I expected that Facebook would keep Beacon around since they turned it opt-in. In hindsight, I can understand why they’d close it. The legal costs were ramping up, I’m guessing that the commissions they get weren’t very high, and it’s much harder to keep partnered with all of these companies than to let maintain a widget.

For a more detailed write-up of the settlemet, check out the article titled A Look at The Facebook Privacy Class Action Settlement from blawger Venkat Balasubramani.

I’d like more details about the privacy group the money will go towards, but it seems that’s not available yet.

Related articles by Zemanta

• Facebook shuts down Beacon marketing tool (privacylawyer.ca)
• One privacy step forward, one back for Facebook (privacylawyer.ca)

The Abika case has already shown that the Privacy Commission has the jurisdiction to hear complaints on foreign companies. Whether or not they can do anything about it is another matter. In this case Facebook isn’t entirely foreign since they have at least one Canadian office in Toronto. As shown in Wu and Goldsmith’s Who Controls the Internet, influence can be exerted on them. I’m not sure the specifics of what the Privacy Commission can do and whether it’ll be enough to make Facebook change course remains to be seen.

Most of the issues have been sorted out. The last big ones are explained by Michael Geist, with the particularly nasty ones being third party applications and data collection of non-users. I’m not going to close my account but I’m going to be as careful with third party applications as I ever was.

Related articles by Zemanta

• Facebook still violates privacy laws: Experts (canada.com)
• Facebook to streamline user privacy controls, raise awareness about dissemination of info (privacylawyer.ca)

The proposed production order would require a third party, such as a communication service provider, to make data or information in its possession or control available to investigators within a specified time period, as set out in a court order. Under a production order, the service provider would provide the data or information to police, thereby eliminating the need for a police search. Production orders would be subject to the safeguards already in place for search warrants.

That FAQ is intended to describe the old Lawful Access bill but the paragraph doesn’t explain that subscriber data would have been available without a court order, potentially including handing over subscriber names and addresses associated with an IP address, putting it well below any safeguards in place for a search warrant. The thought of ISPs freely giving up subscriber data without court order caused Sympatico some headache earlier. I’m glad that Jennifer Stoddart, our Privacy Commissioner, is stepping in.

Update 15/02/2009: Ars Technica has a story on an Ontario court ruling that says there is no expectation of privacy on the internet. It’s a little worrying but doesn’t seem to change much. Law enforcement was always able to ask an ISP to fork over subscriber information, and ISPs were allowed to, just not required to.

The interview with Nora Young of Spark went over general issues of net neutrality, which is why my questions weren’t asked. My questions were a bit more technical and Nora felt they were already answered either in The Current or an article in The Gazette. I’m still not content despite these three pieces.

I’ll lay out my biggest problems with the interviews so far: They all include Bell claiming they need to do this to maintain network integrity, they give no explanation of where the congestion occurs or why they moved their throttling from the transit level to the DSLAM level, and they fudge the differences between wholesalers and resellers.

For example, from the Gazette article:

What they do instead is they buy a wholesale, end-to-end Internet product and put their brand around it. Then they don’t have the ability to manage their own network. It’s the same network shared between retail and wholesale. Those ISPs that bothered to invest in their own infrastructure, this problem doesn’t affect them. The use of the term “leased lines” isn’t quite accurate and I see that in a number of newspaper articles. It’s a very, very important point.

If it’s wholesale, it’s not an end-to-end Internet product. If it’s wholesale, the ISP has to provide their own transit. Bell will just provide the point to point connection that connects the user to the ISP. The ISP provides the connection to the internet. TekSavvy is not an end-to-end Bell technology. It just takes one trip to their DSL sales page to realize that.

This service is intended as a two-tiered option where you can go DSL Unlimited over Cogent (5ms to 15ms more latency) or if you prefer a premium option, DSL over Peer1 (premium routing). The difference between Unlimited and Premium Capped service is in its use of internet onramps. Call for further details!

