July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

Tech companies like Facebook, Apple, and Google are not the only ones helping U.S. intelligence agencies track citizens.

For years, data scientists have been brought in to brief with the National Security Agency.

The NSA has a massive team of analysts and a huge wiretapping program called PRISM, but it is eager to take advantage of the newest “big data” and machine learning technologies, so it can more easily make sense of millions of phone calls, emails, and text messages.

The goal is to track suspicious activity and create a complex “alerts system” for acts of terrorism, said Sean Gourley, a data scientist and founder of Silicon Valley-based Quid, which provides big-data analysis services, mostly for government customers.

Some of the most innovative technology designed to cope with massive data streams has come out of Silicon Valley. For this reason, the CIA’s venture arm, In-Q-Tel, has an office on the Palo Alto’s famous Sand Hill Road. It makes strategic investments in “big data” startups, like Recorded Future, whose products may come in useful for various government agencies.

“The NSA is naturally interested in data mining; I know of data scientists in Silicon Valley who have helped them,” said Mike Driscoll, chief executive of Silicon Valley-based big data startup Metamarkets.

“They appeal to our sense of patriotism,” said Driscoll.

Driscoll was not surprised by today’s news exposing the government’s PRISM program, which caused a furor among civil liberties activists and the media. He referred to the Echelon Project, the NSA’s clandestine data mining project and spy program that we’ve known about for years, as a precedent.

To recap: The Washington Post reported today that tech companies are participating in a top secret data mining program for the FBI and NSA, dubbed PRISM. Since the news broke, the companies named in the report have almost universally issued statements to the press that they do not provide direct access to their servers.

However, the government is a third party. Facebook’s terms of service, for instance, state that it can share your information with third parties. The assumption most Facebook users make is that the wording refers to marketers or advertisers, not the government.

“We don’t mind little bits of manipulation, but we do mind if it’s on this scale,” said Gourley.

According to Gourley, who regularly works with federal agencies, the NSA is most interested in real-time systems for data analysis. It’s not just what you say — but who you know. In other words, you’ll be flagged if you’ve communicated with a person of interest, or if you share a suspicious tweet.

“The NSA is essentially looking for a needle in a massive, massive haystack,” he said.

Given that technology exists for sophisticated analysis of social networks, “you could be on the list by association,” he warns.

The new SDK adds better mobile analytics that will help developers get metrics on sharing events and actual usage: what people are actually doing in their apps. In addition, the new tools will enable conversion logging from ads running in Facebook-connected iOS apps, and — currently in beta — logging of in-app purchases. Both of which, of course, will help Facebook-connected apps monetize better.

In addition, the new Facebook SDK adds better — and simpler — error handling.

“The SDK will now automatically categorize errors by common application handling behavior and provide helpers to simplify some common error response cases,” Facebook engineer Jason Clark posted today. ”In addition, the SDK will automatically handle a larger number of error cases including various iOS 6 cases such as password changes and expired tokens.”

It sounds like developers who have heard about the update are happy, so far, as the update is solving annoying problems. One, Jack Tihon from Endorse, said “It’s about time. I was living in a world of pain trying to unstick users with expired tokens due to various reasons (change password, sign out of devices, etc.”

With better tracking and analytics capabilities, the new SDK is almost starting to impinge on some of the functions of dedicated app analytics solutions like App Annie and Flurry, but of course in a purely Facebook-focused manner.

The update also includes bugfixes, is backwards compatible, and is available here.

photo credit: Steel Wool via photopin cc

MapMyFitness rolled out an update today for its MVP premium subscribers that’s full of new and enhanced features.

MapMyFitness powers a suite of health and fitness tracking apps. Its flagship products, MapMyRun and MapMyRide, use built-in GPS technology so you can record your workout as well as search for new routes and monitor data like duration, pace, speed, elicitation, and calories burned. It saves all of this information so you can view your activity progress over time. Social elements provide motivation to stick to regimens and can make exercise more fun.

The business is based on a “freemium” model. The core set of features are free, but fitness enthusiasts can pay a monthly or annual fee for a more comprehensive experience. The MVP membership is $30 a year and comes without ads as well as tools like a Route Recommender, Customs Splits, Advanced Heart Rate, Training Plans, and Power Analytics.

“The new MVP is just a cleaner experience,” said CEO Robin Thurston in an interview. “People are gaining a fitness aptitude for data. They want content and analytics, and they are willing to pay for it if it will change their health outcomes and improve daily health.”

