Former FBI cyber agent urges all consumers to demand action on data privacy

Turmoil in the online world has been making headlines lately, whether it’s the uproar on Twitter or the ongoing effort to ban TikTok on US government systems.

As a security practitioner, I know that I should never let a crisis go to waste. We can use these heightened data privacy concerns to motivate us to take action that will have a much more lasting and holistic effect than simply banning one specific app.

Today’s digital world is a modern marvel of convenience, information and entertainment. Algorithms enable each of us to easily navigate that vast and sometimes messy ecosystem. At best, these algorithms are extremely useful. At worst, they are weapons of mass manipulation that cause significant damage to us, our families and our society. But good or bad, we can’t avoid them and deserve to know how they work and how they are used.

These algorithms do not cause immediate, noticeable changes. Rather, they feed ruthless micro-manipulations that over time profoundly reshape our society, politics, and opinions. It doesn’t matter if you can resist the manipulation or if you opt out of the apps powered by these algorithms. If enough of your neighbors and friends make these almost imperceptible changes in attitude and behavior, your world will change – and not in a way that benefits you, but for the benefit of the individuals who own and control the platforms.

Finally a move for data privacy

Data privacy activists have been sounding the alarm about these algorithms for years, but have had little success in enacting meaningful changes. But now there’s finally a chance to do something about the problem — a piece of federal legislation that the House Energy and Commerce Committee submitted for a vote by the full House at the last Congress.

The bill, known as the US Data Privacy and Protection Act (ADPPA), would for the first time hold the makers of these algorithms accountable – requiring them to demonstrate that their engagement formulas do not harm the public.

I like to think of it as similar to the generally accepted accounting principles that the SEC requires of publicly traded companies. In this case, the enforcement agency is the Federal Trade Commission.

Unfortunately, no vote on the ADPPA took place before the last Congress was adjourned. And there’s no telling whether the new House, now governed by the new party, will be inclined to take it on. But citizens of all political persuasions who care about data privacy should urge their lawmakers to revive the legislation or come up with a new version that addresses the shortcomings of some critics.

As a former FBI Cyber ​​Special Agent who now works at a cybersecurity firm, I urge every cyber citizen to pay attention to this issue and implore their legislators to take action.

Why you should be concerned

A common example of the algorithms I’m referring to are the algorithms that make the suggestions “might also interest” on sites like Amazon or Netflix. They seem harmless enough, but are designed to get us to buy more stuff or binge-watch more, which I think is okay if you have time or money to burn.

But other algorithms are pernicious, such as those used by some online financial institutions that have been accused of encoding racism or other bias into their loan application process, and that drive algorithmic radicalization, leading users to feed increasingly radicalized content with extremist views on topics from political concern.

Then there’s TikTok, the “free” social media app used by 80 million Americans. It’s so addictive that some critics have dubbed it “digital fentanyl.” Revelations about TikTok’s data collection and data storage activities have also raised serious concerns. It’s unclear if the Chinese government is aware of the data TikTok collects on its users, but national security chiefs say they don’t want to wait to find out.

Checking data collection

These concerns led to the US Senate to unanimously pass a bill banning the app from all federally issued devices, with at least 11 states following suit by enacting similar bans on state-owned devices.

FBI Director Chris Wray also testified before the House Homeland Security Committee in November that China could potentially weaponize the app to influence or control users and their devices — creating a virtually endless stream of information from which attackers can phishing— or could launch social manipulation campaigns targeting US users.

But with strong and clear regulation and data privacy enforcement, Americans could use social media apps like TikTok with much less fear. If we were better able to control what information is collected, where it is stored, who it is shared with, and if we could verify these facts, these kinds of concerns would be greatly reduced.

More importantly, if we could understand the algorithms used to influence users, we could set rules about what we allow and even the ability to opt out of these manipulative systems.

A crucial step towards data privacy

The ADPPA is far from perfect, but it marks the first time in decades that the federal government is serious about protecting consumer data privacy. Some states, notably California, already have tougher data privacy laws, and critics of the ADPPA want the bill amended so that states aren’t deterred from introducing more stringent protections.

But internet data doesn’t respect state lines. And even if the ADPPA is just a first step on behalf of the nation’s cyber citizens, it would be an important one. We need a legal framework at the federal level that protects everyone and avoids the pitfalls of a patchwork of unequal laws across states.

This bill, as drafted, is a reminder to all of us: Don’t let the perfect be the enemy of the good. I would like to see the FTC’s regulatory powers expanded and given more budget to perform the tasks outlined in the bill. In addition, we need more detail and clarity on the “private right of action” to take legal action directly against companies for data privacy abuses.

Data collection an advanced science; also destructive

That said, one of the most valuable parts of the ADPPA highlights how the advanced science of data collection can be turned into something dangerous and destructive. Right now, we trust companies to do the right thing. Many are not.

The ADPPA would finally create a mechanism requiring companies to certify that private data will not be misused. And it would give every consumer the right to choose not to have their data tracked and shared with third parties.

In the business-to-business world where I now work, everyone recognizes the value of data. So they take all kinds of measures, including legally binding contracts, to prevent other companies from exploiting it to their advantage.

Today, consumers have little say in how their equally valuable personal data is used – and by whom – for someone else’s profit. The ADPPA would provide consumers with legal remedies, including in some cases the right to sue companies for wrongful data practices. In addition, consumers have little insight into powerful algorithms that underlie our current internet use.

A bill like the ADPPA would provide a process for understanding how these algorithms work, allowing consumers to influence how they work and how they are used.

We, the people, must hold the algorithm makers and data collectors accountable. The ADPPA would create a much-needed foundation upon which to build a much safer and more transparent online world for all of us.

Adam Marrè, a former FBI Cyber ​​Special Agent, is CISO at Arctic Wolf.