244 posts categorized "Retail" Feed

Health App Developer Settles With FTC For Deceptive Marketing Claims

The U.S. Federal Trade Commission (FTC) announced a settlement agreement with Aura Labs, Inc. regarding alleged deceptive claims about its product: the Instant Blood Pressure App. Aura sold the app from at least June 2014 to at least July 31, 2015 at the Apple App Store and at the Google Play marketplace for $3.99 (or $4.99). Sales of the app totaled about $600,000 during this period. Ryan Archdeacon, the Chief Executive Officer and President of Aura, was named as a co-defendant in the suit.

The FTC alleged that the defendants violated the FTC Act. The complaint alleged deceptive marketing claims by Aura about its blood pressure app:

"Although Defendants represent that the Instant Blood Pressure App measures blood pressure as accurately as a traditional blood pressure cuff and serves as a replacement for a traditional cuff, in fact, studies demonstrate clinically and statistically significant deviations between the App’s measurements and those from a traditional blood pressure cuff."

iMedicalApps reported on March 2, 2016:

"A study presented today at the American Heart Association EPI & Lifestyle (AHA EPI) meeting in Phoenix has shown the shocking inaccuracy of a popular medical app, Instant Blood Pressure... Back in 2014, we raised concerns about the Instant Blood Pressure medical app which claimed to measure blood pressure just by having users put their finger over their smartphone’s camera and microphone over their heart presumably to use something akin to a pulse wave velocity... Dr. Timothy Plante, a fellow in general internal medicine at Johns Hopkins, led the study in which a total of 85 participants were recruited to test the accuracy of the Instant Blood Pressure app... When looking at individuals with low blood pressure or high blood pressure, they found that the Instant Blood Pressure app gave falsely normal values. In other words, someone with high blood pressure who used the app would be falsely reassured their blood pressure was normal... the sensitivity for high blood pressure was an abysmal 20%. These results, while striking, should not be surprising. This medical app had no publicly available validation data, despite reassurance from the developer back in 2014 that such data was forthcoming. The use of things like pulse wave velocity as surrogates for blood pressure has been tried and is fraught with problems..."

The FTC complaint listed the problems with an online review posted in the Apple App Store:

"Defendant Ryan Archdeacon left the following review of the Instant Blood Pressure App in the Apple App Store: "Great start by ARCHIE1986 – Version – 1.0.1 – Jun 11, 2014. This app is a breakthrough for blood pressure monitoring. There are some kinks to work out and you do need to pay close attention to the directions in order to get a successful measurement but all-in-all it’s a breakthrough product. For those having connection problems, consider trying again. I have experienced a similar issue. It is also great that the developer is committed to continual improvements. This is a great start!!!" That the review was left by the Chief Executive Officer and President of Aura was not disclosed to consumers and would materially affect the weight and credibility consumers assigned to the endorsement."

The complaint also cited problems with endorsements posted at Aura's web site:

"At times material to this Complaint, the What People Think portion of Defendants’ website contained three endorsements, including the following endorsement from relatives of Aura’s Chairman of the Board and co-founder Aaron Giroux: "This is such a smart idea that will benefit many of us in monitoring our health in an easy and convenient way." That the endorsement was left by relatives of Aura’s Chairman of the Board and co-founder Aaron Giroux was not disclosed to consumers and would materially affect the weight and credibility consumers assigned to the endorsement."

Terms of the settlement prohibit the defendants from making such unsubstantiated claims in the future, refund money to affected customers, reimburse plaintiffs for the costs of this lawsuit, and additional unspecified items. The FTC announcement also stated that the court order imposed:

"... a judgment of $595,945.27, which is suspended based on the defendants’ inability to pay. The full amount will become due, however, it they are later found to have misrepresented their financial condition."

Copies of the complaint are available at the FTC site and here (Adobe PDF). Kudos tot he FTC for its enforcement action. Product claims and endorsements should be truthful and accurate. And consumers still need to do research before purchase. Just because there's an app for it doesn't mean the results promised are guaranteed.

Got an unresolved problem with a product, service, or app? Consumers can file a complaint online with the FTC. What are your opinions of the Aura-FTC settlement? Of claims by app developers?


How To Spot Fake News And Not Get Duped

You may have heard about the "pizzagate" conspiracy -- fake news about a supposed child-sex ring operating from a pizzeria in Washington, DC. A heavily armed citizen drove from North Carolina to the pizzeria to investigate to investigate the bogus child-sex ring supposedly run by Presidential candidate Hillary Clinton. The reality: no sex ring. That citizen had been duped by fake news. Shots were fired, and thankfully nobody was hurt.

CBS News reported that the pizzagate conspiracy had been promoted by Michael G. Flynn, son of retired General Michael T. Flynn, Donald Trump's pick for national security adviser. As a result, the younger Flynn resigned Tuesday from President-Elect Trump's transition team.

I use the phrase "fake news" for several types of misleading content: propaganda, unproven or fact-free conspiracy theories, disinformation, and clickbait. The pizzagate incident highlighted two issues: a) fake news has consequences, and b) many people don't know how to distinguish real news from fake news. So, while political operatives reportedly have used a combination of fake news, ads, and social media to both encourage supporters to vote and discourage opponents from voting, there clearly are other real-life consequences.

To help people spot fake news, NPR reported:

"Stopping the proliferation of fake news isn't just the responsibility of the platforms used to spread it. Those who consume news also need to find ways of determining if what they're reading is true. We offer several tips below. The idea is that people should have a fundamental sense of media literacy. And based on a study recently released by Stanford University researchers, many people don't."

The report is enlightening. In the "Evaluating Information: The Cornerstone of Civic Online Reasoning" report, researchers at Stanford University tested about 7,804 students in 12 states between January 2015 and June 2016. They found:

"... at each level—middle school, high school, and college—these variations paled in comparison to a stunning and dismaying consistency. Overall, young people’s ability to reason about the information on the Internet can be summed up in one word: bleak. Our “digital natives” may be able to flit between Facebook and Twitter while simultaneously uploading a selfie to Instagram and texting a friend. But when it comes to evaluating information that flows through social media channels, they are easily duped... We would hope that middle school students could distinguish an ad from a news story. By high school, we would hope that students reading about gun laws would notice that a chart came from a gun owners’ political action committee. And, in 2016, we would hope college students, who spend hours each day online, would look beyond a .org URL and ask who’s behind a site that presents only one side of a contentious issue. But in every case and at every level, we were taken aback by students’ lack of preparation... Many [people] assume that because young people are fluent in social media they are equally savvy about what they find there. Our work shows the opposite."

This is important for both individuals and the future of the nation because:

"For every challenge facing this nation, there are scores of websites pretending to be something they are not. Ordinary people once relied on publishers, editors, and subject matter experts to vet the information they consumed. But on the unregulated Internet, all bets are off... Never have we had so much information at our fingertips. Whether this bounty will make us smarter and better informed or more ignorant and narrow-minded will depend on our awareness of this problem and our educational response to it. At present, we worry that democracy is threatened by the ease at which disinformation about civic issues is allowed to spread and flourish."

While the study focused upon students, but older persons have been duped, too. The suspect in the pizzeria incident was 28 years old. The Stanford report focused upon what teachers and educators can do to better prepare students. According to the researchers, additional solutions are forthcoming.

What can you do to spot fake news? Don't wait for sites and/or social media to do it for you. Become a smarter consumer. The NPR report suggested:

  1. Pay attention to the domain and URL
  2. Read the "About Us" section of the site
  3. Look at the quotes in a story
  4. Look at who said the quotes

All of the suggestions require readers to take the time to understand the website, publication, and/or publisher. A little skepticism is healthy. Also verify the persons quoted and whether the persons quoted are who the article claims. And, verify that any images used actually relate to the event.