The Route Recommender is based on an algorithm that factors in desired length, travel mode, direction, rotations, and such and will autogenerate a customized route. For those trying to craft their own course, the app has a library of tools and icons to map it out. The heart rate tracking features are useful for people with target heart rate goals or restrictions, and the live tracking means friends can view each others’ activity. Thurston said that these product updates are a direct result of feedback from consumers about their needs.

MapMyFitness currently has 13 million users and hopes to grow to 20 million this year. Further updates are in the pipeline, including challenge/gamification features and more integrations with quantified self devices.

“There are encouraging trends around technology,” Thurston said. “People are adopting activity trackers and using mobile technology to be more active. This is a step in the right direction, but the next step is helping people change outcomes. The next five years in this space specifically is probably going to be one of the most exciting industries to be in, because of rapid change and disruption that is coming.”

MapMyFitness is headquartered in Austin, Texas. It was founded in 2007 by Thurston, who used to be a professional cyclist, and has raised $18.5 million to date. Competitors include Runkeeper, Skimble, and Endomondo. Read the press release.

Microsoft isn’t making itself any friends in the ad industry, which still isn’t crazy about the company’s Do Not Track ambitions.

On Tuesday Microsoft chief privacy officer Brendon Lynch confirmed that the Do Not Track (DNT) setting would be on by default in the next version of Internet Explorer, a move the company initially announced in May.

“Do No Track ” is the name given to a proposed web header that tells websites when a web browser doesn’t want to be tracked. While privacy advocates favor the move, those in the ad industry say it will undermine the way they do business.

In the former camp is Microsoft, which says it’s making the move on behalf of the average web user. “We believe consumers should have more control over how data about their online behavior is tracked, shared, and used,” Lynch said.

For Microsoft, this means turning the setting on by default, a setting that doesn’t make much sense to those in the digital ad industry.

“Their decision to set DNT by default was an overreach, and this remains an overreach,” Scott Meyer, the CEO of advertising tech company Evidon, told VentureBeat.

Unlike Microsoft, Meyer doesn’t believe Do Not Track is something anyone actually wants — least of all consumers.

“The overwhelming reaction of the industry, government, and well-informed advocates to Microsoft’s announcement illustrates that DNT should remain set to off,” he said.

Instead, Meyer wants Microsoft to leave the advertising regulation to the advertisers (something that his company makes a mint helping out with).

One of the big self-regulation bodies, the Digital Advertising Alliance(DAA), agrees, and argues that Microsoft’s DNT ambitions go against how the web works.

“Microsoft’s continued support of DNT as the default setting in IE8 risks advertising support for free and low-cost Internet in products and services,” the DAA said in a statement to VentureBeat.

In the eyes of DAA, Do Not Track is bad news not only for advertisers, but also for the web users that rely on ad-supported services. After all, advertisers are only as effective as the amount of information they have on potential consumers. And if their revenue goes down, it could have big effects on the sites (like this one) that work with them. Or so it goes.

But Microsoft isn’t showing any intention of letting up. While the company will give Windows 8 users the option to turn the Do Not Track features off, it remains to be seen whether users will bother.

“In fact, we found that the brick-and-mortar impact of online ads could be bigger than their online impact,” RapidBlue chief operating office Sampo Parkkinen told VentureBeat today.

This result is astonishing and could upend the way the online advertising industry traditionally tracks costs and measures return on investment. An online campaign that doesn’t seem to be paying for itself could, if this study is correct, be providing offline benefits.

That could be music to offline retailers’ ears, who are naturally not tremendously excited about being Amazon.com’s showroom.

RapidBlue, a venture-funded company, maps shopper behavior in stores and shopping centers: how many visitors, where do they go, how long do they spend in the store, what do they look at. The resulting data helps retailers understand what shoppers are doing and why they’re spending money — or not.

“We’re not really tracking the individual person,” says Parkkinen. “We’re installing our solution, which tracks mobile phones in retail outlets. Then we look at the sales metrics and how they’re fluctuating.”

After gathering baseline data, RapidBlue asked retailers to conduct a Google AdWords campaign. Then, while controlling for time-of-day and day-of-week variability, it re-checked shopper metrics, using a patented approach the company calls Gross Shopping Hours. Finally, after pausing the campaigns, it continued gathering baseline data, in order to control for other variables that could be causing shopper behavior changes.

“What we’ve found, and what seems to be quite encouraging, is that online campaigns for retailers seem to have a brick-and-mortar impact,”says Parkkinen.

