National

Axios Login

For years, we've known that the phones we love and are glued to also record our locations, faces, and fingerprints. And we've understood that the same sensors that serve our individual needs could also, theoretically, be used to conduct surveillance on us.

Driving the news: It's increasingly clear that things have moved from the theoretical to the real, as a pair of reports in the New York Times underscores.

1. One article details how law enforcement in the U.S. has been making use of a trove of location data assembled by Google, called Sensorvault, that helps find both suspects and witnesses to crime.

"Anytime a technology company creates a system that could be used in surveillance, law enforcement inevitably comes knocking," writes NYT's Jennifer Valentino-DeVries.

"Sensorvault, according to Google employees, includes detailed location records involving at least hundreds of millions of devices worldwide and dating back nearly a decade."

2. The other piece describes how China is using facial recognition to identify and take action against its Uighur Muslim population.

The AI-based system, which uses surveillance cameras in public places rather than phones, tracks the minority population's members not only in their home province but when they travel in other Chinese regions.

"Using algorithms to label people based on race or ethnicity has become relatively easy," writes NYT's Paul Mozur. "But China has broken new ground by identifying one ethnic group for law enforcement purposes."

Meanwhile, marketers are also stepping up their use of location data to deeply target advertising, as Axios' Sara Fischer reports.

Google has already started to build the next phase of its advertising business around its ability to track users' location in real time. 

The company is beefing up the ads served via its real-time navigation app Waze. Waze announced last month that it's parenting with ad giant WPP (via its ad-buying arm GroupM) to help Waze develop new ad formats.

In a pitch deck revealed to Digiday last month, the company expanded on its efforts to sell such ads. It said it would sell ads that try to convince drivers to alter their routes by using things like "branded pins" that would guide drivers to nearby stores or restaurants.

It has also begun publicly talking about its next big moneymaker: maps. Rajas Moonka, director of product management for Google Maps, told Bloomberg last week, “We want to be able to highlight things that are around you and surface them nearby to you in a way that’s not disrupting your experience."

Why it matters: This data can be used for purposes that some might identify as good and others might find objectionable. But it's most definitely already being used, ever more widely, while our legal systems and personal understandings lag far behind.

Our thought bubble: It's (past) time to start making rules for how this information can and can't be accessed and by whom.

Go deeper: AI surveillance goes to school

From China to the U.S., sensor surveillance gets real

From location tracking to facial recognition, the theoretical is happening now.

Technology

Surveillance

World

From the Valley to D.C., Big Tech players like Facebook, Google and Amazon are under more scrutiny than ever as new technology develops and privacy and antitrust concerns grow in lockstep with companies’ ambitions.

As nationalism rises around the world, globally minded tech companies are finding their businesses increasingly hemmed in by association with their home countries.

The big picture: The bonds of international trade that for decades were viewed as a key driver of economic growth are instead coming to be seen as national security risks — by the U.S. as well as many of its trading partners.

The U.S. has long raised questions about Chinese companies, especially Huawei and ZTE, over espionage risks. Objections over Huawei, in particular, have increased, with the U.S. bringing criminal charges against both the company and top executives.

National security concerns have also surfaced over U.S. companies acquired by Chinese entities, such as gay dating site Grindr.

Russia's Kaspersky Lab is trying to overturn a ban on federal purchases of its software in the U.S.

U.S. companies can face similar concerns abroad, especially in Europe, where both security and antitrust concerns have been raised about U.S. tech companies.

Between the lines: U.S. policymakers often argue that fragile laws in countries like China and Russia won't protect companies' customers, data, and intellectual property from demands made by authoritarian governments — and there's plenty of evidence and examples to support that view.

The Snowden revelations about NSA surveillance showed how closely U.S. tech firms work with their own government.

Facebook's Cambridge Analytica scandal showed how poorly some U.S. firms protect their users' data.

That has left American companies facing an uphill battle to claim high ground in this realm.

Context: Judging companies on where they're based and what motives they might have beyond commercial interests is part of a larger shift in thinking, says Robert D. Atkinson, president of the Information Technology and Innovation Foundation.

"We went through about a 20-year idealistic period where the 'One Worlders' believed everything would be this one giant global market with massive free trade and everything will be great," Atkinson said. "It turns out that's a myth. Really what we have now are competing blocs."

