Following the scandal involving former CIA employee Edward Snowden, who revealed online surveillance by the US National Security Agency (NSA), the issue of personal data protection has taken a new turn.
Ukrainian civic activists have also stirred into action, announcing plans to sue Google and to ask the internet giant to revise its privacy policy. Members of parliament, meanwhile, have proposed setting up a temporary investigative commission to identify threats to Ukraine's national security from the spy programs of US intelligence agencies. Obozrevatel, for its part, offers ways to protect yourself against such spy programs, as recommended by our experts.
Under surveillance
The NGO "All-Ukrainian Association for Personal Data Protection" has announced its intention to file a lawsuit in a California court against Google and VKontakte over the protection of personal data.
The suit will be filed once the State Service provides information on the results of its monitoring of how Ukrainians' personal data is protected on the Google and VKontakte websites.
The Cabinet of Ministers, in turn, said that, based on the results of an audit of the two companies' advertising activities, it would send requests to their Ukrainian offices asking them to revise their privacy policies.
The State Service for Personal Data Protection also recently made its official position public. The agency believes that Ukrainians' personal data is insufficiently protected. In particular, both of the companies mentioned process users' personal data for advertising purposes. At the same time, they do not inform their users that they can file complaints with the authorized bodies.
But Ukrainians were not the first to talk about suing Google. Earlier, on July 11 this year, French human rights activists pledged to file lawsuits against two internet giants — Google and Facebook.
According to Agence France-Presse, the activists believe that both companies provided US intelligence agencies with servers for collecting internet users' data.
As it turned out, however, Google itself has had to fight for privacy. In June this year, a court hearing took place in San Francisco at which Google fought to protect its users' confidential information. According to CNET, the company receives demands from the FBI every year to disclose information about specific users. Moreover, the court warrants that would normally have to be presented to the internet giant in such cases have become optional. In such situations, both the FBI and the NSA cited US laws that allow them to demand user data without a court order if national security is at stake.
But as soon as Google decided to show its "claws" and challenge nearly two dozen FBI requests, it promptly lost in court. The judiciary explained to the company that a rehearing of the case concerning its refusal to give intelligence agencies users' personal information would require specific reasons to be stated.
The all-seeing eye of the US
Ukrainian MPs have also voiced their grievances against America's all-seeing "eye" in the form of the NSA and the FBI. MP Vadym Kolesnichenko proposed setting up a temporary investigative commission to identify threats to Ukraine's national security from the spy programs of US intelligence agencies, namely their data collection and search programs.
The commission would spend a year studying the protection of various databases.
The MP himself told the media that all Ukrainian technologies are based on microchips made in the US, so the States know everything about Ukraine.
Needless to say, what worries the MP most are the databases of Verkhovna Rada deputies downloaded by US intelligence agencies.
The era of privacy is over
This is how Yuriy Syvytsky, a member of the supervisory board of the Intecracy Group consortium, opened the conversation. He has put together a set of tips on how to protect yourself from intelligence agencies of all kinds, from marketers hunting you online, from cybercriminals, and from business and/or political rivals.
According to Syvytsky, intelligence agencies are interested only in specific people and only on specific grounds, for example during investigative actions. If you have not committed any criminal offences and have no links to terrorist groups, nobody will be watching you. It simply makes no sense: people are unable to process such huge volumes of information. The main feature of intelligence agencies' work is that the information about a user is personalized, and the user is clearly identified as a real person.
"The danger is that you could be questioned in connection with a crime simply because your social media page features ambiguous photos, or because your list of interests mentions ultra-radical organizations or views, even as a joke," Syvytsky told Obozrevatel.
To avoid trouble with intelligence agencies, you should, first of all, never send any truly secret information over the internet, especially by insecure means (through a free online service or a file-sharing site). And, naturally, you should not spread unnecessary information about yourself: hobbies, political views, sexual preferences, state of health or any other details you want to keep secret, the expert advises.
Marketers pose a threat of a different kind. They build so-called "digital portraits." They are not interested in data such as a person's full name linked to their tax ID or social insurance card. What interests them is user behavior: which websites a user visits, how long they spend on a particular page, what queries they type into a search engine, which photos they appear in and which other users they are connected with.
"This kind of information makes it possible to personalize advertising," says Syvytsky. "For example, as soon as you type 'digital camera kyiv buy' into Google, ads for digital cameras will be flashing on all sorts of pages for at least a week. The danger is that you don't know how this data will be used in the future or whose hands it will end up in. After all, what matters for sales in the digital environment is not the price margin that lets you make a 'killing,' but the scale of audience reach combined with maximum personalization. Providers that have accumulated user profiles will sell them wholesale to other businesses."
