Occam's Razor

As a tech guy, it’s rare for me to find technology and politics intersecting. Both are my passions. Last week though it did and at the suggestion of my wife (actually her friend) we subscribed to a virtual private network service.

Why? Well, if you live in the United States it’s hard to miss the news that Congress passed and on Monday Trump signed into law a bill that allows Internet Service Providers (ISPs) to sell your Internet usage data. The law prohibits the Federal Communications Commission (FCC) from implementing a rule planned for later this year. That Obama FCC rule would have prohibited ISPs from selling your Internet access information without your explicit consent. With the new law, ISPs don’t need your consent. So in addition to paying companies like Comcast $100 a month for your Internet service they now have government sanction to do whatever they want with your Internet access information and without your consent too. You would think they would at least give you a kickback depending on the value of the information.

Being money grubbing, profit-making corporations of course ISPs will try to sell your information for as much as the market will allow. There are likely to be plenty of buyers because what they have to sell is likely plenty valuable. Think about your Internet life. Perhaps it is quite G-rated, as mine is most of the time. But even if you lead a G-rated life your browser history will still be tracked and analyzed, and sold to companies that will want to sell you stuff. Of course it’s much easier to sell you stuff when they already suspect you have an interest in what they are promoting, which is why it will likely generate a lot of profits for ISPs. In the sales business, this is called prospecting. It used to be done door-to-door and now it’s done electronically and you have no say in the matter because it’s like leaving your front door open for marketers to roam around in at any hour of the day to observe your behavior.

This practice isn’t news. You probably get targeted ads that follow you online, as I do. It’s probably not Comcast (yet) selling this information, although in the past they were not legally prohibited from selling it. (Most of these are site owners sharing information they collect about your access on their site, principally your IP address, to others.) The issue was murky so ISPs appeared to be refraining from doing it. That’s not the case now and really if you complain what are you going to do? Most of us don’t have the option of choosing another ISP. I sure don’t here in Massachusetts where Comcast holds the monopoly. My only choice is to give up the Internet altogether or access it from public libraries. Obviously this is not a viable solution today. Google and Facebook of course make lots of money selling targeted ads. However, you don’t have to use Google or Facebook, and they don’t charge you for the privilege. Using it is a choice.

With no constraints on what ISPs can do with information it collects about you while using its network, pretty much anything about your Internet usage is now available potentially to anyone with the money. ISPs could even give it away for free. Perhaps you don’t mind getting targeted ads so you think, okay, I’m in. If I have to have ads thrown at me online all day, maybe they can at least be relevant. But consider some of the other ways this information could be misused:

• The government could pay ISPs to collect all this information and store a copy in its own servers. You could even make a case for it. If the NSA is looking for potential terrorists, knowing you keep going to an al Qaeda website sure would be good to know. Of course while they are in there they could also learn that you frequent PornHub.com or regularly contribute to the American Communist Party. If you want to create a police state, this is a pretty efficient way to get one started.
• Political parties could use it not just to find new voters, but also to target voters they don’t want voting because they suspect you will vote against their interests. This is similar to what the Russian government is accused of doing in our last election through fake news sites and sophisticated web robots that promoted false stories that it believed we were likely to fall for. It’s quite likely that Hillary Clinton lost the election through the promotion of fake news stories about her email server or actions on Benghazi while Secretary of State.
• It would make it much easier for the Russians to affect future elections. Now they have to hunt to find gullible people. Buying the information up front is so much easier and allows a broader scope. Russia need not be the only state actor. Any nation with the cash (like China) could play.
• Your spouse can find out that you frequent ashleymadison.com or gay porn sites.
• Your Googling of medical conditions might suggest to health insurers that you are a bad bet and they might deny you a policy or cancel an existing one.
• You may have related confidential family information, maybe about your kid’s run in with the law, or a son’s ADHD, or a sister with Alzheimer’s Disease, stuff that is your business, but not some stranger’s business.
• Political enemies could discover you and target you, perhaps with a brick through your window because you gave to the ACLU and Planned Parenthood. (I am guilty of both.)

In short this should be very alarming. In more reasonable places, like most of Europe, laws prohibit this stuff. It doesn’t generate controversy because no one would consider an idea as radical as the bill Trump signed on Monday. Ah, but here in the USA we’re all about extreme capitalism. Those with the money make the rules and that appears to be Republicans since they moved this law, and very quickly too.

What can you do about it? I don’t intend to get into the many ways to safeguard your privacy on the web that have been around for years. In this case though you are being mined and recorded without your consent. Your Internet address is stored, geolocation information too along with a host of other information, like your web browser, the page you were viewing and the page that referred you to the page. It can all be logged and put into vast data warehouses and there is nothing you can do about it.

Okay, there is one thing: use a virtual private network (VPN). It’s hardly a perfect solution but it’s the next step. Unfortunately, a VPN service is rarely free, which means that if you value your privacy like everything else you will probably pay a cost, most likely in money, but perhaps just in your time. A VPN is a secure tunnel that your ISP cannot read, aside from knowing that you are connecting to a VPN site. Your web requests essentially are proxied through the VPN provider you choose.

(A side note: Congress is also considering legislation to do away with “net neutrality”. If passed, ISPs could use this is an excuse to block VPN sites or to charge them extra for the privilege, costs which would trickle down to you. This is just another reason that I think net neutrality is essential.)

We took the plunge last week and bought a year of VPN service from Private Internet Access. It’s a pretty good deal. ($40 a year for up to 5 simultaneous devices, if you pay for a year in advance.) I am not endorsing the company as we have just started using it. Of course you have no idea if the VPN service is reselling your information just like Comcast. You have to trust them. Private Internet Access’s terms of service suggest that if you are doing illegal things they can detect it and might report it. I’m quite confident that if they get a search warrant they can turn on logging easily enough. Of course they would not be in business long if they were engaged in these sorts of activities routinely. Private Internet Access, like most VPNs, says they don’t keep logs of your access. If true, it’s reasonably private.

So if you are shopping for a VPN, by all means shop around. This recent PC World article reviewed a bunch of VPNs so it’s a good place to get unbiased advice. (Private Internet Access is one of their Editor’s Choice winners.) Some, like one built into the Opera browser, are free. Most cost money. As you might expect the quality of the service you get depends principally on how much you are willing to pay. With Private Internet Access so far I have noticed:

• I could not access Craigslist until I pointed it to use a connection point within the United States
• I could not use it at the same time with another VPN. Since I teach at a local community college, I use its VPN from time to time. I could not use it until I first turned off the Private Internet Access VPN.
• Content streaming is not noticeably slower but it is probably slower in general because there is an extra server between me and the content I want

Hopefully in time we’ll get a Congress and president again that will respect our privacy. Like with the Citizens United decision, Americans are overwhelmingly against this law, and that includes Republicans. So it’s likely Republicans will eventually pay a price for this heavy handedness. In the meantime if you value your privacy, you probably need to get a VPN.