We all have to be smarter consumers of news in order to stay informed and meet our civic duties, which includes voting. Nobody wants to vote for politicians that don't represent their interests because they've been duped. To the above list, I would add:

  • Read news wires. These sites include the raw, unfiltered news about who, when, where, and what happened. Some suggested sources: : Associated Press (AP), Reuters, and United Press International (UPI)
  • Learn to recognize advertisements
  • Learn the differences between different types of content: news, opinion, analysis, satire/humor, and entertainment. Reputable sites will label them to help readers.

If you don't know the differences and can't spot each type, then you are likely to get duped.


The List of Fake News Sites

New York Magazine reported:

"As Facebook and now Google face scrutiny for promoting fake news stories, Melissa Zimdars, a communication and media professor from Merrimack College in Massachusetts, has compiled a handy list of websites you should think twice about trusting. “Below is a list of fake, false, regularly misleading, and otherwise questionable ‘news’ organizations that are commonly shared on Facebook and other social media sites,” Zimdars explains. “Many of these websites rely on ‘outrage’ by using distorted headlines and decontextualized or dubious information in order to generate likes, shares, and profits.” (Click here to see the list.)

Be warned: Zimdars’s list is expansive in scope, and stretches beyond the bootleg sites (many of them headquartered in Macedonia) that write fake news for the sole reason of selling advertisements. Right-wing sources and conspiracy theorists like Breitbart and Infowars appear alongside pure (but often misinterpreted) satire like the Onion and The New Yorker’s Borowitz Report."

For consumers seeking "hard" news (e.g., the raw who, what, when, and where something happened), some sources: Associated Press (AP), Reuters, and United Press International (UPI). What sources do you use for "hard" news?


Phone Calls, Apple iCloud, Cloud Services, And Your Privacy

A security firm has found a hidden feature that threatens the privacy of Apple iPhone and iCloud users. Forbes magazine reported:

"Whilst it was well-known that iCloud backups would store call logs, contacts and plenty of other valuable data, users should be concerned to learn that their communications records are consistently being sent to Apple servers without explicit permission, said Elcomsoft CEO Vladimir Katalov. Even if those backups are disabled, he added, the call logs continue making their way to the iCloud, Katalov said... All FaceTime calls are logged in the iCloud too, whilst as of iOS 10 incoming missed calls from apps like WhatsApp and Skype are uploaded..."

Reportedly, the feature is automatic and the only option for users wanting privacy is to not use Apple iCloud services. That's not user-friendly.

Should you switch from Apple iCloud to a commercial service? Privacy risks are not unique to Apple iCloud. Duane Morris LLP explained the risks of using cloud services such as Dropbox, SecuriSync, Citrix ShareFile, and Rackspace:

"Users of electronic file sharing and storage service providers are vulnerable to hacking... Dropbox as just one example: If a hacker was to get their hands on your encryption key, which is possible since Dropbox stores the keys for all of its users, hackers can then steal your personal information stored on Dropbox. Just recently, Dropbox reported that more than 68 million users’ email addresses and passwords were hacked and leaked onto the Internet... potentially even more concerning is the fact that because these service providers own their own servers, they also own any information residing on them. Hence, they can legally access any data on their servers at any time. Additionally, many of these companies house their servers outside of the United States, which means the use, operation, content and security of such servers may not be protected by U.S. law. Furthermore, consider the policies regarding the sharing of your information with third parties. Among others, Dropbox has said that if subpoenaed, it will voluntarily disclose your information to a third party, such as the Internal Revenue Service."

Regular readers of this blog know what that means. Many government entities, such as law enforcement and intelligence agencies besides the IRS issue subpoenas.

This highlights the double-edged sword from syncing and file-sharing across multiple devices (e.g., phone, laptop, desktop, tablet). Sure, is a huge benefit to have all of your files, music, videos, contacts, and data easily and conveniently available regardless of which device you use. Along with that benefit comes the downside privacy and security risks: data stored in cloud services is vulnerable to hacking and subject to government warrants, subpoenas, and court actions. As Duane Morris LLP emphasized, it doesn't matter whether your data is encrypted or not.

Also, Forbes magazine reported:

"Katalov believes automated iCloud storage of up-to-date logs would be beneficial for law enforcement wanting to get access to valuable iPhone data. And, he claimed, Apple hadn’t properly disclosed just what data was being stored in the iCloud and, therefore, what information law enforcement could demand."

Well, law enforcement, intelligence agencies, and cyber-criminals now know what information to demand.


Some Android Phones Infected With Surveillance Malware Installed In Firmware

Security analysts recently discovered surveillance malware in some inexpensive smartphones that run the Android operating system (OS) software. The malware secretly transmits information about the device owner and usage to servers in China. The surveillance malware was installed in the phones' firmware. The New York Times reported:

"... you can get a smartphone with a high-definition display, fast data service and, according to security contractors, a secret feature: a backdoor that sends all your text messages to China every 72 hours. Security contractors recently discovered pre-installed software in some Android phones... International customers and users of disposable or prepaid phones are the people most affected by the software... The Chinese company that wrote the software, Shanghai Adups Technology Company, says its code runs on more than 700 million phones, cars and other smart devices. One American phone manufacturer, BLU Products, said that 120,000 of its phones had been affected and that it had updated the software to eliminate the feature."

Shanghai ADUPS Technology Company (ADUPS) is privately owned and based in Shanghai, China. According to Bloomberg, ADUPS:

"... provides professional Firmware Over-The-Air (FOTA) update services. The company offers a cloud-based service, which includes cloud hosts and CDN service, as well as allows manufacturers to update all their device models. It serves smart device manufacturers, mobile operators, and semiconductor vendors worldwide."

Firmware is a special type of software store in read-only memory (ROM) chips that operates a device, including how it controls, monitors, and manipulates data within a device. Kryptowire, a security firm, discovered the malware. The Kryptowire report identified:

"... several models of Android mobile devices that contained firmware that collected sensitive personal data about their users and transmitted this sensitive data to third-party servers without disclosure or the users' consent. These devices were available through major US-based online retailers (Amazon, BestBuy, for example)... These devices actively transmitted user and device information including the full-body of text messages, contact lists, call history with full telephone numbers, unique device identifiers including the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI). The firmware could target specific users and text messages matching remotely defined keywords. The firmware also collected and transmitted information about the use of applications installed on the monitored device, bypassed the Android permission model, executed remote commands with escalated (system) privileges, and was able to remotely reprogram the devices.

The firmware that shipped with the mobile devices and subsequent updates allowed for the remote installation of applications without the users' consent and, in some versions of the software, the transmission of fine-grained device location information... Our findings are based on both code and network analysis of the firmware. The user and device information was collected automatically and transmitted periodically without the users' consent or knowledge. The collected information was encrypted with multiple layers of encryption and then transmitted over secure web protocols to a server located in Shanghai. This software and behavior bypasses the detection of mobile anti-virus tools because they assume that software that ships with the device is not malware and thus, it is white-listed."

So, the malware was powerful, sophisticated, and impossible for consumers to detect.

This incident provides several reminders. First, there were efforts earlier this year by the U.S. Federal Bureau of Investigation (FBI) to force Apple to build "back doors" into its phones for law enforcement. Reportedly, it is unclear what specific law enforcement or intelligence services utilized the data streams produced by the surveillance malware. It is probably wise to assume that the Ministry of State Security, China's intelligence agency, had or has access to data streams.

Second, the incident highlights supply chain concerns raised in 2015 about computer products manufactured in China. Third, the incident indicates how easily consumers' privacy can be compromised by data breaches during a product's supply chain: manufacturing, assembly, transport, and retail sale.

