capitalizes off sensitive events,” they write in a letter to attorney general Barr.

“Digital Citizens is sharing this information in the hopes your Justice Department will act swiftly to hold bad actors, who take advantage of the coronavirus, accountable. In this crisis, strong action will deter others from engaging in criminal or illicit acts that harm consumers or add to confusion and anxiety,” they add.

Responding to the groups’ findings a YouTube spokesperson said some of the videos the researchers had identified had not received many views.

After we contacted the company about the content YouTube told us it had removed three channels identified by the researchers in the report for violating its Community Guidelines.

In a statement YouTube added:

Our thoughts are with everyone affected by the coronavirus around the world. We’re committed to providing helpful information at this critical time, including raising authoritative content, reducing the spread of harmful misinformation and showing information panels, using WHO / CDC data, to help combat misinformation. To date, there have been over 5B impressions on our information panels for coronavirus related videos and searches. We also have clear policies against COVID-19 misinformation and we quickly remove videos violating these policies when flagged to us.

The DCA and CSW also recently undertook a similar review of Facebook’s platform — finding sellers touting masks for sale despite the tech giant’s claimed ban on such content. “Facebook promised CNN when they did a story on our report about them that the masks would be gone a week ago, but the researchers from CSW are still finding the masks now,” their spokesman told us.

Earlier this week the Tech Transparency Project also reported still being able to find masks for sale on Facebook’s platform. It found examples of masks showing up in Google’s targeted ads too.

09.05.19 Credit Cards

Indias mobile payments firm MobiKwik reaches rare key profit milestone

Indian mobile payments firm MobiKwik has reached a milestone very few of its local rivals can even contemplate: not burning money. The 10-year-old Gurgaon-headquartered firm said Tuesday it is now generating a profit excluding interest, taxes, depreciation and amortization.

“We have been in an ecosystem where we have seen a lot of high-growth and several regulatory changes in the payments domain. But what we realized was that payments alone is likely not going to be a very profitable business,” Bipin Singh, co-founder and CEO of MobiKwik, told TechCrunch in an interview.

To get to the path of profitability, MobiKwik has made a number of significant changes to its business in recent years. It stopped participating in the race to aggressively acquire users and fighting with heavily backed firms such as Paytm, which has raised more than $2 billion to date.

Paytm remains unprofitable and an analysis of its financial performance shows that this is not going to change anytime soon. Google, which also offers a payments service in India, has no shortage of cash, either. MobiKwik has raised about $118 million to date from Sequoia Capital, American Express and Cisco Investments, among others.

Upasana Taku, co-founder and COO of MobiKwik, said the company has taken inspiration from Kotak and ICICI banks, both of which have about 15 million to 20 million customers — a fraction of many digital payment apps — but are profitable. MobiKwik, which employs 400 people, has 110 million users, she said.

In the last two and a half years, MobiKwik has cut down on cashbacks it bandies out to users — a practice followed by every company offering a payments solution in India — and focused on building financial services on top of its wallet app to retain customers and find additional sources of revenue.

The company continues to focus on its mobile wallet and payments processing businesses that account for about 75% of its revenue, but its growing suite of financial services, such as providing credits and insurance to customers, is already bringing the rest of the revenue, she said.

That’s not surprising, as India remains alarmingly under served. Fewer than 50 million credit cards are in circulation in the nation currently, and for people with limited income, getting a loan of any size remains a major challenge.

“Even the population that has access to smartphones and cheap internet data can’t get a credit card in India. We found it a good match for the growth of our payments app. We started serving these users who have the discipline to repay money and have certain kind of income,” the couple said, who are now also donning the role of angel investors.

MobiKwik works with banks and other lenders to finance loans between Rs 5,000 ($69) to Rs 100,000 ($1,380). In the 18 months since it started offering this, MobiKwik has provided 800,000 loans and disbursed $100 million.

In late 2018, the company launched “sachet-sized” insurance plans to provide protection from cyber fraud, fire, accident and hospitalization. These sachets start at as little as Rs 20 (28 cents) and thousands of users buy these everyday. Similarly, it also allows users to buy mutual funds for as little as $1.30.