You can "fight back" against marketers too, Syvytsky says. In your browser settings, specify that you do not want websites to track you and do not want to see pop-up ads. Also disable cookie storage. In addition, the expert recommends installing an extension such as Adblock. Another option is to buy access to a paid anonymizer. It not only provides anonymity but also lets you shop online on US websites that block access for users from other countries.
Another category poses a serious danger — "cybercriminals." They collect any information that can be sold. Among other things, they are interested in accounts and passwords for social networks and free online services (email, messengers, file-sharing sites), which are then used to send spam. Users' computers are also often infected with a virus and then used for DDoS attacks.
To neutralize cybercriminals, you need an Internet Security-class antivirus.
"It should be noted that many antivirus developers offer free versions for individual users running them on a home PC, and these also provide decent protection," Syvytsky remarked. "You need to realize that using unlicensed software carries risks: a great many programs distributed for free are infected with viruses. Pirates don't do this out of love for humanity."
The most dangerous criminals collect information to gain access to payment cards, so you must never store your card number, its issue and expiry dates or its CVV2 code on your computer. It is best to get a separate card just for online payments and keep only a small amount on it. If theft does occur, the damage will be minimal, the expert advises. Bear in mind that with today's technology it is no problem to clone a SIM card and then pass authentication in a bank's payment system.
Business and/or political rivals, meanwhile, engage in so-called competitive intelligence. What interests them most is personal correspondence, especially if it contains documents or figures, or confidential information that can be used to "cook up" compromising material.
"Practically every serious company has IT staff who make sure important information is kept safe," says Syvytsky. "In cases provided for by law, companies commission comprehensive information security systems. But they can do nothing if users work from their own devices and use free online services. A striking example is the hacked free email account of Serhiy Vlasenko. Incidentally, a paid, secure business-class email service costs just 100 hryvnias a month. Notaries should use secure email too."
According to the expert, research his company conducted in Kyiv showed that 97% of notary offices send clients' documents via free services. Yet when offered paid services, all of them declined, because they do not realize the danger to which they are exposing their clients.
Smartphones are a weak link, the expert noted. Bugging software is often installed on them to record conversations and then send them to criminals over the internet.
"To avoid this, don't forget to install an antivirus that monitors all data transfers on your mobile device (and that includes tablets)," Syvytsky advises. "It is also very important to download software only from trusted sources, that is, app stores vetted by the company that developed the operating system (for example, Google or Apple). Never accept an offer from an unknown device to download a file via Bluetooth, never follow unknown links and never reply to advertising text messages. And it is better to turn off Wi-Fi, GPS and Bluetooth whenever you don't need them."
It is also worth remembering that all text messages are stored forever. The same goes for comments on forums, websites and social networks. They are not only stored but also analyzed. So before you say or write something or share a photo, it is best to think carefully about how it might be understood not only today but also several years from now, and in different circumstances, the expert noted.
"For example, you said something negative about a company, and a year later you happen to take a job there — a silly remark made years ago can affect your career," Syvytsky continued. "The same goes for dealing with people: you never know when and how a quarrel with a commenter under an article will resurface."
Taras Utyralov, a lawyer at Ilyashev & Partners, in turn advises Obozrevatel readers to be very careful when signing up for various online services, including foreign ones.
"Registration there almost always requires users to provide personal information," Utyralov told Obozrevatel. "As a rule, the user accepts the service's terms, including those on the processing of their personal data. With foreign websites, however, the rules for processing personal data may not fully comply with Ukrainian legal requirements, since they are based on foreign law. When suing to protect your personal data in the courts where the foreign portals are headquartered, you can of course demand that Ukrainian personal data protection legislation be applied as mandatory for such relations. But how effective that would be is highly questionable."
The agreements users conclude with online services when registering are contracts of adhesion. In other words, as users we can either accept the contract as a whole or not enter into it at all, with no way of changing individual terms. In practice, we face a choice: use a particular website or not, the expert says.
"So here everyone decides for themselves," Utyralov concluded. "Of course, intervention by the State Service for Personal Data Protection and numerous complaints from users may influence certain online services, and they may change their privacy policies. But the most effective way to protect your personal data on foreign websites is to keep track yourself of what data you provide when registering and using them, and which services you use at all."
Source: Obozrevatel