Fourth, the incident highlights Android phone security issues raised earlier this year. We know from prior reports that manufacturers and wireless carriers don't provide OS updates for all Android phones. Fifth, the incident highlights the need for automakers and software developers to ensure the security of both connected cars and driverless cars.

Sixth, the incident raises questions about how and what, if anything, President Elect Donald J. Trump and his incoming administration will do about this trade issue with China. The Trump-Pence campaign site stated about trade with China:

"5. Instruct the Treasury Secretary to label China a currency manipulator.

6. Instruct the U.S. Trade Representative to bring trade cases against China, both in this country and at the WTO. China's unfair subsidy behavior is prohibited by the terms of its entrance to the WTO.

7. Use every lawful presidential power to remedy trade disputes if China does not stop its illegal activities, including its theft of American trade secrets - including the application of tariffs consistent with Section 201 and 301 of the Trade Act of 1974 and Section 232 of the Trade Expansion Act of 1962..."

This incident places consumers in a difficult spot. According to the New York Times:

"Because Adups has not published a list of affected phones, it is not clear how users can determine whether their phones are vulnerable. “People who have some technical skills could,” Mr. Karygiannis, the Kryptowire vice president, said. “But the average consumer? No.” Ms. Lim [an attorney that represents Adups] said she did not know how customers could determine whether they were affected."

Until these supply-chain security issues get resolved it is probably wise for consumers to inquire before purchase where their Android phone was made. There are plenty of customer service sites for existing Android phone owners to determine the country their device was made in. Example: Samsung phone info.

Should consumers avoid buying Android phones made in China or Android phones with firmware made in China? That's a decision only you can make for yourself. Me? When I changed wireless carriers in July, I switched an inexpensive Android phone I'd bought several years ago to an Apple iPhone.

What are your thoughts about the surveillance malware? Would you buy an Android phone?


Facebook Says it Will Stop Allowing Some Advertisers to Exclude Users by Race

Facebook logo [Editor's note: Today's guest post was originally published by ProPublica on November 11, 2016. It is reprinted with permission. This prior post explained the problems with Facebook's racial advertising filters.]

by Julia Angwin, ProPublica

Facing a wave of criticism for allowing advertisers to exclude anyone with an "affinity" for African-American, Asian-American or Hispanic people from seeing ads, Facebook said it would build an automated system that would let it better spot ads that discriminate illegally.

Federal law prohibits ads for housing, employment and credit that exclude people by race, gender and other factors.

Facebook said it would build an automated system to scan advertisements to determine if they are services in these categories. Facebook will prohibit the use of its "ethnic affinities" for such ads.

Facebook said its new system should roll out within the next few months. "We are going to have to build a solution to do this. It is not going to happen overnight," said Steve Satterfield, privacy and public policy manager at Facebook.

He said that Facebook would also update its advertising policies with "stronger, more specific prohibitions" against discriminatory ads for housing, credit and employment.

In October, ProPublica purchased an ad that targeted Facebook members who were house hunting and excluded anyone with an "affinity" for African-American, Asian-American or Hispanic people. When we showed the ad to a civil rights lawyer, he said it seemed like a blatant violation of the federal Fair Housing Act.

After ProPublica published an article about its ad purchase, Facebook was deluged with criticism. Four members of Congress wrote Facebook demanding that the company stop giving advertisers the option of excluding by ethnic group.

The federal agency that enforces the nation's fair housing laws said it was "in discussions" with Facebook to address what it termed "serious concerns" about the social network's advertising practices.

And a group of Facebook users filed a&n class-action lawsuit against Facebook, alleging that the company's ad-targeting technology violates the Fair Housing Act and the Civil Rights Act of 1964.

Facebook's Satterfield said that today's changes are the result of "a lot of conversations with stakeholders."

Facebook said the new system would not only scan the content of ads, but could also inject pop-up notices alerting buyers when they are attempting to purchase ads that might violate the law or Facebook's ad policies.

"We're glad to see Facebook recognizing the important civil rights protections for housing, credit and employment," said Rachel Goodman, staff attorney with the racial justice program at the American Civil Liberties Union. "We hope other online advertising platforms will recognize that ads in these areas need to be treated differently."

ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.


Connected Cars: 4 Tips For Drivers To Stay Safe Online

With the increasing dominance of the Internet of Things (IoT), connected cars are becoming more ubiquitous than ever. We’ve long heard warnings from the media about staying safe online, but few consumers consider data hacks and other security compromises while driving a car connected to the internet.

According to the inforgraphic below from Arxan, an app protection company, 75 percent of all cars shipped globally will have internet connectivity by 2020, and current connected cars have more than 100 million lines of code. Connected features are designed to improve safety, fuel efficiency, and overall convenience. These features range from Bluetooth, WiFi, cellular network connections, keyless entry systems, to deeper “cyberphysical” features like automated braking, and parking and lane assist.

More Features Means More Vulnerability
However, with this increasing connectivity comes risks from malicious hacking. Today, connected cars have many attack points malicious hackers can exploit, including the OBD2 port used to connect third-party devices, and the software running on infotainment systems.

According to Arxan, some of the more vulnerable attack points are mobile apps that unlock vehicles and start a vehicle remotely, diagnostic devices, and insurance dongles, including the ones insurance companies give to monitor and reward safe drivers. These plug into the OBD2 port, but hackers could essentially access any embedded system in the car after lifting cryptographic keys, as the Arxan page on application protection for connected cars describes.

Vulnerabilities are usually demonstrated in conferences like Black Hat. Example: in 2010, researchers at the University of Washington and the University of California San Diego hacked a car that had a variety of wireless capabilities. The vulnerable attack points they targeted included its Bluetooth, the cellular radio, an Android app on the owner’s phone that was connected to the car’s network, and an audio file burned onto a CD in the car’s stereo. In 2013, hackers Charlie Miller and Chris Valasek hijacked the steering and brake systems of both a Ford Escape and Toyota Prius with only their laptops.

How To Protect Yourself
According to the FBI and Department of Transportation in a public service announcement, it’s crucial that consumers following the following recommendations to best protect themselves:

  1. Keep your vehicle’s software up to date
  2. Stay aware of recalls that require manual security patches to your car’s code
  3. Avoid unauthorized changes to your car’s software
  4. Use caution when plugging insecure devices into the car’s ports and network

With the latest remote hack of a Tesla Model S, it seems that the response time between finding out about a breach and issuing a patch to correct it is thankfully getting shorter. As more automakers become tech-oriented like Tesla, they will also need to cooperate with OEMs to make sure the operating-system software in their vehicles is designed securely. It seems, this will take time, coordination with vendors, and money to bring these operations in house.

Arxan connected vehicles infographic

What do you do to protect your Internet-connected vehicle? What security tools and features would you prefer automakers and security vendors provide?


Potential Security Issues Regarding the Internet of Things

Header potential IoT device security issues

[Editor's Note: today's blog post is by guest author Cassie Phillips, a technology blogger who developed a special interest in cybersecurity after her webcam was hacked. While she’s interested to see how the Internet of Things changes how we use technology, she is very concerned about all the risks it poses.]

By Cassie Phillips

Many people and organizations have raised concerns about the potential risks related to the Internet of Things (IoT). It turns out that they were right to be concerned. Last month the France-based hosting provider, OVH, fell victim to an enormous distributed denial-of-service (DDoS) attack on the Minecraft servers that OVH was hosting.

DDoS attacks are attempts to make a resource (usually a website) inaccessible to its users through an inundation of requests, aiming to overburden the system. In the past, DDoS attacks were carried out by computers, with or without their owner’s consent. Hot Hardware reported:

“OVH was the victim of a wide-scale DDoS attack that was carried via a network of over 152,000 IoT devices… Of those IoT devices participating in the DDoS attack, they were primarily comprised of CCTV cameras and DVRs.”