Sen. Marco Rubio (R-Fla.) told Axios in a statement that Chinese companies should be viewed as agents of the state.

"In China, companies like Huawei and Hikvision willingly advance the authoritarian regime’s goals, yet here in America, we can't even get Apple to crack open an iPhone for the FBI to investigate a terrorist attack."

In a Washington Post op-ed, Sens. John Cornyn and Tom Cotton made the case for keeping China out of 5G networks in Europe.

Laura Rosenberger, director of the Alliance for Securing Democracy, said the controversies are about more than just the location of a company's headquarters.

"I don't think it's that companies should be viewed based on their home countries, but rather that ... those companies' relationships with the state and the laws that govern them are important to understand and — in the case of Kaspersky, Huawei and ZTE — have direct implications for national security."

Nationalist concerns are splintering global tech

Amid gowing concerns about what foreign companies will do with data.

Computer screens with the Russian, Chinese and American flags on the monitor

Nationalism

Chicago's extensive web of surveillance cameras was key to law enforcement's success in tracking down Jussie Smollett's two co-conspirators, who helped the "Empire" actor stage an allegedly fake hate crime for which he has since been charged, the AP reports.

Details: By leveraging Chicago's colossal camera network — which has more than 32,000 cameras on buildings, poles, buses and even some private residences (with the owners' permission) — detectives were able to track the men's movements after the attack. Investigators used footage from the men's cab — whose driver they also interviewed — and following the vehicle "along a trail of cameras" to Chicago's North Side. They also reviewed "telephone logs, ride-share records and credit card records" as evidence to bring charges against Smollett.

How Chicago police cracked the Jussie Smollett case

Chicago has the most extensive video surveillance network in the country.

Epire actor Jussie Smollett leaving Cook County jail. Photo: Nuccio DiNuzzo/Getty Images

U.S. News

Chicago

The New York Times reports that experts from the U.S. played a role in the Chinese government's use of DNA samples to keep tabs on its Uighur population — the largely Muslim ethnic group whose members the government has also forced into camps.

The big picture, per the NYT: Almost 36 million people took part in a DNA testing program in Xinjiang, the part of China where the government's campaign against Uighurs is most pronounced. Many Uighurs were coerced into giving the samples.

An American company, Thermo Fisher, supplied the equipment the Chinese government used to conduct the testing, per the Times. Those tests weren't used for health screenings, as advertised, but as part of an effort to keep track of the ethnic minority population. 

China accounted for 10% of the company's business in 2017, and American officials have criticized the company previously for its willingness to sell China equipment that could be used for tracking and monitoring.

Thermo Fisher said this week that it would stop selling equipment in Xinjiang, but not the rest of China.

China also relied on DNA samples from Yale geneticist Kenneth Kidd to help perfect its technology and prove that it could effectively use DNA to identify Uighurs.

Kidd told the NYT he didn't know that had happened, and that he was "not particularly happy" with the way his data had been used.

Go deeper: Uighur detentions in China get global attention

U.S. firm aided Chinese DNA collection of Uighur Muslims

Many Uighurs, who are being detained in "re-education camps," were coerced into giving DNA samples.

In this image, a Uyghur woman in a black shirt holds a Chinese flag above her as she walks down the street on a cloudy day.

A Uighur woman holds the Chinese flag. Photo: Guillaume Payen/SOPA Images/LightRocket via Getty Images

Science

A new breed of intelligent video surveillance is being installed in schools around the country — tech that follows people around campus and detects unusual behaviors.

Why it matters: This new phase in campus surveillance responds to high-profile school shootings like the one in Parkland, Florida, last February. School administrators are now reaching for security tech that keeps a constant, increasingly sophisticated eye on halls and classrooms. One drawback: a major blow to student privacy.

Background: Schools are experimenting wildly with technology in order to secure students, deploying facial recognition, license plate readers, microphones for gunshot detection and even patrol robots.

At a news conference today, officials in Broward County, Florida — where Parkland is located — announced that they have spent more than $11 million on security cameras over the past year.

Read this fact: There are now more than 12,500 cameras in Broward County schools, said Superintendent Robert Runcie, and the district signed an agreement this week to share real-time video with the county sheriff's office.

Now, the school district is considering buying a next-generation surveillance system for more than $600,000, the South Florida Sun Sentinel reports.