More shoppers visited, and shopper spent more time in-store.

Exciting stuff, if you’ve invested in a physical location.

Rostislav Glinsky / Shutterstock.com, Wrangler/ShutterStock

Or costing you more, if you’re Mario Andretti in a minivan.

Source: Progressive

Progressive’s Snapshot device

Progressive’s system, called Snapshot, works by plugging a little electronic dongle into your vehicle. Previously only available to select Progressive clients, Snapshot is now available to all clients … and customers of any other insurance agency.

The device tracks three driving behaviors: time of day you’re driving, distance you’re driving, and how many times you hit the brakes hard per mile.

Snapshot uploads that data to Progressive via the cellular network, and from those three driving behaviors, Progressive can assess your accident risk much more effectively than before.

“Until now, insurers had no effective way to capture actual driving behavior and factor that into the rates they could offer,” Progressive chief executive Glenn Renwick said in a statement. “But we have made a meaningful start toward personalized insurance pricing that’s based on measuring real-time driving behavior.”

In testing the program, Progressive said 70 percent of drivers who sign up for Snapshot actually save money, averaging $150 in annual savings. More than a million drivers have beta tested the device, saving more than $70 million so far.

The question is, of course: are already-safe drivers choosing the device, or is the device making drivers safer? Perhaps both, according to Progressive:

“Snapshot is an optional program, which tends to attract safe drivers — as evidenced by the fact that seven out of ten save,” a company representative told VentureBeat. But, the spokesperson added, “drivers with the device in their cars tend to be more aware of their driving overall.”

After a month of usage, drivers can go online to check their stats … and get a new quote, potentially saving them money.

What if Snapshot decides that you are a bad insurance risk? Will your costs go up?

According to Progressive, no: the program is discount only, and no current Progressive clients are charged more. Non-clients will get a quote which they can take or leave.

Realistically, however, insurance works by averaging risk.

Those who have accidents are subsidized by those who do not. If all safe drivers, who rarely crash, start using Snapshot or similar devices, insurance rates for those who do crash and are not using the device would, inevitably, have to rise at some point. When that happens, it might be better to be classified in the safe pool than see skyrocketing insurance rates.

And it’s hard to argue that this wouldn’t be fair.

Image credit: Serg Dibrova/ShutterStock

With its stock value sinking, Facebook is looking to restore faith in its ad-based business model any way it can. It’s solution? A form of ad auctioning known as real-time bidding.

With the new system, dubbed “Facebook Exchange”, advertisers will be able to display more targeted ads using the browsing history of individual Facebook users, Bloomberg reports. While real-time bidding is new to Facebook, it’s already in use by companies like Google, Yahoo, and Aol.

“By bidding on a specific impression rather than a larger group, advertisers are able to show people more relevant ads while also running more efficient and effective campaigns,” Facebook said in a statement.

Real-time bidding is a different sort of beast from the pre-paid ad model most people are familiar with. The bidding component is simple: Advertisers vie for a particular ad spot, and whoever offers the most cash wins the prize.

This is all done in real-time, which means that not only is the system swift and flexible, but it’s also potentially more powerful as well. Rather than serve ads with a wide net, advertisers offer them based on actual user behavior — offering Jameson ads to those who really like Mad Men, for instance. The effectiveness can be increased even further if advertisers run the Jameson ads while Mad Men is on television.

For Facebook this obviously means greater revenue in situations where multiple ad firms are trying to outbid each other for some particularly juicy piece of real estate. And greater revenue is just what Facebook is looking for now that it’s under the watchful eyes of investors.

The problem? With better targeting comes more strenuous tracking, and Facebook Exchange will offer both in droves. Will this make Facebook users uneasy? Probably. While the social network doesn’t plan to offer the ability to opt out on Facebook proper, users will be able to do so via third-party brokers.

Photo: People raise hand to be picked/ Shutterstock

July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

Apple has sent developers flurrying to find tracking alternatives since it began rejecting some apps that take advantage of your device’s UDID, or unique device identifier, to track your behavior. But now it seems Apple is gearing up to offer a solution of its own.

Just a few days before Apple kicks off WWDC 2012, its annual developers conference, the Wall Street Journal is reporting that the iPhone maker is developing a new app tracking tool that would provide developers with useful information, while protecting users’ privacy more than the UDID approach.

The WSJ doesn’t have any details on what Apple’s new tracking tool could offer — other than saying it could be announced within the next two weeks — but it’s not hard to fathom a few guesses (more on that below). Apple, of course, isn’t commenting on the report.