Before the attack on OVH, there was another DDoS attack on prominent internet security researcher Brian Krebs’ website. This attack was also carried out by IoT devices. Akamai Technologies Inc., a provider of security services worldwide for major companies, cut ties with Mr. Krebs because the DDoS attack on Krebs’ website was enormous. Josh Shaul, Akamai’s vice president, said it was the worst DDoS attack the company had ever seen.

These broad attacks prove that the IoT does pose a significant security risk. And DDoS attacks are by no means the only security risks that the IoT presents. Let’s look at what the IoT is, the risks it presents and, most importantly, how to ensure that any IoT devices you use are secure.

What Is the Internet of Things?
The IoT is the idea that any device can be designed to be able to connect to the internet and other devices. These devices include mobile phones, washing machines, refrigerators, coffee makers, televisions, home thermostats, motion sensors, headphones, Barbie dolls and baby monitors. There is no limit except the imagination.

There are even buildings, cars, and health-related implants (such as pacemakers) that can connect to the internet and to each other. All of these devices can exchange information and collect data, creating a huge pool of information and an enormous network.

What Risks Does the Internet of Things Pose?
As mentioned above, the IoT poses a few risks and concerns. There are four key risks associated with the IoT, with the first being reliability. IoT devices are not necessarily reliable. While this may not be a crisis if the device in question is a refrigerator, it is deadly if devices such as cars fail or are hacked.

The second major risk related to the IoT is privacy. Each device in a network of the IoT can collect and share data. As consumers, we don’t always know who gets this data and what it is used for. The data will almost certainly be used to track consumers’ behavior, allowing companies to target each consumer with tailor-made advertising. While this data probably won’t always be used for nefarious purposes, it can be used in a way that violates our right to privacy. According to Buzzfeed:

“ "We were sleeping in bed, and basically heard some music coming from the nursery, but then when we went into the room the music turned off,” said the anonymous mother. They tracked the IP address that had accessed their camera and discovered a website with “thousands and thousands of pictures of cameras just like their own.” Anyone could use the site to access hacked cameras and monitors located in at least 15 different countries."

This leads to the third major risk associated with the IoT, namely security. Again, each of the IoT devices collects and transmits data. If these devices are hacked, criminals will have access to vast amounts of consumers' private information. Depending on the device, criminals can learn our routines, find out what valuables we keep in our homes, gain access to information about any security measures we use, and even collect sensitive information such as financial payment information.

Another security risk is the potential for hacking medical devices and implants. According to a report by research and advisory firm, Forrester, ransomware in medical devices is the single biggest cybersecurity threat for this year. Security researchers have already managed to hack into hospitals’ networks, pacemakers and other medical devices. This will put people’s lives at risk.

The potential for cyberattacks is the fourth major risk associated with the IoT. Because all these devices are connected, they have the potential to spread malware across homes and entire companies. However, the greatest risk lies in criminals’ ability to use our IoT devices in massive cyberattacks, such as the DDoS attack on OVH. Widespread vulnerabilities are only a few missteps away, and that is a seriously concerning fact.

How to Protect Yourself When Using IoT Devices
Given the risks listed above, it’s vital that consumers learn to protect our devices, our homes, and ourselves. The following actions are all essential to your security when using IoT devices:

  • Carefully consider how much connectivity you need in your home and life. Then try to avoid any devices that unnecessarily connect to the internet. After all, you can always opt for a coffeemaker with a timer instead of one that connects to a mobile app on your phone.
  • If you do decide to buy an IoT device, be sure to find one with the best security features possible.
  • Read all the terms and conditions and privacy policies for any IoT device you intend to purchase. This will help you understand what data the device collects and what it does with the data.
  • When you buy an IoT device, change its default password immediately. This also applies to any IoT devices that you already own. Be sure to use strong passwords and manage them effectively.
  • Always keep the software on IoT devices up to date. Updates often contain essential bug fixes and security patches.
  • If your IoT device supports security software, install it. Don’t forget that your mobile phone and tablet count as IoT devices!
  • Use a reputable Virtual Private Network, such as one recommended by Secure Thoughts.
  • If your IoT device allows it, use encryption technology.
  • Switch off and unplug any IoT devices when you are not using them.
  • If your IoT device uses location data unnecessarily, turn it off if possible.
  • If your IoT device has a camera or monitor that you don’t think it needs, block the lens.

Conclusion
While it would be best if security features were built into the design of IoT devices, that’s not always the case. So it’s crucial that you implement the security ideas discussed above. Hopefully, we’ll start seeing a move toward creating an international standard for all IoT devices in the future.

Have you had any bad experiences with IoT devices? How do you think the technology is progressing? Share your thoughts in the comments section below.


German Regulators Ask Tesla To Stop Advertising 'Autopilot' Term

Government regulators have asked the automaker Tesla to stop using the term "autopilot" for its driver-assist feature. Deutsche Welle (DW) reported that a letter:

"... published in the newspaper "Bild am Sonntag," called on Tesla to take urgent action "in order to prevent misunderstandings and false expectations from clients." The KBA transport regulator said the term "autopilot" was misleading, and called for it to be removed in future advertisements for Tesla products. The self-driving feature has been available on the California-based automaker's Model S since October 2015."

The Autopilot feature manages the car's speed, steers within a lane, changes lanes (when the driver taps a turn signal), scan for a parking space, and parallel parks on command. Officials in Germany are still conducting an investigation into the car's capabilities.

After the fatal crash in May of a Tesla Model S car operating beta-version software for its Autopilot feature, Tesla engineers said in August the problem was with the car's brakes and not its Autopilot feature.

DW also reported:

"... the German transport regulator wrote to Tesla owners warning them that the autopilot function was purely to assist the driver and did not turn the car into a highly-automated vehicle. The feature still required the driver's unrestricted attention at all times, the letter said. Under German road traffic regulations, the driver is required to remain alert and in control of the vehicle at all times when using the system, the letter added."

The Los Angeles Times reported:

"Tesla Chief Executive Elon Musk has repeatedly said he’s sticking with the name, and the company responded to the German report as it does every time the subject comes up: The term “autopilot” has a long history in aerospace, where human pilots and autopilot systems work together to fly a plane."


Comcast Fined $2.3 Million For Charging Customers For Unrequested Services

Federal communications Commission logo After receiving numerous complaints from consumers, the U.S. Federal Communications Commission (FCC) investigated and announced yesterday that Comcast will pay a $2.3 million fine for charging its customers for services and equipment they did not request. The FCC announcement explained:

"The Communications Act and the FCC’s rules prohibit a cable provider from charging its subscribers for services or equipment they did not affirmatively request, a practice known as “negative option billing.”  Negative option billing burdens customers with the responsibility of contacting a cable company to dispute the charges and obtain refunds. The Communications Act and the FCC’s rules prohibit a similar practice by telecommunications carriers when unauthorized charges are placed on customers’ phone bills, an abuse known as cramming."

Comcast logo The complaints by consumers included:

"... unordered services or products, such as premium channels, set-top boxes, or digital video recorders (DVRs). In some complaints, subscribers claimed that they were billed despite specifically declining service or equipment upgrades offered by Comcast. In others, customers claimed that they had no knowledge of the unauthorized charges until they received unordered equipment in the mail, obtained notifications of unrequested account changes by email, or conducted a review of their monthly bills. Consumers described expending significant time and energy to attempt to remove the unauthorized charges from their bills and obtain refunds..."