TekSavvy, along other wholesalers like Eagle.ca, is being throttled even though they’re using an entirely different transit provider. The big question is whether or not this is covered under the tariff as reasonable network maintainence. Is the DSLAM the point of congestion? Is throttling there necessary to maintain the integrity of the network? Is Bell even entitled to throttle at the DSLAM level? No one has tried to answer this.

My inclination is “no.” All of the ISPs that built up transit capacity were able to handle the traffic without their customers complaining. The throttling has impacted all sorts of traffic, not just peer to peer, which isn’t even as big of a hog as YouTube. There are scads of problems without any transparency or even demonstration of why the throttling has to occur at the DSLAM, let alone whether Bell should be allowed.

As the CEO of TekSavvy says,

This is the exact problem and where Bell doesn’t get it. TekSavvy and all third party ISPs are paying for a “slice” of this network, so no, it’s not Bell’s at that point. They’re paid to make sure the infrastructure remains in good shape, but they’re not paid to police it! The flaw in Bell’s thought is in their not understanding that we’ve paid for the right to this space… We’ve paid for multiple Gig-E connections for the data to flow back to; we’ve paid for the DSL aggregation interface (AHSSPI) and we’re also paying on a per user basis (approx $20/month) to have the data relayed directly back to our main point of Interconnect.

So, in short, no, they don’t have rights to this network segment… An easy analogy would be a landlord, who is managing an apartment, gives himself a key to come in and out as he pleases and on top of that decide which tenants friends they let in! I’m not sure about you, but I’m fairly certain, one; the tenant would call the police, but two; you’d land up with a very big black-eye!

Facebook is changing Beacon privacy settings just like they did with the news feed.

Oh, and we’ll get a chunk of the spectrum auction set aside for new entrants after all.

The idea behind Beacon is that it’ll advertise what you buy or use on the ‘net. It’s ruined Christmas surprises for a few people already, showed who plays games where, and revealed real tastes in movies. The nasty parts are that it works on an opt-out principle rather than opt-in, you can’t opt-out of the entire service, it’s so easy to overlook the “No thanks, don’t advertise my purchase” button, and the button only lasts for twenty seconds.

Once you trigger Beacon through a partner you have the option of opting out of that partner. You can’t opt-out of Beaconing for a particular partner before it’s triggered. Once it’s triggered, a screen overlay is displayed for twenty seconds. If you navigate away the overlay is gone, I’m not sure if it warns you of this, and if you don’t click “No thanks” in that twenty second window Facebook assumes it’s okay to advertise.

Though you can’t easily get out of the service you can kill Beacon for now. It looks like you don’t need to be buying under the same email address as your facebook account either.

So, if Beacon creeps you out, join the protest group after blocking Beacon, browse Facebook under a different browser than your usual browser (this is a good time to try out Prism! Make sure it runs under a different profile!), and pray that Facebook doesn’t start tracking your offline purchases.

Recommendation 23

The Committee recommends that PIPEDA be amended to include a breach notification provision requiring organizations to report certain defined breaches of their personal information holdings to the Privacy Commissioner.

The notification of breach recommendation is interesting. Remember the Winners credit card breach, followed by the Club Monaco one? Even after those fiascos there is still resistance to requiring businesses to report information leaks. The report mentions that companies tend to look to the privacy commission to guidance anyway, and the Openness Principle of the CSA Model Code already makes companies responsible for disclosure. I’d just feel more comfortable if there was a punishment for companies that fail to notify.

… While supporting the notion of a duty to notify, the Commissioner pointed to the difficulty of choosing an appropriate model and she noted that a duty to notify did not easily fit into the current PIPEDA model since there is no straightforward way to penalize organizations that fail to notify individuals about security breaches. …

I’m glad that the report recommends a breach notification clause and I hope that the amendment will have some teeth.

My next concern is what happens to my data when it’s moved outside of Canada. I have a Canada.com email account and I remember when they changed the privacy policy to say PIPEDA no longer applies. It’s a good thing that’s not the case. I tried to form an opinion on whether or not it’s a good thing that there’s no change recommended and drew a blank. I just don’t know what protections PIPEDA gives me. I need to read more but at least I’m not in any worse shape.

The full report is available. Michael Geist has a less than positive take on it.