The tech the district wants is benignly branded "intelligent video analytics." It's already popular with police and retailers; now, it's appearing in schools.

It represents a sea change in how video surveillance works. Where once a lone security guard would sit bored in front of dozens of security feeds, scanning for abnormal activity, unblinking artificial intelligence now monitors the videos.

It can detect unusual motion — such as a person in a hallway that is usually empty at a given time — and can search footage by peoples' appearance.

One company, Avigilon, sells these capabilities to school districts and universities, in addition to banks, hospitals and airports. Another, Pelco, announced last April that it will provide schools with an IBM version of intelligent video.

Every public school in Fulton County, Georgia, will soon include Avigilon tech, according to a flyer posted online.

School districts in Tennessee, Montana and Missouri are listed among the company's "case studies" for school deployments.

Increased surveillance stirs up some worry among students, teachers and privacy advocates.

On an online forum for teachers, some wrote that students shouldn't be monitored — or even that they felt uncomfortable being watched — while others said footage helped to settle arguments.

In an October town hall meeting, UCLA students raised worries about breaches of privacy, according to the university's student newspaper.

"We often see new surveillance technologies first applied to populations that are not going to object: prisoners, children, immigrants," the ACLU's Jay Stanley tells Axios. "You have to ask whether you want to raise a generation that is used to growing up in environments where they're electronically monitored by AI agents."

Kenneth Preston, a Broward County high school student, says he supports surveillance tech that excludes facial recognition. (Broward County says it's not installing facial recognition.)

But technology should be an "absolute last precaution," he tells Axios.

Preston, who has been deeply critical of the county and school district, calls for a better system in which teachers and counselors identify threatening students in advance, rather than technology that helps to solve a crime after the fact.

Just east of Nashville, in Wilson County, Tennessee, schools are brimming with security tech. Several schools have cameras in every classroom, teachers have panic buttons at hand, and students' online communication is monitored 24/7.

"We're like every other school district" trying to keep students safe, says Jennifer Johnson, a spokesperson for the school system. "We're just throwing darts at the wall to see what sticks."

AI surveillance goes to school

The same systems used in banks and airports are appearing in schools — and not without controversy.

Illustration of school desk with various objects highlighted and identified

Future

A new report shows that a military contractor has likely sold spyware to repressive regimes. But the study's authors and other experts differ on how to stop the problem.

The big picture: That study, released Tuesday by the University of Toronto's Citizen Lab, found that 36 surveillance networks used commercial militarized spyware made by the Israeli NSO Group.

Many countries operated more than one network, and six of the suspected countries — including Bahrain, Kazakhstan and Saudi Arabia — had histories of using spyware to target dissidents, journalists and other civil targets. 

Some uses veered toward the petty: One cluster of infections hit supporters of a soft drink tax in Mexico. 

NSO is far from the only spyware maker that sells its tools to countries that might be repressive.

It happens often enough that companies follow the same script. “They say, ‘We only sell to law enforcement. We’re self-regulating,'" says Bill Marczak, the author of the Citizen Lab report. "But if this wasn’t being used to target civil society, it would never cross our desks.”

We can't get rid of the industry altogether. Lots of countries use commercial spyware for legitimate purposes. The study's list includes the U.S. and Canada, and the new U.S. strategy for military cybersecurity released earlier this week calls for more use of "off-the-shelf" hacking tools. 

Citizen Lab's solution: regulation. “The best step to keep the tools in line would be a process of export controls with humanitarian restrictions rather than just defense and national security ones,” says Marczak.

Yes, but: The security industry is still stinging from the last time a powerful group of countries tried to do just that. 

The nations of the Wassenaar Arrangement, an arms export pact that includes the U.S., EU and others, tried to use that agreement to slow the spread of commercial malware to repressive regimes in 2013. 

The move was ultimately a disaster. Poor definitions in the agreement inadvertently applied limits not just to spying tools, but to research into spying tools, security testing software and other products that might need to replicate something bad to accomplish something good. Researchers — and Congress — rebelled. 

Katie Moussouris, a cybersecurity expert brought in by the State Department to renegotiate the Wassenaar Arrangement, says, "We’ve already seen for 20 years that export controls on software have been hard to do with surgical precision."