This is the largest civil penalty assessed by the FCC to a cable provider. Additional terms of the settlement agreement require Comcast to implement a five-year compliance plan:

"Specifically, Comcast will adopt processes and procedures designed to obtain affirmative informed consent from customers prior to charging them for any new services or equipment. Comcast will also send customers an order confirmation separate from any other bill, clearly and conspicuously describing newly added products and their associated charges. Further, Comcast will offer to customers, at no cost, the ability to block the addition of new services or equipment to their accounts. In addition, the settlement requires Comcast to implement a detailed program for redressing disputed charges in a standardized and expedient fashion, and limits adverse action (such as referring an account to collections or suspending service) while a disputed charge is being investigated."

Comcast customers experiencing unresolved problems are encouraged to submit complaints online to the FCC, or contact the FCC Consumer Center at 1-888-225-5322, TTY at 1-888-835-5322, fax at 1-866-418-0232, or via postal mail:

Federal Communications Commission
Consumer and Governmental Affairs Bureau
Consumer Inquiries and Complaints Division
445 12th Street, SW
Washington, DC 20554

Comcast has a checkered history of customer service. In 2014, the Internet service provider (ISP) began to convert customers home wireless routers to public hotspots, which placed the burden on customers to opt out. A customer-friendly approach instead would have asked interested customers to opt in.

In 2015, reports surfaced that 13,000 consumers had filed complaints about the ISP's usage-based pricing services. The same year, Comcast paid $33 million to settle privacy violations affecting its VOIP phone customers. Earlier this year, Comcast proposed the idea of charging customers (phone, Internet, TV, cable) additional fees for privacy.

Comcast issued a statement down-playing the FCC fine and consent order:

"We have been working very hard on improving the experience of our customers in all respects and are laser-focused on this. We acknowledge that, in the past, our customer service should have been better and our bills clearer, and that customers have at times been unnecessarily frustrated or confused. That’s why we had already put in place many improvements to do better for our customers even before the FCC’s Enforcement Bureau started this investigation almost two years ago. The changes the Bureau asked us to make were in most cases changes we had already committed to make, and many were already well underway or in our work plan to implement in the near future.

We do not agree with the Bureau’s legal theory here, and in our view, after two years, it is telling that it found no problematic policy or intentional wrongdoing, but just isolated errors or customer confusion. We agree those issues should be fixed and are pleased to put this behind us and proceed with these customer service-enhancing changes."

This latest incident with Comcast reminds me of the unlawful sales practices at Wells Fargo, where bank staff created new accounts without customers' consent or notice, all to game the sales incentive system. The CFPB assessed a massive fine on the bank earlier this year. Both incidents seem to indicate poor or asleep management and a lack of internal oversight and controls. 13,000 consumer complaints seems substantial.

What are your opinions of Comcast and the FCC fine?


Samsung Permanently Stops Sales And Recalls All Galaxy Note 7 Phones

Image of Samsung Galaxy Note7 smartphone. Click to view larger version Samsung has stopped sales worldwide of its Galaxy Note7 smartphone. The tech giant announced yesterday:

"Samsung is working with the US Consumer Product Safety Commission (CPSC) to investigate the recently reported cases involving the Galaxy Note7. While the investigation is taking place, Samsung is asking all carrier and retail partners here and around the globe to stop sales and exchanges of the Galaxy Note7. Since the affected devices can overheat and pose a safety risk, we are asking consumers with an original Galaxy Note7 or a replacement Galaxy Note7 to power it down and contact the carrier or retail outlet where you purchased your Galaxy Note7. If you bought your Galaxy Note7 from Samsung.com or have questions, you should contact us at 1-844-365-6197 and we can help you."

Owners of Galaxy Note7 phones can either exchange their device for a Galaxy S7 Edge with a refund of the price difference, or get a full refund from the retailer they purchased their phone from. The announcement listed the phone numbers and websites of wireless providers for phone owners to obtain refunds or exchanges.

The New York Times reported:

"Authorities in the U.S. and South Korea are still investigating why even the replacement Note 7 phones that Samsung equipped with a safer battery are catching fire. An official at the South Korean safety agency said the replacement phones may have a defect that is different from the problem with the original Note 7s... Also Tuesday, China's product safety regulator said Samsung will recall all Galaxy Note 7 smartphones sold in mainland China, amounting to around 191,000 units. The General Administration of Quality Supervision, Inspection and Quarantine said it was investigating for defects in the devices.."

Elliot F. Kaye, the Chairman of the U.S. Consumer Product Safety Commission, released a brief statement:

"No one should have to be concerned that their phone will endanger them, their family, or their property. Due to the ongoing safety concerns with Galaxy Note7 phones, it is the right move for Samsung to suspend the sale and exchange all Galaxy Note7s..."

Most Galaxy Note7 owners, about 90 percent, had stuck with the device. Samsung announced on September 27 that 60 percent of all Galaxy Note7 phones sold in the United Stated and Korea had already been exchanged. Given yesterday's recall announcement, it confirms that the replacement devices categorized as "safe' really aren't. And, it seems to be the end of the Galaxy Note7 device.

Recent events remind me of the Ford Edsel and Chevrolet Corvair. What are your opinions?


Exploding Phones And Washing Machines. It's Been A Rough Time For Samsung

Image of Samsung Galaxy Note7 smartphone. Click to view larger version It has been a busy and rough few months at Samsung, after the consumer electronics company introduced the Galaxy Note7 smartphone on August 19. Soon afterwards, reports surfaced of a phone catching fire while charging, exploding phones in separate incidents which burned down a garage and a car, and another exploding phone which caused $1,380 in damage to a hotel room.

On September 2, Samsung Electronics America, Inc. (SEA) announced an exchange program in the United States "regarding isolated battery cell issues" with the phone. The exchange program allowed current Galaxy Note7 users to get a new Galaxy Note7 phone, or a Galaxy S7 Edge. Customers were offered a $25 gift card or bill credit from select carrier retail outlets. Also on September 2, SEA announced the results of an investigation with 35 cases reported worldwide of problems with the phone's battery.

Headquartered in Ridgefield Park, N.J., SEA is a wholly owned subsidiary of Samsung Electronics Co. Limited. The retailer also stopped sales of the device on September 2. On September 8, three Australian airlines banned passengers from using or charging Samsung Galaxy Note7 smartphones during flights. Reportedly Qantas, Jetstar, and Virgin Australia all issued the voluntary bans without orders from aviation regulators. The airlines did it as a precaution.

The U.S. Federal Aviation Administration (FAA) issued this warning on September 8:

"In light of recent incidents and concerns raised by Samsung about its Galaxy Note7 devices, the Federal Aviation Administration strongly advises passengers not to turn on or charge these devices on board aircraft and not to stow them in any checked baggage."

On September 9, SEA announced that it worked jointly with the Consumer Product Safety Commission (CPSC) in the United States to implement a "voluntary corrective plan" to recall all Galaxy Note7 phones sold from August 2015 through September 15, 2016. 2.5 million devices had been sold by that time.

While this is Samsung's largest recall, it is not the largest recall ever. The New York Times reported:

"While the recall of the Galaxy Note7 is Samsung’s largest voluntary recall, it is not the biggest on record. In 2007, Nokia announced a recall of 46 million cellphone batteries. In 2006, Dell recalled 4.1 million lithium-ion batteries for notebook computers."

On September 15, SEA announced approval by the CSPC of its corrective plan and product recall. On September 20, SEA announced a firmware update and the availability of 500,000 new Galaxy Note7 replacement devices in the United States. The firmware update:

"The software updates are being delivered in partnership with Carriers and will display a green battery icon on the status bar found on the top right hand of the screen. The green icon indicates that consumers have a new Galaxy Note7 with an unaffected battery.