MobiKwik expects its revenue to hit $69 million in the financial year that ends in March next year, up from $28 million a year earlier. The company, which expects to turn fully profitable by fiscal year 2021, plans to go public in four to five years, Taku said.

MobiKwik competes with a number of players, many of which are increasingly adding financial services, such as loans, to their platforms. Since these digital platforms are able to process loans without the need of salespeople and support staff, it becomes feasible for banks to chase customers with weak financial power.

India’s overall retail credit demand is expected to grow 60% to $771 billion over the next four years, according to the Digital Lenders Association of India.

09.02.19 telecommunications

13 ways to screw over your internet provider

Internet providers are real bastards: they have captive audiences whom they squeeze for every last penny while they fight against regulation like net neutrality and donate immense amounts of money to keep on lawmakers’ good sides. So why not turn the tables? Here are 13 ways to make sure your ISP has a hard time taking advantage of you (and may even put it on the defensive).

Disclosure: Verizon, an internet provider guilty of all these infractions, owns TechCrunch, and I don’t care.

1. Buy a modem and router instead of renting

The practice of renting a device to users rather than selling it or providing it as part of the service is one of the telecommunications industry’s oldest and worst. People pay hundreds or even thousands of dollars over years for equipment worth $40 or $50. ISPs do this with various items, but the most common item is probably the modem.

This is the gadget that connects to the cable coming out of your wall, and then connects in turn (or may also function as) your wireless and wired router. ISPs often provide this equipment at the time of install, and then charge you $5 to $10 per month forever. What they don’t tell you is you can probably buy the exact same item for somewhere between $30 and $100.

The exact model you need will depend on your service, but it will be listed somewhere, and they should tell you what they’d provide if you ask. Look online, buy a new or lightly used one, and it will have paid for itself before the year is out. Not only that, but you can do stuff like upgrade or change the software on it all you want, because it’s yours. Bonus: The ISP is limited in what it can do to the router (like letting other people connect — yes, it’s a thing).

2. Avoid service calls, or if you can’t, insist they’re free

I had an issue with my Comcast internet a while back that took them several visits from a service tech to resolve. It wasn’t an issue on my end, which was why I was surprised to find they’d charged me $30 or so every time the person came.

If your ISP wants to send someone out, ask whether it’s free, and if it isn’t, tell them to make it free or ask if you can do it yourself (sometimes it’s for really simple stuff like swapping a cable). If they charge you for a visit, call them and ask them to take it off your bill. Say you weren’t informed and you’ll inform the Better Business Bureau about it, or take your business elsewhere, or something. They’ll fold.

When someone does come…

3. Get deals from the installer

If you do end up having someone come out, talk to them to see whether there are any off the record deals they can offer you. I don’t mean anything shady like splitting cables with the neighbor, just offers they know about that aren’t publicized because they’re too good to advertise.

A lot of these service techs are semi-independent contractors paid by the call, and their pay has nothing to do with which service you have or choose. They have no reason to upsell you and every reason to make you happy and get a good review. Sometimes that means giving you the special desperation rates ISPs withhold until you say you’re going to leave.

And as long as you’re asking…

4. Complain, complain, complain

This sounds bad, but it’s just a consequence of how these companies work: The squeaky wheels get the grease. There’s plenty of grease to go around, so get squeaking.

Usually this means calling up and doing one of several things. You can complain that service has been bad — outages and such — and ask that they compensate you for that. You can say that a competing ISP started offering service at your location and it costs $20 less, so can they match that. Or you can say your friend just got a promotional rate and you’d like to take advantage of it… otherwise you’ll leave to that phantom competitor. (After all, we know there’s often little or no real competition.)

What ISPs, and, more importantly, what their customer service representatives care about is keeping you on as a customer. They can always raise rates or upsell you later, but having you as a subscriber is the important thing.

Note that some reps are more game than others. Some will give you the runaround, while others will bend over backwards to help you out. Feel free to call a few times and do a bit of window shopping. (By the way, if you get someone nice, give them a good review if you get the chance, usually right after the call or chat. It helps them out a lot.) Obviously you can’t call every week with new demands, so wait until you think you can actually save some money.