Moussouris, the CEO of Luta Security, says better alternatives might include sanctions against misbehaving countries or intervention under the military's new cyber strategy.

The bottom line: There are no easy fixes.

 "Stopping humanitarian abuses is something I think we as human beings typically support," says Moussouris. But there isn't any consensus on how to do that, safely, given the lessons learned the last time nations tried.

When governments turn spyware on citizens

A military contractor has likely sold spyware to repressive regimes.

Protestor holding up a canister of tear gas

Protesters in Cairo use cell phones to photograph a tear gas container in 2011. Photo: Karimphoto via Getty Images

Researchers at Tenable announced Monday a security flaw in the firmware of network video recorders made by NUUO that could allow hackers to delete or modify surveillance videos or turn off surveillance entirely. It is not yet patched, although Tenable claims a patch might be available tomorrow. 

Why it matters: NUUO makes hardware that records and manages security camera footage. The company's product integrates with more than 100 different camera brands. 

The technical details: The vulnerability, which Tenable has dubbed "Peekaboo," is a firmware-level problem allowing for remote code execution. 

The bug is what's known as a buffer overflow, where an attacker sends more data than a computer is designed to receive, leading the computer to inadvertantly store the leftover data as commands the computer will later run. 

The company posted a blog with more information and a tool to determine whether systems are vulnerable.

Why announce before a patch is available? There is always a concern when researchers announce vulnerabilities before a patch is available that hackers might use that information to take advantage of unpatched systems. 

Researchers often give a deadline for a company to show progress in developing a patch before announcing a vulnerability to the public to incentivize manufacturers taking vulnerability reports seriously. 

In this case, Tenable alerted the media after giving NUUO 105 days to announce a release date for a patch (Tenable gives a deadline of 90 days). NUUO only announced the patch early Monday, after the media had already been notified.

"We believe that, thanks to our disclosure the vendor released the patch," Renaud Deraison, co-founder and chief technology officer at Tenable, told Axios. 
 

Unpatched security problem affects surveillance video recorders

The vulnerability in NUUO systems would give attackers the ability to delete or alter stored video.

Photo: Omar Marques/SOPA Images/LightRocket via getty

Cybersecurity

Jolted by rising suicide and self-injury among young Americans, schools are using software to monitor student browsing history and logs for signs of distress, in what they hope will curb the problem.

What's going on: Kids and teens increasingly rely on the internet to answer their mental-health questions, creating browsing patterns that schools hope could identify potential harm before it happens. But that requires sweeping online surveillance that critics say could leave a lasting mark on students.

The context: Between 2006 and 2016, the suicide rate for white children rose 70%, to more than five per 100,000 children, according to the CDC. The rate for black children increased 77%, to 2.62 suicides per 100,000 children.

The details: Many monitoring tools are on the market, including one by GoGuardian, a Los Angeles-based education-tech company.

GoGuardian's early filtering products were aimed at keeping students away from online porn, Tyler Shaddix, the company's chief product officer, tells Axios.

After a student committed suicide at a school testing the software, an administrator asked whether better monitoring could have prevented it.

That led to a new system that evaluated students’ online activity for signs they may harm themselves.

At first, GoGuardian used keyword matching, a standard approach among companies like it. This generated thousands of extraneous alerts, so in its latest version — due out in October — GoGuardian has added artificial intelligence techniques that it says improves the software's accuracy.

How it works: GoGuardian installs an extension on school-issued computers running Chrome OS or Windows. When the system detects a potential problem in chat conversations, emails, Google Docs, or browsing, it sends an alert to whomever the school has designated to receive them.

With the help of mental-health experts, the company trained a machine-learning algorithm so it flags content most closely associated with potential harm, like searches for suicide methods.

The system now sends a much more manageable 2,000 alerts a week across 5 million students, within seconds of being triggered.

A human makes the final call, reading over the alert — including five minutes of browsing history before and after the incident — to decide whether or not to act.

The software can stumble either by sending sending schools unneeded messages, drowning out real flags, or by missing important signs and failing to send a critical alert.

GoGuardian CEO Advait Shinde says the system errs on the side of alerting more often, but the company refused to share stats about its software's failure rate.

Gennie Gebhart, a researcher at EFF and co-author of a 2017 report on student privacy, said companies that help monitor students are not transparent enough about the accuracy of their software.

