This text is a component of a collection on company surveillance, highlighting civil liberty, privateness, cybersecurity, security, and tech-product consumer exploitation threats related to related merchandise which are supported by the Android (Google) OS, Apple iOS, and Microsoft Home windows OS, smartphones and their dangerous results.
On account of the proliferation of smartphones and bring-your-own system packages, many companies, main firms, authorities entities (together with the army), regulation enforcement businesses, well being care suppliers, authorized professionals, and journalists have adopted smartphones to make use of professionally.
Nevertheless, are smartphones safe sufficient to make use of inside a confidential and guarded surroundings corresponding to the protection business, enterprise enterprise, authorities, well being care, essential infrastructure, and the authorized career?
The reply to this query is not any. That’s based on an admission made by T-Cellular, per a Federal Communications Fee (FCC) formal shopper grievance that I filed towards T-Cellular in July 2015.
T-Cellular has admitted that smartphones which are supported by the Android and Apple working techniques (OS) aren’t personal or safe varieties of telecommunications and computing, as a result of of preinstalled surveillance and data-mining know-how developed by Google and Apple.
Don’t take my phrase for it. T-Cellular explains it higher than I can:
“We, too, remember a time before smartphones when it was reasonable to conclude that when you activated service with T-Mobile that only T-Mobile would have access to our personal information. However, with the Samsung Galaxy Note, the iPhone, and many other devices, there are indeed a variety of parties that may collect and use information.” —T-Cellular Privateness Staff (FCC Shopper Grievance #423849 filed by Rex M. Lee/public report)
In March, I contacted Verizon and requested if Verizon might promote me a personal and safe smartphone, pill PC, or perhaps a flip telephone. After three months of vetting Verizon’s options, I concluded that Verizon couldn’t promote me a personal or safe smartphone, pill PC, or flip telephone.
Shockingly, Verizon agreed with my conclusion, which additionally validates the T-Cellular admission. Nevertheless, Verizon admits that Android, Apple, and even Microsoft OS-driven smartphones, pill PCs, and flip telephones aren’t personal or safe as a result of of preinstalled surveillance and data-mining know-how that not even Verizon can management, disable, or uninstall.
Verizon admission: “We have reviewed your request at the highest levels of our organization and have confirmed that the only solutions to make a phone private and secure are available through third parties, not directly from Verizon. … Additionally, Verizon is not equipped to address preinstalled solutions or applications on any device.”—July 2 e-mail to Rex M. Lee
Moreover, Android, Apple, and Microsoft OS-supported smartphones, pill PCs, related merchandise, and PCs are additionally supported by intrusive and exploitative factory-installed content material developed by corporations resembling Amazon, Fb, and Baidu (a nation-state Chinese language firm/Android content material developer).
My analysis and evaluation point out that such merchandise aren’t personal, safe, or protected sufficient to make use of inside a confidential and guarded surroundings as a result of all merchandise involved are enabled to help indiscriminate surveillance and data-mining enterprise practices rooted in surveillance capitalism.
It’s protected to conclude that smartphones, pill PCs, flip telephones, related merchandise, and PCs plus voice automated assistants are deliberately designed for consumerism. Because of this the factory-installed content material that helps all merchandise involved is deliberately designed to allow the OS and content material builders with the capability to watch, monitor, and data-mine the product consumer for monetary achieve, even at the expense of the product consumer’s privateness, cybersecurity, and security.
The merchandise aren’t protected to make use of as a result of the collective phrases of use that help the merchandise don’t indemnify (shield) the product consumer from hurt, even when the consumer’s private and professional info is utilized in a negligent method, corresponding to the Fb/Cambridge Analytica scandal.
Because of this related merchandise corresponding to smartphones and pill PCs aren’t personal, safe, or protected sufficient to make use of inside a confidential and guarded surroundings that’s ruled by confidentiality agreements (employment), nondisclosure agreements (NDAs), business and federal cyber-security requirements, federal info processing requirements (FIPS), and confidentiality legal guidelines.
All of which means when an individual makes use of a smartphone or pill PC that’s supported by surveillance and data-mining enabled know-how for official enterprise, the product will leak confidential and guarded private and professional surveillance knowledge (e.g., location knowledge) and delicate consumer knowledge (digital DNA) to quite a few unauthorized third events similar to content material builders.
Unauthorized third events embrace Google, Apple, Microsoft, Samsung, Amazon, Fb, Baidu, and different telecom and tech suppliers answerable for the improvement of the OS, plus the intrusive and exploitative preinstalled content material that helps the merchandise.