Which reminds me…

5. Choose your service level wisely

ISPs offer a ton of choices, and make it confusing on purpose so you end up picking an expensive one just to be sure you have what you need. The truth is most people can probably do pretty much everything they need on the lowest tier they offer.

A 1080p Netflix stream will work fine on a 25 Mbps connection, which is what I have. I also work entirely online, stream high-def videos at a dozen sites all day, play games, download movies and do lots of other stuff, sometimes all at the same time. I think I pay $45 a month. But rates like mine might not be advertised prominently or at all. I only found out when I literally asked what the cheapest possible option was.

That said, if you have three kids who like to watch videos simultaneously, or you have a 4K streaming setup that you use a lot, you’ll want to bump that up a bit. But you’d be surprised how seldom the speed limit actually comes into play.

To be clear, it’s still important that higher tiers are available, and that internet providers upgrade their infrastructure, because competition and reliability need to go up and prices need to come down. The full promise of broadband should be accessible to everyone for a reasonable fee, and that’s still not the case.

6. Stream everything because broadcast TV is a joke

Cord-cutting is fun. Broadcast TV is annoying, and getting around ads and air times using a DVR is very 2005. Most shows are available on streaming services of some kind or another, and while those services are multiplying, you could probably join all of them for well under what you’re paying for the 150 cable channels you never watch.

Unless you really need to watch certain games or news shows as they’re broadcast, you can get by streaming everything. This has the side effect of starving networks of viewers and accelerating the demise of these 20th-century relics. Good ones will survive as producers and distributors of quality programming, and you can support them individually on their own merits. It’s a weird transitional time for TV, but we need to drop-kick them into the future so they’ll stop charging us for a media structure established 50 years ago.

Something isn’t available on a streaming service? 100 percent chance it’s because of some dumb exclusivity deal or licensing SNAFU. Go pirate it for now, then happily pay for it as soon as it’s made available. This method is simple for you and instructive for media companies. (They always see piracy rates drop when they make things easy to find and purchase.)

This also lets you avoid certain fees ISPs love tacking onto your bill. I had a “broadcast TV fee” on my bill despite not having any kind of broadcast service, and I managed to get it taken off and retroactively paid back.

On that note…

7. Watch your bill like a hawk

Telecoms just love putting things on your bill with no warning. It’s amazing how much a bill can swell from the quoted amount once they’ve added all the little fees, taxes and service charges. What are they, anyway? Why not call and ask?

You might find out, as I did, that your ISP had “mistakenly” been charging you for something — like equipment — that you never had nor asked for. Amazing how these lucrative little fees tend to fall through the cracks!

Small charges often increase and new ones get added as well, so download your bill when you get it and keep it somewhere (or just keep the paper copies). These are really handy to have when you’re on the phone with a rep. “Why wasn’t I informed my bill would increase this month by $50?” “Why is this fee more now than it was in July?” “Why do I pay a broadcast fee if I don’t pay for TV?” These are the types of questions that get you discounts.

Staying on top of these fees also means you’ll be more aware when there are things like mass refunds or class action lawsuits about them. Usually these have to be opted into — your ISP isn’t going to call you, apologize and send a check.

As long as you’re looking closely at your bill…

8. Go to your account and opt out of everything

When you sign up for broadband service, you’re going to get opted into a whole heap of things. They don’t tell you about these, like the ads they can inject, the way they’re selling this or that data or that your router might be used as a public Wi-Fi hotspot.

You’ll only find this out if you go to your account page at your ISP’s website and look at everything. Beyond the usual settings like your address and choice of whether to receive a paper bill, you’ll probably find a few categories like “privacy” and “communications preferences.”

Click through all of these and look for any options to opt out of stuff. You may find that your ISP has reserved the right to let partners email you, use your data in ways you wouldn’t expect and so on. It only takes a few minutes to get out of all this, and it deprives the ISP of a source of income while also providing a data point that subscribers don’t like these practices.

9. Share your passwords

Your friend’s internet provider gets him streaming services A, B and C, while yours gives you X, Y and Z. Again, this is not about creators struggling to get their content online, but rather all about big media and internet corporations striking deals that make them money and harm consumers.

Share your (unique, not reused!) passwords widely and with a clean conscience. No company objects when you invite your friends over to watch “Fleabag” at your house. This just saves everyone a drive!