Electronic snooping always raises weighty ethical questions, even when it’s meant to safeguard young people.

Privacy experts worry about early, all-encompassing monitoring. Gebhart said pervasive surveillance normalizes electronic snooping, and can keep kids from testing out new ideas and identities as they grow.

"This piece of software is going beyond ed-tech and toward a new kind of surveillance in the classroom," Gebhart said.

When I asked GoGuardian if students have a right to privacy, Shaddix said the benefits of monitoring "outweigh the negatives."

Go deeper: Wired reports on schools that monitor students’ social media feeds for threatening posts or cyberbullying.

Schools turn to AI to monitor students' mental health

Kids and teens increasingly rely on the internet to answer their mental-health questions.

Sixth grade students sit against a wall and work on laptops

Sixth graders at Flint Hill School in Oakton, Va. Photo: Katherine Frey/Washington Post/Getty

Education

"Federal air marshals have begun following ordinary US citizens not suspected of a crime or on any terrorist watch list and collecting extensive information about their movements and behavior," reports Jana Winter, a Boston Globe Spotlight fellow.

Why it matters: Some air marshals say it's "a time-consuming and costly assignment...which saps their ability to do more vital law enforcement work."

The details: "The previously undisclosed program, called 'Quiet Skies,' specifically targets travelers who 'are not under investigation by any agency and are not in the Terrorist Screening Data Base,' according to a Transportation Security Administration bulletin in March." 

It has drawn criticism from air marshals who have to carry it out.

"[S]ome air marshals, in interviews and internal communications shared with the Globe, say the program has them tasked with shadowing travelers who appear to pose no real threat — a businesswoman who happened to have traveled through [Turkey] ... a Southwest Airlines flight attendant [who was on duty] ... a fellow federal law enforcement officer."

One air marshal messaged another: “jeez we need to have an easy way to document this nonsense. Congress needs to know that it’s gone from bad to worse.”

A secret TSA surveillance program targets ordinary Americans

TSA agents at the security checkpoint at Fort Lauderdale-Hollywood International Airport. Photo: Joe Raedle/Getty Images

Politics

Axios Finish Line

American companies eager to enter China’s massive market brace themselves for potential intellectual property theft or forced technology transfers. But there’s another threat at play: their technology is being used for surveillance.

The big picture: China has sophisticated systems of state surveillance, and elements of these systems have long been powered by technologies developed by American companies. Beijing has used U.S. tech to surveil its citizens, violate human rights and even modernize its military.

Companies doing business in China often get caught in a web: Beijing uses its economic leverage to draw them in and then uses their technology for police-state tactics. As a result, "there are American companies enabling or complicit in major human rights abuses," says Elsa Kania, a technology and national security expert at the Center for a New American Security. 

Another concern is American universities and research institutions partnering with Chinese companies that work with state security, she says.

Thermo Fisher Scientific, a Massachusetts company, has supplied the Chinese government with DNA sequencers that it is now using to collect the DNA of ethnic minorities in Xinjiang, Human Rights Watch reports. At a Thursday hearing, Sen. Marco Rubio called Thermo Fisher's operations in Xinjiang "sick."

iFlyTek is a Chinese company that recently launched a 5-year partnership with the Massachusetts Institute of Technology. Beijing has used iFlytek’s voice recognition technology "to develop a pilot surveillance system that can automatically identify targeted voices in phone conversations," according to Human Rights Watch.

Cisco, in 2011, participated in a Chinese public safety project that set up 500,000 cameras in Chongqing, according to the Wall Street Journal.

Yahoo, in 2005, gave the personal information of a Chinese journalist to China's government. That information was used to put the man in jail. 

Tech giants, like Facebook, Apple and LinkedIn, have faced scrutiny in the past for censoring or reportedly offering to censor content in China.

"Not all of these companies realize the extent to which their activities could be exploited," Kania says.

Companies often take on projects for the Chinese government in the name of curbing crime, according to Scott Kennedy of the Center for Strategic and International Studies, but "the boundary between promoting public safety and protecting the state is increasingly blurred with these types of technologies." 

The other side: Axios reached out to all of the companies listed above. The responses we received by deadline:

Thermo Fisher Scientific: "We design our products with great care and work with governments to contribute to good global policy. We are proud to be a part of the many positive ways in which DNA identification has been applied — from reducing human trafficking to exonerating the unjustly accused."