Samsung and the U.S. CPSC have and continue to urge all consumers of Note7s sold prior to September 15 to power down their device. For those not heeding that advice or are still not aware of the recall notice, a software update will be pushed to all recalled devices. Once installed, users will be prompted with a safety notice that urges owners to power down and exchange their recalled device. The notice will appear every time a user powers up or charges their device."

This meant users who bought their phones before September 15 shouldn't use them they have received a replacement device through the exchange program. Earlier this week, Southwest Airlines evacuated an airplane after a passenger's Samsung Galaxy Note7 phone began popping and smoking. USA Today reported:

"The incident brings more damage to Samsung’s reputation and calls into question the very future of the Note7 itself, a phone that was highly regarded when it first hit the market in late August, before reports began to surface about batteries that caught fire. Making matters worse, the device was apparently one of the replacement handsets that the South Korean company had previously deemed “safe.” Now it appears that the issue is far from settled. The CSPC, the federal agency overseeing the U.S. recall of the Note 7, late Wednesday said it is investigating the Southwest flight incident..."

So, the replacement batteries, replacement phones, and firmware updates may not have fixed the battery problem. Given the continuing bad news, some customers may want refunds instead of replacement phones. It is unclear of Samsung will provide refunds to customers who don't want replacement devices.

Sadly, there was more bad news about Samsung products. ABC News reported on September 28:

"The U.S. Consumer Product Safety Commission (CPSC) has issued a warning about certain top-loading Samsung washing machines after reports that some exploded, ABC News has learned exclusively. The agency said it is working with Samsung on a remedy to fix the issue, which apparently affects some units made from March 2011 to April 2016..."

One affected consumer was in Dallas, Georgia and another was in Holly Springs, North Carolina. Reportedly, there have been 21 cases of exploding Samsung top-loading clothes washing machines. You can see photos of the damaged products at the ABC News website. Also, SEA announced on September 28:

"We are in active discussions with the CPSC to address potential safety issues related to certain top-load washing machines manufactured between March 2011 and April 2016. In rare cases, affected units may experience abnormal vibrations that could pose a risk of personal injury or property damage when washing bedding, bulky or water-resistant items. Samsung is recommending that consumers with affected models use the lower speed delicate cycle when washing bedding, bulky or water-resistant materials. There have been no reported incidents when using this cycle."

Now, I am not suggesting the two incidents are related. Both products probably were designed by separate engineering and development teams, and built at separate manufacturing facilities. My main points: it's been a rough time at Samsung as consumers have been inconvenienced, and in some instances placed in danger. Plus, the apparent fix seems ineffective. Will the brand recover? Can it recover?

Do you believe the battery problems are fixed with the Galaxy Note7 phones? Would you travel on an airplane where other passengers carried Samsung galaxy Note7 phones? If you purchased one of the affected products, what has been your experience? Are you satisfied with the corrective and replacement program?


4 Website Operators Settle With New York State Attorney General For Illegal Tracking of Children

Earlier this month, the Attorney General for the State of New York (NYSAG) announced settlement agreements with the operators of several popular websites for the illegal online tracking of children, which violated the Children's Online Privacy Protection Act (COPPA). The website operators agreed to pay a total of $835,000 in fines, comply with, and implement a comprehensive set of requirements and changes.

COPPA, passed by Congress in 1998 and updated in 2013, prohibits the unauthorized collection, use, and disclosure of children’s personal information (e.g., first name, last name, e-mail address, IP address, etc.) on websites directed to children under the age of 13, including the collection of information for tracking a child’s movements across the Internet. The 2013 update expanded the list of personal information items, and prohibits covered operators from using cookies, IP addresses, and other persistent identifiers to track users across websites for most advertising purposes, amassing profiles on individual users, and serving targeted behavioral advertisements.

The NYSAG operated a program titled "Operation Child Tracker," which analyzed the most popular children’s websites for any unauthorized tracking. The analysis found that four website operators include third-party tracking on their websites -- which is prohibited by COPPA -- and failed to properly evaluate third-party companies, such as advertisers, advertising networks, and marketers. The website operators and their properties included Viacom (websites associated with Nick Jr. and Nickelodeon), Mattel (Barbie, Hot Wheels, and American Girl), JumpStart (Neopets), and Hasbro (My Little Pony, Littlest Pet Shop, and Nerf).

Regular readers of this blog are familiar with the variety of technologies and mechanisms companies have used to track consumers online: web browser cookies, “zombie cookies,” Flash cookies, “zombie e-tags,” super cookies, “zombie databases” on mobile devices, canvas fingerprinting, and augmented reality (which tracks consumers both online and in the physical world). For example, the web browser cookie is a small text file placed by a website on a user’s computer which is stored by the user’s web browser.  Every time a user visits the website, the website retrieves all cookies files stored by that website on the user’s computer. Some website operators shared the information contained in web browser cookies with third-party companies, such as marketing affiliates, advertisers, and tracking companies. This allows web browser cookies to be used to track a user’s browsing history across several websites.

All of this happens in the background without explicit notices in the web browser software, unless the user configures their web browser to provide notice and/or to delete all browser cookies stored. The other technologies represent alternative methods with more technical sophistication and stealth.

The announcement by the NYSAG described each website operator's activities:

"Viacom operates the Nick Jr. website, at www.nickjr.com, and the Nickelodeon website, at www.nick.com... The office of the Attorney General found a variety of improper third party tracking on the Nick Jr. and Nickelodeon websites. These included:

1. Many advertisers and agencies that placed advertisements on Nick Jr. and Nickelodeon websites introduced tracking technologies of third parties that routinely engage in the type of tracking, profiling, and targeted advertising prohibited by COPPA. Viacom considered several approaches to mitigate the risk of COPPA violations from these third parties, including removing adult advertising from a child-directed section of the Nick Jr. website and monitoring advertisements for unexpected tracking... However, Viacom did not timely take either approach and did not implement sufficient safeguards for its users.

2. Some visitors to the homepage of the Nick Jr. website were served behavioral advertising and tracked through a third party advertising platform Viacom used to serve advertisements. Although Viacom considered the homepage of the Nick Jr. website to be parent-directed, and thus not covered by COPPA, the homepage had content that appealed to children. Under COPPA, website operators must treat mixed audience pages as child-directed..."

Mattel logo The NYSAG also found:

"... 26 of Mattel’s websites feature content for young children, including online games, animated cartoons, and downloadable content such as posters, computer desktop wallpaper, and pages for young children to color... The office of the Attorney General found that a variety of improper third party tracking technologies were present on Mattel’s child-directed websites and sections of websites. These included:

1. Mattel deployed a tracking technology supplied by a third party data broker across its Barbie, Hot Wheels, Fisher-Price, Monster High, Ever After High, and Thomas & Friends websites. Mattel used the tracking technology for measuring website metrics, such as the number of visitors to each site, a practice permitted under COPPA. However, the tracking technology supplied by the data broker introduced many other third party tracking technologies in a process known as “piggy backing.” Many of these third parties engage in the type of tracking, profiling, and targeted advertising prohibited by COPPA.

2. A tracking technology that Mattel deployed on the e-commerce portion of the American Girl website, which is not directed to children or covered by COPPA, was inadvertently introduced onto certain child-directed webpages of the American Girl website.

3. Mattel uploaded videos to Google’s YouTube.com, a video hosting platform, and then embedded some of these videos onto the child-directed portion of several Mattel websites, including the Barbie website. When the embedded videos were played by children, it enabled Google tracking technologies, which were used to serve behavioral advertisements.

JumpStart logo Regarding JumpStart, the NYSAG found:

"... several improper third party tracking technologies were present on the Neopets website, both for logged-in users under the age of 13 and users who were not logged-in. These included:

1. JumpStart failed to configure the advertising platform used to serve ads on the Neopets website in a manner that would comply with COPPA. As a result, users under the age of 13 were served behavioral advertising and tracked through the advertising platform.

