The U.S. Congress has passed the repeal of the broadband carrier privacy rules that required ISPs to seek consumer consent before selling Web browsing and app usage data to advertisers. The law was approved by the Obama administration and scheduled to take effect by the end of this year. It means that ISPs are legally entitled to sell their users’ browsing history to the highest bidder by default and without requiring permission.

Of course, free services like Google and Facebook have been doing this for years but people pay for a broadband connection. That makes it quite a bit different. While ISPs should provide an opt out, the measure erodes any vestige of privacy for surfing. People who are not reasonably tech-savvy may be totally unaware of the new playing field and fall victim by default.

So What Can You Do?

The usual precautionary measures such as clearing browser history and deleting cookies, setting browser to incognito or private mode, or installing software designed to prevent tracking by advertisers are rendered ineffective since your browsing sessions take place via servers and network of the ISPs. Instead, here’s a list of viable solutions to prevent an ISP from selling your Web data:

1. Apply to opt out

ISPs should provide this option. If not, users should contact them. It’s not exactly ironclad because many ISPs are vague about exactly how they track the online activity of their subscribers. The FCC fined Verizon $1.35 million last year because it neglected to tell smartphone users that it was using “supercookie” technology to track their browsing habits, regardless of privacy settings, and did not initially provide an opt-out.

2. Switch to a different ISP

Not all ISPs will implement this legal data sharing opportunity. Some smaller ISPs actually protested against the repeal. Changing ISPs may be easier said than done for users in rural locations where choice is limited or non-existent. However, expect some ISPs to develop a non-sharing policy as a marketing strategy. Watch this space.

3. Invest in a VPN

A Virtual Private Network is like an encrypted tunnel between a computer or phone and the Internet. In theory it guarantees privacy but not all VPNs are equal. Buyers should perform due diligence by way of researching expert reviews. That One Privacy Site is an excellent review and monitoring service run by a knowledgeable enthusiast for the tech and privacy savvy individuals. It’s probably best to avoid the free services because, who knows, maybe they might as well sell the browsing history of their subscribers. After all, they must generate revenue somehow. A VPN will slow down surfing and users may not be able to view high quality video streams on Netflix, for example.

4. Use Tor

Tor supplies a browser and service that hides your location and conceals your surfing activity so that it cannot be tracked. There are many thousand computers, called relays, in the Tor network, all provided on a voluntary basis by fans of the service. The service bounces the web traffic of its users between several of these relays on a random basis. Like a VPN, it slows surfing speeds. Also, it is for the technically minded only – or perhaps configured by a technically minded friend.

The privacy law repeal only impacts ISPs in the U.S., but the implications are applicable to Internet consumers across the world. Many countries have not enforced strict privacy laws to prevent ISPs and internet companies from freely selling consumer Web data. In this case, consumers are at their own discretion to adopt Internet privacy best practices.

Senior members of the Trump administration have resorted to encrypted communication apps amid email hacking concerns that disrupted Hilary Clinton’s presidential election campaign and exposed sensitive conversations of Democratic National Committee (DNC) members to WikiLeaks.

The use of encrypted and disappearing messaging apps at the White House may violate the Presidential Records Act, which necessitates archival and retention of work related communication for transparency and litigation requirements. Trump aides are reportedly using the messaging app Signal that offers end-to-end encryption for personal communication. Maintaining a complete record of email communication at the White House is already a tough endeavor, and adding encrypted communication to the mix will only make it difficult to enforce the public disclosure laws.

At the same time, the Trump administration also fears White House staffers are using the technology to expose the government’s darkest corners without leaving a digital trail. The messaging app Confide with its SnapChat-like features of disappearing messages is allegedly being used specifically for this purpose by some U.S. government officials.

How Encrypted Messaging Works

Encryption is the process of converting information into a random and apparently meaningless data (cyphertext). Various mathematical functions or algorithms may be used to convert original data into encrypted cyphertext. The process of converting cyphertext back into its original form is called Decryption.

Modern cryptographic protocols utilize numeric codes known as Encryption Keys encrypt and decrypt the data. The Keys are available only to the sender and recipient of encrypted information. Third parties including hackers, government agencies, Internet Service Providers and even the encrypted messaging service providers such as Signal and Confide cannot legally access Encryption Keys. Private communication between end-users therefore remains elusive and untraceable by legitimate means.

Privacy or Transparency?

The concept of secure encrypted messaging is widely popular and appreciated for personal use, even in the White House. Regulations that necessitate data retention apply only to work-related communication that involves senior government officials to ensure transparency. To enforce public disclosure laws for communication that takes place via end-to-end encrypted messaging apps, the government will also need decryption keys to make sense of the encrypted data archived by the sender and recipient. To make matters more complex, apps such as Confide go a step ahead with disappearing messaging features that prevent users from archiving or even taking screenshots of the communication.

Third-party encrypted communication apps are skewed toward privacy, to a point where end-users cannot be held accountable for their communication, since the paper trail is entirely inaccessible and eliminated. In a public office or collaborative workplace, excessive privacy compromises transparency. The concerned authorities should therefore remain on top of the communication technologies used by employees and may need to regulate the use of end-to-end encrypted communication apps for work purposes. The tradeoff between privacy and transparency will emerge as a pressing need of the corporate world in response to rapid adoption of encrypted communication technologies by security-aware end-users.