10. Encrypt everything and block trackers

One of the internet companies’ many dirty little deals is collecting and selling information on their customers’ watching and browsing habits. Encrypting your internet traffic puts the kibosh on this creepy practice — as well as being good security.

This isn’t really something you can do too much to accomplish, since over the last few years encryption has become the rule rather than the exception, even at sites where you don’t log in or buy anything. If you want to be sure, download a browser plug-in like HTTPS everywhere, which opts you into a secure connection anywhere it’s available. You can tell it’s secure because the URL says “https://” instead of “http://” — and most browsers have other indicators or warnings as well.

You should also use an ad blocker, not necessarily to block ads that keep outlets like TechCrunch alive (please), but to block trackers seeded across the web by companies that use sophisticated techniques to record everything you do. ISPs are among these and/or do business with them, so everything you can do to hinder them is a little mud in their eye.

Incidentally there are lots of ways you can protect your privacy from those who would invade it — we’ve got a pretty thorough guide here.

11. Use a different DNS

Bryce Durbin / TechCrunch

On a similar note, most ISPs will usually be set up by default with their own “Domain Name Service,” which is the thing that your browser pings to convert a text web URL (like “techcrunch.com”) to its numerical IP address.

There are lots of these to choose from, and they all work, but if you use your ISP’s, it makes it much easier for them to track your internet activity. They also can block certain websites by refusing to provide the IP for content they don’t like.

TechCrunch doesn’t officially endorse one, but lots of companies offer free, fast DNS that’s easy to switch to. Here’s a good list; there are big ones (Google, Cloudflare), “open” ones (OpenDNS, OpenNIC) and others with some niche features. All you need to do is slot those two numbers into your internet configuration, following the instructions they provide. You can change it back at any time.

Setting up a VPN is another option for very privacy-conscious individuals, but it can be complicated. And speaking of complicated…

12. Run a home server

This is a bit advanced, but it’s definitely something ISPs hate. Setting up your home computer or a dedicated device to host a website, script or service seems like a natural use of an always-on internet connection, but just about everyone in the world would rather you sign up for their service, hosted on their hardware and their connection.

Well, you don’t have to! You can do it on your own. Of course, you’ll have to learn how to run and install a probably Unix-based server, handle registry stuff, install various packages and keep up to date so you don’t get owned by some worm or bot… but you’ll have defied the will of the ISP. That’s the important thing.

13. Talk to your local government

ISPs hate all the things above, but what they hate the most by far is regulation. And you, as a valued citizen of your state and municipality, are in a position to demand it. Senators, representatives, governors, mayors, city councils and everyone else actually love to hear from their constituency, not because they desire conversation but because they can use it to justify policy.

During the net neutrality fight, a constant refrain I heard from government officials was how much they’d heard from voters about the issue and how unanimous it was (in support, naturally). A call or email from you won’t sway national politics, but a few thousand calls or emails from people in your city just might sway a local law or election. These things add up, and they do matter. State net neutrality policies are now the subject of national attention, and local privacy laws like those in Illinois are the bane of many a shady company.

Tell your local government about your experience with ISPs — outages, fees, sneaky practices or even good stuff — and they’ll file it away for when that data is needed, such as renegotiating the contracts national companies sign with those governments in order to operate in their territories.

Internet providers only do what they do because they are permitted to, and even then they often step outside the bounds of what’s acceptable — which is why rules like net neutrality are needed. But first people have to speak out.

07.26.19 telecommunications

Tile finds another $45M to expand its item-tracking devices and platform

Tile — the company that makes popular square-shaped tags and other technology to help people keep track of physical belongings like keys and bags — has made more recent moves to link up with chipmakers, helping it expand to wireless headsets and other electronic and other connected items as part of a wider smart home strategy. Now, Tile is announcing a round of funding of $45 million to double down on those strategies and fulfill a plan to have its technology in millions of devices by the end of this year.

The growth equity is being led by Francisco Partners, with participation from previous investors GGV Capital and Bessemer Venture Partners and new backers Bryant Stibel and SVB Financial Group.