Apple announced last Summer that it would be deprecating UDID-based app tracking (at the time I argued that doing so would cure plenty of privacy headaches), and a few months ago it began rejecting some apps that used the IDs to track users improperly.

It made sense for developers to rely on UDIDs initially: Unlike cookies, which are used on web browsers to track user activity, Apple’s device IDs are permanent, and users can’t block their transmission to third parties. Developers need tracking capabilities to see how users interact with their apps, and mobile ad firms use tracking to target users with relevant ads.

But with privacy concerns on the rise, Apple is being forced to come up with a more secure solution. After all, it wasn’t too long ago that Path, Instagram, and a plethora of other apps got in hot water over accessing your address book data (among other personal information).

Based on conversations with developers over the past year, and inferences from simply looking at the deficiencies with the UDID tracking approach so far, here’s what I’m expecting from Apple’s tracking tool:

Opt-in tracking + toggle switch: The biggest problem with UDIDs for user tracking is that consumers don’t actually know their behavior is being tracked. That’s great for developers, since it means they can get useful data on just about everyone, but it leaves most consumers in the dark. Apple could fix a majority of its privacy issues by simply making consumers aware that their behavior could be tracked, having it turned off by default, and offering a simple way to toggle the tracking on and off.

Stricter developer rules: By taking control of the app tracking process, Apple will be able to better keep developers in check. I wouldn’t be surprised if Apple made it clear to developers that they could lose tracking privileges if they abused the tool. (Apple could still just reject apps outright, but a more granular tool could allow Apple to keep money-making apps available sans-tracking.)

Per-app tracking: Just like how iOS 5 handles notifications on a per-app basis, Apple could offer the ability to tweak tracking by individual app. This one’s a bit of a stretch, but considering just how much is on the line if Apple doesn’t implement user tracking properly, I wouldn’t be surprised to see such a pro-consumer addition.

There’s likely plenty more Apple has up its sleeves, so chime in below with other tracking features you’re expecting. Or, if you think Apple shouldn’t be supporting tracking at all, tell us why.

Photo via Bonnie Brown/Flickr

On the other side of the debate are the behavioral advertising firms and publishers who say that, while protecting consumer privacy is of utmost importance, tracking helps serve targeted ads to consumers who might be interested, and regulating such tracking could suppress innovation and perhaps even kill online advertising.

So, Congress, before considering Speier’s bill and diving headfirst into government regulation, let’s take a look at some other options that will achieve the same consumer privacy results without strangling online advertising. Specifically, these options include transparency from advertisers, proper technology tools, and consumer participation in managing relationships with the businesses they frequent.

Transparency, Data Hygiene, and Technology
“Business transparency” is a buzzword that transcends industries — and for good reason: It’s a key component in developing trust. In digital marketing, adopting transparent business practices is the best way for companies to protect their brand and their business, while also ensuring consumer privacy is maintained. It is also in the best interest of advertisers and data brokers to be transparent about how they collect consumer data and what they intend to do with it. Take a look at recent TRUSTe’s Privacy Index findings, which serve as a warning to digital marketers and advertisers: Eighty-eight percent of U.S. adults say they avoid doing business with companies that do not protect their privacy.

Of course, marketers and advertisers will only want to be transparent if their data (consumer information) is “clean;” that is, permission-based and accurate. They can start by outsourcing to only trustworthy list-rental vendors that offer permission-based lists, so recipients will be those who have “opted in” to receive advertisements and offers.

Technology, too, can play a crucial role here. Savvy digital marketers use technology that helps target specific demographics, while also ensuring opt-out preferences are heeded. Tools from other companies that remove bad or invalid e-mail addresses or non-permissioned addresses and spam traps can augment that technology. (And advertisers using this technology get the added bonus of more targeted results.) Aside from sidestepping privacy issues, making sure records are clean before you execute a campaign means a higher level of in-box delivery and increased open-and-click rates.

The Consumer’s Role
An individual’s responsibility to manage his or her own personal information online is just as important as the role companies play in protecting consumer privacy. It starts with paying close attention to the fine print. Every company a customer has an online relationship with has a privacy policy in place, which details how they plan to share the consumer’s information. If consumers overlook this fine print and fail to opt out, the floodgates are cast open, and those consumers will not only receive unsolicited email, but also open themselves up to publicized personal information.