About 700 million Android phones were sending the contents to a server address in China every 72 hours. The owners of the phones had no idea it was happening. The data known to be extracted included:

• Location information (where you were, at all times)
• Call logs (who you spoke with)
• Text messages (including deleted messages)
• Contact lists

The backdoor was in the firmware in a chip of a component part that was supplied to a large number of Asian phone manufacturers and at least one American one. It was only discovered when a security analyst bought a $50 infected phone for testing and noticed an unusually high level of network traffic when he powered it up.

Was this a one-off occurrence?

Roughly 5 to 6 new Android phones are released by manufacturers on the worldwide market every day on average. The greatest growth surge is in the Asian market where there is a proliferation of extremely cheap devices. Intense price competition means that manufacturing costs must be kept low, which invites supply of the cheapest components whose cost may be secretly subsidized by an interested party. The company involved, Shanghai AdUps Technology, supplies software to phone component manufacturers that can also remotely install apps on a smartphone and update them on demand.

Just how private is my phone’s data?

Forget any notion that a simple passcode keeps your phone data confidential. There are companies, many of them, who specialize in developing and selling equipment that can crack most any phone’s security and suck out the data contents in seconds. Those companies sell that hardware to government security agencies like the FBI and NSA both domestic and foreign, police forces, corporate clients, and most anybody who can pay the price. They may present a veneer of ethics by checking the credentials of potential clients but that is a flimsy defense against allowing the equipment to fall into the “wrong hands”. That is in addition to the shadier activities of software and component suppliers like the China company.

Why would they want my information?

A state actor would have zero interest in the phone data of the average person – only of individuals with access to facilities, organizations or activities (including criminal) of interest to them. The biggest usage by far is in the field of Big Data that is used for marketing or product development purposes by manufacturers and software system vendors. That is the purpose that the Chinese company said was behind their theft of phone data. But don’t for one moment think that a government agency would not suborn that data if the need arose.

How can it be justified?

All nation states have their own specific security interests and prioritized list of targets. They can use the excuse of national security, counter-terrorism, policing criminal activity, or any other rationale they choose. History is littered with examples of government agencies acting outside the law in most any country you choose to name. The Internet enables state actors to easily access any other state, attempt to hack into its agencies, government departments, defense contractors, banks, and even the general population as evidenced by the China mass phone hack.

Why is it so important?

Some people naturally think “what the heck – I don’t care because nobody would be interested in my boring old texts etc.” But that misses the point. Privacy is as vital a concept as freedom of speech or the right to vote. Just because you don’t bother to vote does not mean you don’t care about that freedom or right. Erosion of personal rights is a characteristic of despotic states. Any weakening of those rights and freedoms is a move in that direction.

You may not have heard of the Google Brain team. They are a pretty fringe department, based out of Mountain View, California. Google Brain is, as the name suggests, all about A.I. development. Specifically, A.I. functionality achieved using neural networking.
Recently Google Brain took it’s 3 resident neural networks named Eve, Bob and Alice and gave them a little problem to work on. Alice was instructed to encrypt and send a message to Bob. Bob was instructed to decrypt the message from Alice. And Eve was instructed to try and snoop on the message. Alice and Bob were each given the same unique key to use as the encryption key for the message.
That’s it. They were not given any information or data on cryptography. They had to work from scratch, building their own cryptography algorithms. Over several runs of the test, Alice could develop a cryptography technique that Bob matched, and decoded the message. Eve managed to partially snoop on the message on several occasions, which only resulted in both Bob and Alice improving their cryptography algorithms!
Sci-Fi sexiness aside, the big takeaway here is that these neural networks invented cryptography algorithms that the operators didn’t understand. They were truly groundbreaking.

The Human Weakness in Cryptography
So far, the Google Brain team have managed to work on symmetric encryption of data. The current state-of-the-art in this field, that was designed by humans, is still AES. Provided the key is kept secret and side channel attacks are mitigated, AES is regarded as impossible to break with today’s technology, and when used with a 256 bit key, AES-256 is regarded as secure against tomorrow’s quantum computers.
However, the weakness is still key management. Us mere humans need to manage and secure our encryption keys. This means physically storing them somewhere and involving physical security, and also protecting physically stored keys with passwords. In the entire mathematical scheme of things, it’s the human factor that remains the weakest point.

Where to from here?
Is it possible that a computer can design a better cryptosystem than humans?
At first glance, this seems like something out of a Sci-Fi movie, but other areas of machine learning have seen machines become as competent if not better than humans. In 2014, the DeepFace project at Facebook achieved a level of facial recognition on par with that of humans, and automated facial recognition machines are commonplace at immigration desks in airports around the world, replacing human agents. Self driving cars are now safer than human drivers, with Elon Musk foreseeing a future where manual driving will become illegal..
In the view of the author, AI cryptography does have a long way to go. In particular, current “human” cryptography allows cryptographers to provide mathematical proofs of security. The challenge with AI is that no one understands how it works – so is provable security possible?