CJ Prober — who joined as CEO last year in part to develop Tile’s newer areas of business — said in an interview that the funding will help the startup be more aggressive in doubling down on these new opportunities.

“We’re seeing great business momentum, with the first embedded partner products from our strategic initiatives coming out this year,” he said. It now has partnerships with five semiconductor companies, including Qualcomm and most recently Nordic, which they integrate Tile functionality on to their hardware, he added. “All this is now paying off with great momentum.”

Prober would not comment on the company’s valuation with this round, except to say that it was definitely an up round. A spokesperson described the Series C as having “opened” with this $45 million commitment, which implies that there may be more funding coming, but Tile has declined to specify any more detail on this front. The startup had previously raised rounds in stages — as you can see by this timeline in PitchBook. For some more context, Tile’s last noted valuation (also in PitchBook) was around $166 million, but that was now more than two years ago, before the various initiatives and other changes at the company.

Tile is not disclosing any metrics on its market share or how many of its devices are now in use, but it typically is rated as the largest of a crowded market for item-tracking devices (with others in the space including TrackR (Adero), Chipolo, and more).

But it notes that its European business (a relatively new area of focus for Tile) has grown by 160% in the last quarter. That’s coming from a small base, though: Prober confirmed that the U.S. is still by far its biggest market in terms of sales and users.

And it also had a strong Prime Day on Amazon this year, doubling its unit sales (but didn’t provide hard numbers for comparison). It said it has exceeded projections for sign-ups for its Premium tier, which provides free battery replacements, 30-day location history, smart alerts (prompting you, for example, when you’ve left your keys somewhere), customer support and more for $30 for the year, or $3 per month.

The company has been planting a lot of seeds, and some of them have yet to sprout. Last year, Tile announced that it would take an investment from Comcast to help it develop new products for its wider connected consumer strategy.

Prober, however, described this as still in the “roadmapping phase” and would not get into specifics except to say that there are a number of different initiatives in the works. There also was a partnership with Google unveiled at the most recent I/O that will see its home devices also being able to be tracked by the Tile platform.

I asked Prober if he worries ultimately about whether large tech companies like Apple, Amazon, Google and the rest — which all want to “own” connected home customers and the ecosystem of hardware and services that they may use — are seen as opportunities or threats for Tile, given that it’s piggy backing on their platforms and devices. His and the company’s fundamental feeling — one that should be supported in the spirit of competition and consumer choice — is that having a cross-platform option is the way to go.

“Our customers have different devices, products from different companies and it’s our job to ensure that Tile works well across all of those,” he said. “We see ourselves a little bit like Switzerland, which is also something that our customers and partners appreciate.”

While we’re seeing a surge of new communications technologies and protocols — 5G being perhaps the one we are hearing about most at the moment — Tile is sticking to Bluetooth for now.

“We love what Bluetooth enables for our customers in terms of the form factor, the cost and profile of the device and the power consumption,” said Prober. “We’re constantly evaluating different alternatives, and if there is an alternative we would consider that, but in our view that doesn’t exist right now.”

It’s a choice that its investors are also supporting.

“Tile pioneered the smart location category,” said Andrew Kowal, partner with Francisco Partners, in a statement. “With Bluetooth technology projected to be included in nearly 30 billion devices shipping in the next five years, Tile is poised to deliver an embedded finding solution for a rapidly expanding market. We are extremely excited to be partnering with Tile as the company enters the next chapter of its growth story.”

06.30.19 telecommunications

Huawei can buy from US suppliers again but things will never be the same

U.S. President Donald Trump has handed Huawei a lifeline after he said that U.S. companies are permitted to sell goods to the embattled Chinese tech firm following more than a month of uncertainty.

It’s been a pretty dismal past month for Huawei since the American government added it and 70 of its affiliates to an “entity list” which forbids U.S. companies from doing business with it. The ramifications of the move were huge across Huawei’s networking and consumer devices businesses. A range of chip companies reportedly forced to sever ties while Google, which provides Android for Huawei devices, also froze its relationship. Speaking this month.

All told, Huawei founder and chief executive Ren Zhengfei said recently that the ban would cost the Chinese tech firm — the world’s third-larger seller of smartphones — some $30 billion in lost revenue of the next two years.