Many supporting Speier’s bill fail to recognize how easy it is for consumers to opt out of receiving unsolicited email. It’s simply a one-click process and requires nothing more than an email address to complete. Furthermore, it’s regulated: Under the CAN-SPAM Act of 2003, consumer opt-out requests must be honored within 10 days or the offending company could face criminal and/or civil charges.

With this consumer buy-in to take responsibility for opting out, as well as proper technology tools and transparency among advertisers and data brokers, we can effectively self-regulate and continue to reap the rewards online advertising affords all parties.

David Fowler is chief privacy officer of lead-generation platform maker Marketfish. 

[Top image credit: Luis Louro/Shutterstock]

The world now has access to a list of words and phrases that the U.S. Department of Homeland Security uses to monitor social networks and news article comments for terrorism and general threats against the country.

The list was part of a 39-page “2011 Analyst’s Desktop Binder” document that was released due to a Freedom of Information Act request by privacy watchdog organization Electronic Privacy Information Center. The list contains references to all the related governmental agencies, obvious references to threats (attack, nuclear threat, etc.) and then some pretty generic words like pork, cloud, electric, port, dock, and many others.

The overall report is interesting because it sheds some light on how these security agencies are trained to track potential threats online, but it does raise more than a few questions. For instance, why is Homeland Security tracking many vague terms, and what do they do with this information once its been identified as a possible threat?

The department claims that the practice is simply to monitor activity and not to track anti-U.S. comments made by individuals — a practice currently employed by the governments of Iran and Syria.

The FBI is also getting into the business of crawling social media sites for possible threats against the country with a new tool, as VentureBeat reported back in January.

We’ve embedded the Homeland Security Department’s document below for further inspection. Let us know what you think in the comments.

Via Daily Mail; Image via Andrea Danti/ Shutterstock

Apple has been cracking down on apps that try to use a device’s UDID, a 40-character code that uniquely identifies each device the company sells.

The Cupertino company’s apparent turnabout (it used to allow apps to access the UDID) has spawned confusion and an abundance of theories. On one hand, Apple has indicated that users will reject its App Store if it allows UDID sharing without user consent. However, the company has not made any announcement, and we’ve yet to see an actual breakdown of the number of apps that have been rejected vs. the number that are passing where the UDID is accessed. Because Apple’s policy on UDID crackdowns has been vague, the market was caught off guard last month when Apple told its reviewers to reject apps that access UDID.

This issue is particularly relevant to mobile app publishers, mobile analytics providers, advertisers, and ad networks, who are scrambling for solutions that will survive a post-UDID world.

Why everyone is hooked on UDIDs

Why is this so pressing? In short, ad networks use UDIDs to measure conversion of a specific ad or campaign, a practice called attribution. It’s one identifier that’s sure to work across all different apps, because it’s consistent and unique to each iPhone or iPad. Also, when partners and advertisers have access to audience data, they use UDIDs to target their ads to users that are likely to be more interested and responsive.

The biggest weakness of UDIDs is that they are tied to a device and therefore cannot be deleted. So they’re not designed for opt-out mechanisms, and the actual device ID can be considered as “personally identifiable information” (PII), much like a given name, Social Security number, or driver’s license number. As concerns about user privacy have surfaced in the press lately, the reliance on UDIDs has started to look less and less defensible.

We’ve seen this before. During the height of the Web ad-targeting days, people raised concerns about privacy. However, the technology of the Web provided an opt-out for consumers who did not want their activity to identify them: Just delete your browser cookies. Only a tiny fraction of consumers actually opted out, and the reality is that those who opt out view just as many ads online; the ads are just not targeted to them. Back then, the cookie solved the problem for marketers.

Similarly, today’s UDID controversy obscures a key point: It’s actually a real opportunity for the mobile industry.

The UDID was never a perfect solution to begin with, and though some of the current alternatives leave much to be desired, the industry is attempting to work together on new standards. A new standard could alleviate Congressional concerns around user privacy and prevent a complete crackdown, dramatically lessen the mobile industry’s reliance on Apple, and give service provides more control over their ad operations.

It’s time to find alternatives

At Apsalar, we have chosen to support all current UDID alternatives for cross-app analytics and targeting — including SHA1 encryption of a device’s MAC address (a unique identifier used in network communications), an MD5 hash of MAC address, ODIN (a derivative of the MAC address), and OpenUDID — in our most recent SDK. We are supporting all the MAC address-related options because industry players have implemented them (the MAC address is programmatically accessible today through a well-publicized API) and they are current market realities.