Cisco said it "has never custom-tailored our products for any market, and the products that we sell in China are the same products we sell everywhere else ... We do not and will not supply video surveillance cameras or video surveillance monitoring software in our public infrastructure projects."

Oath, which now owns Yahoo: “We’re deeply committed to protecting and advocating for the rights to free expression and privacy of our users around the world."

LinkedIn: "[A]s we said at the time of our launch in February 2014, it’s clear to us that in order to create value for our members in China and around the world, we will need to implement the Chinese government’s restrictions on content, when and to the extent required."

"A lot of people wanted very much to believe that once China had exposure to the outside world, political liberalization would come with economic liberalization," Sophie Richardson, China director at Human Rights Watch, tells Axios. "They're getting a lot richer and a lot more powerful and no more politically liberal."

Some companies have pulled out of China of their own accord in the past. Google refused to censor its search engine in China in 2010, leading to its ouster from the country. Other companies may follow suit if they realize their technology is being misused, says Kania.

If companies cannot be held accountable by internal ethics guidelines, shareholders or users, the government may need to step in through export controls or limits on funding to researchers that collaborate with China, she says.

Worth noting: There's already a U.S. law that prohibits the export of crime-control products to China, but the sale of cameras and other dual use technologies that could be used for surveillance are not banned, reports the Wall Street Journal.

Go deeper: The rise of AI-powered surveillance

How U.S. tech powers China's surveillance state

It's another complication of doing business in China.

A surveillance camera labeled "Made in USA" is pointed at a man

China

China is becoming the most formidable rival America has faced, and the risk of confrontation with Russia, North Korea or Iran still looms. Authoritarians are rising, the chaotic Afghanistan exit revealed the limits of U.S. power, and the pandemic, climate change and other critical challenges continue to pose grave threats.

President Trump's crackdown on TikTok suggests that the U.S. government is starting to see the internet more like China does — as a network that countries can and should control within their borders.

The big picture: Today's global internet has split into three zones, according to many observers: The EU's privacy-focused network; China's government-dominated network; and the U.S.-led network dominated by a handful of American companies. TikTok's fate suggests China's model has U.S. fans as well.

Why it matters: As the global internet splinters further, the U.S. and China look set to enter a Cold War-style battle for the hearts and minds of global users and developing nations. In this fight, U.S. nationalism may make a weaker case to the world than the ideal of internet freedom and open networks that the U.S. once evangelized.

Driving the news: President Trump's threat to ban TikTok from the U.S. has fast-tracked an effort to force the video-sharing app's Chinese owners to sell it to a U.S. company (Microsoft is in talks).

Be smart: The move puts other foreign-owned companies on notice that the U.S. intends to favor American-owned businesses in the digital world. 

That's a giant break from a long-established bipartisan consensus that American interests are best served by a U.S. marketplace, online and off, managed as a level playing field.

China started this game — it was the first country to self-isolate from the global internet. 

China controls information flows inside its borders, and its "great firewall" keeps most information the government dislikes from entering the country. 

The Chinese government has ensured that its most widely used search and social services are domestically owned, and its laws now require any internet service to share data with the authorities.

Meanwhile, the EU's new privacy rules have created a different kind of internet zone  governed by a stringent set of standards for handling individual user data.

Last month, a major EU ruling struck down the Privacy Shield, an arrangement between the EU and the U.S. that enabled companies to transfer data into and out of EU nations without risk. 

Trump's crackdown on TikTok suggests that the U.S. is now adopting a more China-like perspective on what kinds of actions governments should take toward internet companies, including:

picking winners and losers among companies based on the whims of leaders;

insisting that companies make data available to the government for its needs — as Attorney General William Barr's argument for weak encryption does;

threatening to punish private platforms unless they support political leaders' preferred form of speech regulation.

Yes, but: Concerns over TikTok's willingness to share U.S. user data with the Chinese government are real.

TikTok says it keeps all such data outside of China and the reach of the Chinese government's laws. 

The U.S. is now playing by China's internet rules

China believes in nationalist control over digital networks, and increasingly, so does the White House.

Sections

Axios Local

Axios gets you smarter, faster with news & information that matters.

About

Subscribe

All Surveillance stories