At this level, many individuals that I’ve mentioned these issues with convey up cellular system administration (MDM) and safety options as a way to denationalise and safe related merchandise corresponding to smartphones and pill PCs.
Let’s check out MDM and safety options to see if stated options can privatize and safe a smartphone or pill PC.
MDM and Safety Options
My analysis signifies that it’s unattainable to denationalise and safe a smartphone, pill PC, or related product supported by the Android OS, Apple iOS, or Microsoft Home windows OS, as a consequence of preinstalled surveillance and data-mining know-how developed by all events involved.
My analysis additionally signifies that factory-installed and third-party MDM and safety options gained’t forestall Google, Apple, and Microsoft from amassing private and professional digital DNA from a consumer’s smartphone, pill PC, or related merchandise generally, together with PCs that help stated options.
For instance, the software permission statements that help the preinstalled Android Samsung Knox safety app allow Samsung plus all affiliated content material builders, reminiscent of Google, to indiscriminately acquire surveillance knowledge and delicate consumer knowledge from the Samsung Knox app consumer.
See the Android Knox app permission evaluation under for a Samsung Galaxy Observe smartphone supported by the Android OS:
(Rex M. Lee)
The so-called Android Knox safety app is granted greater than 60 extremely intrusive permissions, which signifies that Samsung, plus all related affiliated content material builders, is enabled to gather almost 100 % of the Knox app consumer’s private and professional digital DNA from the Galaxy Notice smartphone.
My analysis signifies that the Android Knox safety app may be categorized as a predatory surveillance and data-mining app.
Moreover, the Android Knox app that I analyzed is supported by a Fb interactive software permission command string, implying that Google and/or Samsung are enabling Fb to gather the consumer’s private and professional digital DNA by way of the Knox safety app, additional validating that the app is predatory in nature.
Per the formal buyer complaints that I’ve filed with AT&T, T-Cellular, and Samsung, I’ve despatched my Galaxy Notice smartphone phrases of use and factory-installed content material studies to AT&T, T-Cellular, and Samsung on a number of events to verify all of my findings.
AT&T, T-Cellular, and Samsung have but to deal with the complaints, info, considerations, questions, and smartphone reviews that I’ve submitted to them courting again to 2015, which is shocking as a result of I paid for all merchandise involved. That signifies that I’m a paying buyer identical to you.
Now that we will safely conclude that smartphones and pill PCs supported by surveillance and data-mining enabled know-how aren’t personal, safe, or protected sufficient to make use of inside a confidential and guarded surroundings, let’s evaluation confidentiality legal guidelines plus telecom legal guidelines related to protected (due course of/Fourth Modification) telecom infrastructure ruled by the FCC.
The evaluation of present legal guidelines will assist validate if, the truth is, smartphone and pill PC customers plus OS builders and content material builders may very well be breaking present legal guidelines plus violating authorized agreements and cybersecurity requirements related to confidential and guarded telecommunications, info, and knowledge.
Confidential and Protected Telecommunications and Infrastructure
In my skilled profession, I’ve but to assessment a confidentiality settlement, NDA, business or federal cybersecurity normal, FIPS, or confidentiality regulation that makes an exception for telecom and tech suppliers reminiscent of AT&T, Verizon, T-Cellular, Dash, Google, Apple, Microsoft, Samsung, Amazon, Fb, or Baidu.
It’s unlawful for any particular person to leak confidential and guarded telecommunications, info, or knowledge to any unauthorized third get together, which would come with all telecom and tech suppliers involved.
Moreover, additionally it is unlawful for any unauthorized third social gathering (reminiscent of telecom and tech suppliers) to gather, use, share, promote, buy, and combination any confidential and guarded telecommunications, info, and knowledge collected from a telecommunication subscriber (particular person/enterprise/authorities entity) or approved system consumer (worker) with out correct authorization.
Smartphones and pill PCs are not any much less vital than a house or workplace telephone or PC that’s supported by protected (due course of/Fourth Modification) telecom infrastructure ruled by the FCC inside the United States.
Because of this smartphone and pill PC customers are additionally protected by the similar telecommunication and shopper legal guidelines that shield house and workplace telephone and PC customers from unwarranted and unauthorized surveillance and data-mining carried out by state actors, people, or corporations.
For instance, if Google, Apple, or Microsoft have been state actors, they would wish to acquire a warrant from a home decide or a U.S. Overseas Intelligence Surveillance Courtroom (FISC/FISA) to conduct lawful surveillance and data-mining on U.S. telecommunication subscribers and approved system customers.