However, we don’t see the MAC address as a lasting solution. If Apple eventually does away with the UDID because it is tied to the device and can’t be erased, the same fate will befall the MAC address, which is just as tied to each particular device. Although Apple has not deprecated the MAC address yet, to rely on this as anything but an interim measure is burying one’s head in the sand.

In the longer term, our position is that OpenUDID offers the most promise as the foundation for the new standard. First, OpenUDID is distributed by nature. Any participant can write and read OpenUDIDs and therefore no one party controls them. Further, OpenUDID does not rely on an ID tied to hardware, which means that it is delete-able, just like browser cookies, and less likely to be classified as personally identifiable information. Moreover, OpenUDID provides a framework for users to opt out, and that gives every publisher or network the flexibility to create its own opt-out policy.

In the end, a suitable mobile industry consumer privacy framework will focus on the following areas:

• Limited (or no) collection of PII
• Consumer notice of collection and use of behavioral data
• Targeting only on non-PII behavioral data
• Conspicuous choice to opt out of behavioral advertising

Amid the uncertainty, we as an industry can define a new standard that addresses users’ opt-out concerns while also developing audience measurement and targeting best practices that don’t rely on PII. If we get it right, we will reduce our reliance on a single platform provider as well as avoiding the intervention of an overzealous legislature. It’s up to us to develop the mobile audience measurement and advertising ecosystem in a responsible way.

Michael Oiknine is the chief executive and cofounder of Apsalar, which serves highly targeted mobile ads based on user segmentation and behavior analytics. Oiknine was previously founder and CEO of Kefta, a SaaS provider of behavioral targeting services for large Web entities.

Steve Ballmer facebook

Microsoft is leveraging an outcry over Google’s approach to privacy to smear its rival in the press. It released a blog post yesterday that claimed to have fresh findings about how Google circumvents privacy protections in Internet Explorer to place cookies that track users across the web.

But Microsoft was playing dumb. It has known about this technique for two years and failed to mention that many other major sites like Facebook, in which Microsoft is an investor, use the same techniques to get around IE’s default privacy settings.

Here is the setup from Microsoft’s blog post yesterday, written by Dean Hachamovitch a corporate Vice President at Internet Explorer. “When the IE team heard that Google had bypassed user privacy settings on Safari, we asked ourselves a simple question: is Google circumventing the privacy preferences of Internet Explorer users too?”

That’s a question that Microsoft already knows the answer to. A study published way back in 2010 showed that more than a third of sites visited using Internet Explorer have a technical error that allows cookies to be installed. The study was big news, meriting a story in the New York Times.

The trick that Google, Facebook and many other are using to get around IE’s privacy settings involves a web standard know as P3P. In their recent blog post, Microsoft said they would be calling on Google to honor this protocol. But Facebook has made it perfectly clear that P3P isn’t some universally accepted technology. A blog post from technologist Nik Cubrilovic lays out the specifics. Attached to the piece of code that allows Facebook to get by IE’s privacy settings he found this statement:

“The organization that established P3P, the World Wide Web Consortium, suspended its work on this standard several years ago because most modern web browsers do not fully support P3P. As a result, the P3P standard is now out of date and does not reflect technologies that are currently in use on the web, so most websites currently do not have P3P policies.”

So to recap. Microsoft jumped on a story about how Google was getting around privacy protections in Safari to drum up outrage about a two-year old violation they were already well aware of. What they neglected to mention is that plenty of other sites, including Facebook and its Bing search data partners, use the exact same techniques and have more or less dismissed the standards Microsoft is calling on Google to honor.

This is playing politics with privacy concerns, plain and simple.

July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

Welcome to another edition of yellow journalism with Julia Angwin of The Wall Street Journal. The reporter who brought you the “What They Know” series has caught Google with its pants down. The WSJ found that Google managed to get temporary tracking cookies assigned to people using Safari on the iPhone and iPad, even though both Apple and Google told consumers that Safari, by default, blocked this kind of activity.

When it was informed of this story, Google changed its approach and deleted text from its website, making it look very guilty.

At the risk of being seen as an apologist for the culture of tracking — the dark side of the web supported by advertising (that’s how Google pays the bills, remember) — this story glosses over a lot of important details in its rush to judgement. The first paragraph declares Google “tricked” Apple’s software into letting it track users, which sounds pretty dark.