Now, however, the Trump administration has provided a reprieve, at least based on the President’s comments following a meeting with Chinese premier Xi Jinping at the G20 summit this weekend.

“US companies can sell their equipment to Huawei. We’re talking about equipment where there’s no great national security problem with it,” the U.S. President said.

Those comments perhaps contradict some in the US administration who saw the Huawei blacklisting as a way to strangle the company and its global ambitions, which are deemed by some analysts to be a threat to America.

President Trump has appeared to soften his tone on Chinese communications giant Huawei, suggesting that he would allow the company to once again purchase US technology https://t.co/4YNJCyKLTg pic.twitter.com/jr45f40ghP

— CNN International (@cnni) June 29, 2019

Despite the good news, any mutual trust has been broken and things are unlikely to be the same again.

America’s almost casual move to blacklist Huawei — the latest in a series of strategies in its ongoing trade battle with China — exemplifies just how dependent the company has become on the U.S. to simply function.

Huawei has taken steps to hedge its reliance on America, including the development of its own operating system to replace Android and its own backup chips, and you can expect that these projects will go into overdrive to ensure that Huawei doesn’t find itself in a similar position again in the future.

Of course, decoupling its supply chain from US partners is no easy task both in terms of software and components. It remains to be seen if Huawei could maintain its current business level — which included 59 million smartphones in the last quarter and total revenue of $107.4 billion in 2018 — with non-US components and software but this episode is a reminder that it must have a solid contingency policy in case it becomes a political chess piece again in the future.

Beyond aiding Huawei, Trump’s move will boost Google and other Huawei partners who invested significant time and resources into developing a relationship with Huawei to boost their own businesses through its business.

Indeed, speaking to press Trump, Trump admitted that US companies sell “a tremendous amount” of products to Huawei. Some “were not exactly happy that they couldn’t sell” to Huawei and it looks like that may have helped tipped this decision. But, then again, never say never — you’d imagine that the Huawei-Trump saga is far from over despite this latest twist.

06.22.19 telecommunications

Who Owns Song Lyrics on the Internet? It’s Complicated

If you felt that an internet giant stole your hard work and claimed it as its own, how would you ever prove that? Well, what if you could booby-trap the information first?

On this spine-tingling episode of the Gadget Lab podcast, Mike, Arielle, and Lauren talk with WIRED’s Emily Dreyfuss about how the tension between Google and song lyric service Genius could become much more than just a copyright dispute.

Also in the news, Apple takes a hit with a recall of the MacBook Pro, and GE catches some delayed online ridicule over a video about light bulbs. Finally, the gang considers switching formats to become an ASMR podcast.

Show Notes

Read more from Emily about the Google-Genius dispute here. Soothe your senses with Arielle’s story about ASMR. Read Lauren’s analysis of the latest woes of the MacBook Pro. And you can follow along with the video for how to reset C by GE light bulbs and paint yourself into a tingly slumber with Behr Paint’s ASMR ad. (Psst … we also got more Keanu.)

Recommendations

Arielle recommends the podcast Top 40 Philosophy. Mike recommends Katamari Damacy Reroll on the Nintendo Switch. Lauren recommends diving into the Genius page for Skee-Lo’s “I Wish” and season three of The Handmaid's Tale on Hulu. Emily recommends that you delete your Twitter app. (No link here, pal.)

Michael Calore can be found at @snackfight. Lauren Goode is @laurengoode. Arielle Pardes can be found at @pardesoteric. Emily Dreyfuss is @EmilyDreyfuss. Boone Ashworth, who edited the show, can be found at @booneashworth. Bling the main hotline at @GadgetLab. Our theme song is by Solar Keys.

How to Listen

You can always listen to this week's podcast through the audio player on this page, but if you want to subscribe for free to get every episode, here's how:

If you're on an iPhone or iPad, open the app called Podcasts, or just tap this link. You can also download an app like Overcast or Pocket Casts, and search for Gadget Lab. If you use Android, you can find us in the Google Play Music app just by tapping here. We’re on Spotify too. You can also download an app like Pocket Casts or Google Podcasts, and search for Gadget Lab. And in case you really need it, here's the RSS feed.