Word that Baidu is, the truth is, a nation-state actor (of China) regarding U.S. telecom subscribers and approved gadget customers.
The Federal Commerce Fee, FCC, Division of Justice, Division of Homeland Safety, state attorneys basic, and related businesses want to research if present civil liberty, telecommunication, and shopper legal guidelines are being violated by Google and Baidu with regard to intrusive Android and Baidu content material, comparable to the Baidu net browser and Android Baidu apps that help smartphones (mentioned additional under).
Moreover, people or personal corporations should search the authorization from the telecom subscriber or approved gadget consumer as a way to conduct surveillance and data-mining on the telecom product consumer by approach of the consumer’s smartphone or pill PC.
By method of software legalese, akin to app permissions, a person can’t lawfully grant an unauthorized third social gathering (e.g., Google, Apple, Microsoft) the means to gather confidential and guarded telecommunications, info, or knowledge from a smartphone or pill PC that’s supported by protected telecom infrastructure ruled by the FCC.
The truth is, the smartphone or pill PC consumer, plus the unauthorized third get together (e.g., Google, Apple, Microsoft), might each be held answerable for breaking the regulation or for violating any related authorized agreements and cyber-security requirements.
For instance, it might be unlawful for a smartphone or pill PC consumer to reveal confidential and guarded info related to the smartphone or pill PC to any unauthorized third get together, whether or not that third get together is a telecom supplier, OS developer, unique gear producer, content material developer, or a spy.
Use of Shopper-Grade Smartphones Is Unlawful in Confidential Environments
In line with the T-Cellular and Verizon admissions, coupled with my analysis, quite a few third events that embrace Google, Apple, Microsoft, Samsung, Amazon, Fb, and Baidu are, the truth is, enabled to gather a smartphone and pill PC consumer’s private and professional digital DNA, which might additionally embrace confidential and guarded telecommunications info and knowledge as a result of the indiscriminate surveillance and data-mining enterprise practices employed.
Based mostly on this info, one might conclude that it’s unlawful to make use of a smartphone, pill PC, voice-automated assistant, related product, or PC that’s enabled to help surveillance and data-mining enterprise practices inside a confidential and guarded surroundings, resembling the protection business, well being care, authorized career, essential infrastructure, or authorities, together with the army.
Because of this well being care suppliers, members of the army and regulation enforcement, judges, attorneys, elected officers, and even lawmakers could also be inadvertently breaking the regulation once they use a smartphone or pill PC for official use.
Moreover, individuals who use smartphones supported by surveillance and data-mining enabled know-how inside the protection business, crucial infrastructure, enterprise enterprise, and authorities could also be inadvertently in violation and/or in breach of confidentiality agreements (employment), NDAs, business and federal cyber-security requirements, and FIPS.
On account of predatory surveillance and data-mining enterprise practices, corporations corresponding to Google, Apple, and Microsoft might have ended privateness and cybersecurity as we all know it.
Organizations want to think about the funding they’re making with regard to privateness and cybersecurity related to their telecom and community infrastructure, as a result of smartphones and pill PCs supported by surveillance and data-mining enabled know-how aren’t personal, safe, or protected.
In any case, what good is a safe community if smartphones, pill PCs, voice-automated assistants, related merchandise, and PCs are unsecure on account of factory-installed surveillance and data-mining know-how developed by telecom and tech suppliers?
Who is aware of? You could be stunned to seek out out that you’re leaking your private and professional info to nation-state corporations from China similar to Baidu.
For those who don’t consider me, evaluate the put in apps that help your smartphone. You might discover the following Android Baidu app permission in your smartphone: E-mail app, Android permission: BAIDU_LOCATION_SERVICE.
I used to be stunned and horrified when I discovered this Android Baidu interactive software permission command string in a Samsung Galaxy Notice smartphone that I bought from a T-Cellular company retailer in Selma, Texas.
In Half 2 of this text, I’ll handle the proven fact that the Android OS helps intrusive content material developed by nation-state corporations similar to Baidu.
I may also handle a battle of curiosity between telecom suppliers and data-driven OS and content material builders that compete in a number of industries worldwide, corresponding to Google.
Rex M. Lee is a privateness and knowledge safety marketing consultant and an analyst and researcher for Blackops Companions. His web site is MySmartPrivacy.com
Views expressed on this article are the opinions of the writer and don’t essentially mirror the views of The Epoch Occasions.