John Battelle, a journalist and founder of Federated Media, has an interesting take on this: “Google and many others have figured out ways to get around Apple’s default settings on Safari in iOS — the only browser that comes with iOS, a browser that, in my experience, has never asked me what kind of privacy settings I wanted, nor did it ask if I wanted to share my data with anyone else (I do, it turns out, for any number of perfectly good reasons). Apple assumes that I agree with Apple’s point of view on ‘privacy,’ which, I must say, is ridiculous on its face, because the idea of a large corporation (Apple is the largest, in fact) determining in advance what I might want to do with my data is pretty much the opposite of privacy.”

Oh, and here’s another interesting tidbit. There appears to be two versions of this story floating around on the WSJ website. The story currently causing an uproar is co-bylined by Julia Angwin and Jennifer Valentino-Devries. There is another piece by Valentino-DeVries that covers the exact same material, but dives into more technical detail. The last paragraph of that story reads, “An update to the software that underlies Safari has closed the loophole that allows cookies to be set after the automatic submission of invisible forms. Future public versions of Safari could incorporate that update. The people who handled the proposed change, according to software documents: two engineers at Google.”

That update took place seven months ago.

At Google, one hand often doesn’t know what the other is doing. While the advertising team was exploiting a loophole to get tracking cookies in Safari, another set of Google engineers was closing the loophole. That seems like a fact worth mentioning, especially since it squashed this bug in Safari’s settings more than half-a-year before this story came out.

Cookie Monster via Flickr user bsabarnowl

July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

The United States Congress is readying a new piece of legislation aimed at preventing unauthorized use of your cellphone data.

The Mobile Device Privacy Act (PDF), released today by Rep. Edward Markey (D-Mass.), is in direct response to the recent controversy caused by data tracking software Carrier IQ. That software is designed to help cellphone companies track the performance of their devices, but many critics believe it’s far too intrusive because it records users’ web browser history, text messages and location, and every keystroke.

Under the proposed legislation, companies would be required to disclose if they are using data-tracking software, as well as the type of data that’s being collected or tracked. The bill also requires cellphone companies obtain the consent of customers before they can implement such data tracking software.

While I’m OK with cellphone companies or device manufacturers collecting usage data about my cellphone habits, I definitely don’t want that information shared with third-party organizations. Since many others are likely to agree, the bill stipulates any company that wants to transfer data to third parties must file an application with the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC).

Via The Hill

Yesterday, VentureBeat reported on tests run by entrepreneur/hacker Nik Cubrilovic, who determined that Facebook merely alters its tracking cookies when a user log out, rather than deleting them. Those cookies still contain account information and other unique identifiable information, which means Facebook can track a person’s visits to any page with a Facebook button or widget.

A Facebook spokesperson sent us the following statement:

Facebook does not track users across the web. Instead, we use cookies on social plugins to personalize content (e.g. Show you what your friends liked), to help maintain and improve what we do (e.g. Measure click-through rate), or for safety and security (e.g. Keeping underage kids from trying to signup with a different age).  No information we receive when you see a social plugins is used to target ads, we delete or anonymize this information within 90 days, and we never sell your information.

Specific to logged out cookies, they are used for safety and protection, including identifying spammers and phishers, detecting when somebody unauthorized is trying to access your account, helping you get back into your account if you get hacked, disabling registration for a under-age users who try to re-register with a different birthdate, powering account security features such as 2nd factor login approvals and notification, and identifying shared computers to discourage the use of ‘keep me logged in’.

Regardless of why Facebook is keeping the information stored in those cookies, the information is still there and able to be exploited, according to Catalin Cosoi, head of Online Threat Labs for security software firm BitDefender.

“In the past, third-party groups could gain access to a users information regardless of if they were logged in because it revealed their individual token,” Cosoi said, who said he’s not certain that the cookies could be exploited in the same way. “But the fact that Facebook’s cookies retain some information… it’s certainly one more thing to consider given all of (Facebook’s) other changes announced at f8.”

BitDefender published a list of major security concerns that Facebook’s new OpenGraph platform presents. For instance, Smart Lists — lists based on a single identifying detail (like location, school, employer) that are automatically collected by Facebook — will make it much easier for data thieves to target users. Facebook’s new Timeline profiles present the same problem — giving scammers a hyper-detailed description of you life.

“For an attacker who wants to target a specific group of individuals, it makes his job a lot easier since you already have them clustered,” Cosoi said, adding that someone could pose as a member of a particular social group and gain access to all the other account info.