2. JumpStart integrated a Facebook plug-in into the Neopets website... Facebook uses the tracking information for serving behavioral advertising, among other things, unless the website operator notifies Facebook with a COPPA flag that the website falls is subject to COPPA. JumpStart did not notify Facebook that the Neopets website was directed to children."

Hasbro logo For Hasbro, the NYSAG found:

"... several improper third party tracking technologies were present on Hasbro’s child-directed websites and sections of websites. These included:

1. Hasbro engaged in an advertising campaign that tracked visitors to the Nerf section of Hasbro’s website in order to serve Hasbro advertisements to those same users as they visited other websites at a later time, a type of online behavioral advertising prohibited by COPPA known as “remarketing.”

2. Hasbro integrated a third-party plug-in into many of its websites, that allowed users to be tracked across websites and introduced other third parties that engaged in the type of tracking, profiling, and targeted advertising prohibited under COPPA.

It is important to note that Hasbro participated in a safe harbor program. A website operator that complies with the rules of an FTC-approved safe harbor program is deemed in compliance with COPPA. However, safe harbor programs rely on full disclosure of the operator’s practices and Hasbro failed to disclose the existence of the remarketing campaign through the Nerf website."

The terms of the settlement agreements require the website operators to:

  1. Conduct regular electronic scans for unexpected third party tracking technologies that may appear on their children’s websites. Three of the companies, Viacom, Mattel, and JumpStart will provide regular reports to the office regarding the results of the scans.
  2. Adopt procedures to evaluate third-party companies before they are introduced onto their children’s websites. the evaluation should determine whether and how the third parties collect, use, and disclose, and allow others to collect, use, and disclose, personal information from users.
  3. Provide notice to third parties that collect, use, or disclose personal information of users with information sufficient to enable the third parties to identify the websites or sections of websites that are child directed pursuant to COPPA.
  4. Update website privacy policies with either, a) information sufficient to enable parents and others to identify the websites and portions of websites that are directed to children under COPPA, or b) a means of contacting the company so that parents and others may request such information.

Kudos to the NYSAG office and staff for a comprehensive analysis and enforcement to protect children's online privacy. This type of analysis and enforcement is critical as companies introduce more Internet-connected toys and products classified as part of the Internet of Things (ioT).


Proposed Legislation in Michigan For Driverless Cars

The Stanford Center For Internet & Society (CIS) analyzed several draft driverless-car bills under consideration by legislators in Michigan. The analysis highlighted the issues and inconsistencies by the proposed legislation. First, the good news. While SB 995 repeals existing laws that ban driverless cars, it:

"... would return Michigan law to flexible ambiguity on the question of the legality of automated driving in general. The bill probably goes even further by expressly authorizing automated driving: It provides that "[a]n automated motor vehicle may be operated on a street or highway on this state," and the summary of the bill as reported from committee similarly concludes that SB 995 would "[a]llow an automated motor vehicle to be operated on a street or highway in Michigan." (This provision is somewhat confusing because it would be added to an existing statutory section that currently addresses only research and testing and because it would seem to subvert many restrictions on research tests and "on-demand automated motor vehicle networks.") Regardless, this bill would also exempt groups of closely spaced and tightly coordinated vehicles from certain following-distance requirements that are incompatible with platooning."

Platooning is a method for several driverless vehicles to operate together on highways with less space in between, than otherwise. Advocates claim this maximizes the capacity of highways. What does this mean for safety? Do consumers want platooning? Can drivers opt out? If platooning is allowed, then the driverless vehicle you ultimately buy must be outfitted with that software feature.

The drawbacks of the draft legislation:

"... The currently proposed language could mean that automated driving is lawful only in the context of research and development and "on-demand motor vehicle networks." Or it could mean that automated driving is lawful generally and that these networks are subject to more restrictive requirements. It could mean that any company could run a driverless taxi service, including motor vehicle manufacturers that might otherwise face unrelated and unspecified legal impediments. Or it could mean that a company seeking to run a driverless taxi service must partner with a motor vehicle manufacturer -- or that such a company must at least purchase production vehicles, the modification of which might then be restricted by SB 927 and 928 (see below). It could also mean that municipalities could regulate and tax only those driverless taxi services that do not involve a manufacturer..."

And:

"... SB 995 and 996 understandably struggle to reconcile an existing vehicle code with automated driving. Under existing Michigan law, a "driver" is "every person who drives or is in actual physical control of a vehicle," an "operator" is "a person, other than a chauffeur, who "[o]perates" either "a motor vehicle" or "an automated motor vehicle," and "operate" means either "[b]eing in actual physical control of a vehicle" or "[c]ausing an automated motor vehicle to move under its own power in automatic mode," which "includes engaging the automated technology of that automated motor vehicle for that purpose." The new bills would not change this language, but they would further complicate these concepts in several ways..."

I encourage you to read the long list of complications in the CIS analysis. Another key issue:

"Consider the provision that "an automated driving system ... shall be considered the driver or operator ... for purposes of determining conformance to any applicable traffic or motor vehicle laws." This provision says nothing about who or what the driver is for purposes of determining liability for a violation of those laws, particularly when there is no crash. SB 996 does provide that "a motor vehicle manufacturer shall assume liability for each incident in which the automated driving system is at fault," subject to the state's existing insurance code..."

The proposed legislation is important for several reasons. Besides platooning and the list of complications, it decides: a) which types of companies can operate driverless-car networks, b) who is liable and under what conditions, and c) who can repair driverless cars. All items affect consumers rights. A narrow definition of "A" (e.g., only automakers) would mean fewer competitors, and probably higher prices due to a lack of competition. Similarly, a narrow definition of "C" could mean fewer options and choices for consumers, with higher repair prices. Liability must be clear for instances when a driverless vehicle violates road laws; and especially when there is a crash and/or fatality.

Consistency and clarity matter, too. The final legislation and definitions also should be forward-thinking. It's not just driverless vehicles but also remotely-operated vehicles. Companies want remotely-operated ships on the oceans, and remotely-operated trucks are already used off-road for mining purposes. It seems wise to anticipate that off-road use will probably migrate to roads and highways.

Clearly, the proposed legislation in Michigan is not ready yet for prime time. This topic definitely bears monitoring.


Royal Caribbean's Allure Of The Seas: Built For Families

Recently, my family and I sailed on Royal Caribbean cruise line's Allure of the Seas mega-ship from Fort Lauderdale, Florida to destinations in the Caribbean: St, Kitts, St. Thomas (USVI), and Nassau, Bahamas. This was our 26th cruise, so my wife and I have sailed on a variety of cruise lines and ships to many places around the planet. For this 7-night sailing, our daughter, son-in-law, grandchildren (ages 10 and 8), and in-laws joined us.

Our travel agent had arranged TSA Pre-Check boarding for our JetBlue flights, which made travel stress-free and easier. If you travel frequently, the fees for TSA Pre-Check are a no-brainer. We arrived in Fort Lauderdale three days before the ship's departure. We usually arrive early so any flight delays (due to weather or equipment) don't cause us to miss the cruise ship's departure. Experienced travelers know that if you miss the ship's departure, it is the passenger's responsibility (and cost) to catch up with the ship in the next port.

Early arrival in Florida also provided plenty of time to relax poolside at the hotel, explore the departure city, and sample several nearby restaurants. The Crowne Plaza Fort lauderdale Airport/Cruise featured comfortable beds, spacious rooms, and a large, relaxing pool. The main draw for us was the shuttles provided by the hotel both from the airport and to the cruise port.