From there, Cosoi said compromised accounts would turn into spam bots that could theoretically pollute Facebook’s new real-time activity ticker. Also, Facebook’s new subscribe feature could increase the number of spambots — giving Facebook a problem that’s similar to what Twitter has to combat with its own subscription-based service.

With the increased ability to track a persons activity on a timeline, arguably one could make a case for Facebook’s cookie storing practice — especially if the account data is being used to make sure data thieves don’t gain access to an account and not for ad targeting. But it’s clear that Facebook users are a bit apprehensive about the idea of Facebook storing information that they have little control over.

July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

Why is Apple tracking the locations of iPhone and iPad users? The reason is probably less Big Brother and more Big Glitch, according to blogger John Gruber.

Gruber’s source told him that the much-maligned tracking file is just a cache for location data, and that the historical data isn’t being cleared due to a bug or an oversight. But the source didn’t downplay the implications of the issue, according to what appears to be a fragment of an email from Gruber’s “little bird”:

“But still! What a nervous can of worms. This is an open, unlocked file in a known location in a standard database format that anybody can read. If someone has physical access to your Mac — or remote access to your user account — it’s a simple matter of copying a file and opening it. And while the logfile can’t tell someone that you were at a specific house, it can obviously tell your boss that you went to the Cape on the day you called in sick.”

Developers Alasdair Allan and Pete Warden brought the tracking issue to light yesterday at the Where 2.0 conference in San Francisco. Allan said he stumbled upon the tracking file while looking at iTunes backup files on his computer. The file contained thousands of datapoints of geographical coordinates and timestamps.

For a video of Allan and Warden discussing their discovery and its implications, check out our coverage of yesterday’s announcement.

[Steve Jobs image via acaben/Flickr]

July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

Still afraid of evil websites tracking you and stealing your information? Angel investor Dave McClure says Disconnect is the browser extension for you.

Chrome and Safari extension Disconnect, which blocks websites from tracking users and sending private information to other sites, launched today at the Launch conference in San Francisco.

The extension automatically stops pictures, icons and pixels on websites that send information to other sites from loading. Once installed, it adds a button next to the address bar that indicates how many sites have been blocked by the extension. Users can click on the icon to find out what types of sites Disconnect blocked from tracking them.

Icons and pictures that send data to other sites are deleted from the site and replaced by a blue color block. That even includes tiny tracking pixels. Users can click on the color block to allow loading of the tracking images and content instead of having to disable the extension.

But the judges at Launch said the best market for Disconnect was the swath of web browsers that are captured by fear-mongering by some media outlets. McClure said the company should capitalize on the movement to improve privacy settings on large sites like Facebook and Twitter in order to market the service.

“You’ll never go broke underestimating the C-minus students, those searching for answers” said movie star and judge Kevin Pollak. “It used to be, ‘if it bleeds it leads,’ and now it’s all fear based — how do you protect, how do you protect.”

The company is moving toward creating some premium services in order to monetize it, but for now the extension is free. There weren’t any additional details about what kind of premium services might come out. Internet Explorer 9, however, already offers a “do not track” option, and those features are probably coming to other browsers as well.

San Francisco-based Tynt works with online publishers and websites to track and analyze data about the sharing activity of their users.

It currently claims 600,000 online publishers and websites, which track the sharing activity of a combined 1 billion unique users.

The four new tools, dubbed Tynt Keywords,Tynt Social, Tynt Content and Tynt Publisher API, were created to help publishers find where their content is most popular on social networking communities.

They will also be able to track what words are driving traffic to and from their site.

Tynt Keywords tell publishers what searches and keywords are bringing readers to the site and, perhaps more importantly, what searches and keywords are causing users to leave.

Tynt Social allows publishers to view where their links and content go when they’re shared, helping them understand what specific content is gaining the most traction.

Tynt Content is designed for writers and editors specifically and provides information about the content and keywords that users are most likely to respond to positively.

The Tynt Publisher API gives publishers access to the data on their dashboard in whatever format they choose. Publishers can now use one dashboard to tell Tynt that they want their data through an API and reciting their unique publisher code.

The company has been busily expanding its product offerings and reach over the last six months.

It recently unveiled its new Content Discovery feature, where visitors can see top stories, popular search terms and images of in the sections of celebrity, how-to, New York, sports, technology and travel.

It also simultaneously announced its new Geo-location service, which shows the specific areas, images, search terms and stories that people in New York are most closely following.

Tynt raised $8 million in private equity from 11 Silicon Valley investors led by Panorama Venture Capital in April.