The boarding process at Port Everglades, the cruise terminal in Fort Lauderdale, was well-organized and easy. We checked our luggage with the porters, and waited for our daughter and her family. When they arrived, we all entered the check-in line, passed through security, and boarded the ship. Our stateroom was ready, so we left our carry-on bags there and explored the ship. We booked an inside stateroom for this sailing, since we expected to spend very little time thee. On prior sailings we've booked outside staterooms (with a larger window) or staterooms with balconies.

The Allure OTS is a mega-ship in the truest definition. At 222,282 tons, it was the largest cruise ship for six years until Royal Caribbean's Harmony of the Seas debuted in May, 2016. Our sailing on July 24 included 6,464 passengers, of which about 1,700 were children under the age of 16. It offers 25 different dining options with a crew of 2,384. Besides the standard dining rooms, the ship offers the Chops Grille American steakhouse, Sabor Taqueria and Tequila Bar, Izumi Hibachi and Sushi, Giovanni's Table Italian restaurant, Starbucks, and a Johnny Rockets hamburger shop.

Royal Promenade. Allure of the Seas. Click to view larger version The ship includes seven "neighborhoods" or areas. Situated indoors and length-wise the cruise ship, the Royal Promenade (Deck 5) features several retail stores, art gallery, a Champagne bar, restaurants, nightclubs with live music, duty-free stores, comedy club, karaoke bar, and the customer service desk. You'll often see children posing for photos with characters from "Shrek," "Madagascar," and other animation films produced by DreamWorks Animation.

View of Carousel. Allure of the Seas. July 2016. Click to view larger version The outdoor Boardwalk (Deck 6), modeled after Coney Island amusement area in New York City, features several retail shops, ice cream and pizza, casual-dining options, a merry-go-round, and the AquaTheatre. I've never seen a merry-go-round on a cruise ship before, and I doubt you have either.

The Pool & Sports Zone (Deck 15) features the H20 Zone water park, several swimming pools, several hot-tubs that easily seat 14 persons each, plenty of deck space with umbrellas to enjoy the sun, several bars for adult refreshments, and guest services to get beach towels. Beach towels are free, but the cruise line will charge you if you don't return it. Also on Deck 15 is the full-size basketball court, miniature golf course, two Flow-Rider surf simulators, and an 82-foot long Zip Line. Lessons are available for the surf simulators.

View of Central Park. Allure of the Seas. July 2016. Click to view larger version Outfitted with 60 trees and about 12,000 plants, the Central Park (Deck 8) is an outdoor park with recorded birds chirping, upscale dining options, shady spots to relax at, and access to the Rising Tide bar. Like an elevator, this bar for adults moves between decks 5 and 8 on a daily schedule. I've never seen a park before on a cruise ship. It is definitely a must-see neighborhood. Since I practice Tai Chi, I asked if there were classes on board. A crew member replied that a group practiced in Central Park at 6:00 am. I thanked her for the tip, and didn't join that group. I was on vacation and rising early was not a priority.

The Vitality Sea Spa & Fitness Center (Deck 6); far larger than fitness centers on other cruise ships, covered two decks and featured plenty of treadmills and exercise equipment. Like other cruise ships, passengers can get their hair done in the salon for formal dinner nights, or experience a a relaxing massage (e.g., full-body,, detox, hot stone, bamboo, etc.) in the spa. There is easy access from the fitness center to the Jogging Track (2.4 laps = 1 mile). You can run, jog, or walk comfortably out of the wind and in the shade.

Flow Rider. Allure of the Seas. Click to view larger version A large portion of the ship is dedicated to children and families. This includes activities in the Adventure Ocean day-camp program, the H2O Zone water park, two 43-foot high rock-climbing walls, two Flow-Rider surf simulators, an 82-foot long Zip Line, the merry-go-round, a 3-D movie theater, a miniature golf course, a full-sized basketball court, an ice-skating rink with shows and open skating, and video arcade. The day camp program provides parents with plenty of opportunities for "couple's time."

For adults, there are several nightclubs with adult entertainment, the Solarium and Solarium Bar (decks 15 and 16), the Casino Royale (Deck 4), and numerous upscale dining options. The Allure Of the Seas truly offers plenty of activities for everyone. If you try to do it all, then you'll probably need a vacation to recover from your cruise vacation.

Rock Climbing Wall. Allure of the Seas. Click to view larger version The Allure of the Seas was refurbished in May, 2015. Several shops, public areas, and the WiFI were upgraded. Royal Caribbean's investment showed. My Internet connection was consistently very fast throughout the entire voyage; unlike other ships. If you seek quiet places on the ship (without music, noise or recorded birds chirping), there are several, including the Card Room (Deck 14), Library (Deck 11), and the Solarium (Decks 15 and 16). If you seek a place away from children, the Solarium is a good choice.

Like other Royal Caribbean cruise ships, the next day's activities are listed in the daily Cruise Compass newsletter, delivered each evening to your stateroom. This newsletter is a handy tool. It also lists discounts and sales in the on-board retail stores, hours of operation of the restaurants and dining options, movies in the cinemas, and the live entertainment daily in the theaters and nightclubs.

Royal Caribbean encourages passengers to make your reservations for dining, shows, and nightclub music performances before you sail. This is one of several new trends in cruise vacations. Many people like it. I don't. It used to be that you could arrive early for any show and walk right in. Now, walk-ins must wait until all guests with reservations are seated first. For me, this mandatory reservations system removes the spontaneity and freedom of deciding what to do based upon how you feel at that moment.

H2O Zone water park. Allure of the Seas. Click to view larger version Overall, I give the Allure of the Seas excellent marks. The ride was very smooth, and most of the time you didn't know you were at sea on a cruise ship. The ship's layout and venues are well organized, and the crew is very professional. Most of the time, I did not realize I was on a ship with 6,464 passengers. About the only time the ship felt crowded was in the Promenade. When the Promenade was crowded, it looked and felt like any land-based shopping mall between Thanksgiving and Christmas holidays. I like to go on cruises to get away from land-based attractions, not replicate them.

If you have sailed on the Allure of the Seas, what was your experience? Which neighborhood on the ship was your favorite?


Pokemon Go: The Good, The Bad, And The Ugly

Pokemon Go mobile game image. Click to view larger version The game's popularity proliferated after a July 6 launch in Australia, New Zealand, and the United States: 7.5 million downloads during its first week; 50 million downloads from Google Play during its first month; and it was WikiPedia's most visited article by mid-July. (View the game's Wikipedia pageviews.) Everyone noticed. Early in July, a former advertising coworker joked on Facebook:

" 'How about we partner with Pokemon Go?' -- Said in every office at every agency for every client this morning."

Probably. The augmented-reality (AR) mobile game requires players to travel real-life streets to find and capture digital characters superimposed on locations and displayed on the screens of players' phones. The game's screens also display PokeStops and gyms, locations superimposed on real-life landmarks. The CNN video at the end of this blog post provides a good summary. The Apple iTunes site explains important game details:

"Search far and wide for Pokémon and items: Certain Pokémon appear near their native environment—look for Water-type Pokémon by lakes and oceans. Visit PokéStops, found at interesting places like museums, art installations, historical markers, and monuments, to stock up on Poké Balls and helpful items... As you level up, you’ll be able to catch more-powerful Pokémon to complete your Pokédex. You can add to your collection by hatching Pokémon Eggs based on the distances you walk... Take on Gym battles and defend your Gym: As your Charmander evolves to Charmeleon and then Charizard, you can battle together to defeat a Gym and assign your Pokémon to defend it against all comers."

Pokemon Go mobile game image with character. Click to view larger version For many players, Pokemon Go has been a nostalgic return to their youth when Pokemon existed in cartoons, video games, and board-games. Some experts have speculated that the game's popularity, as measured by daily active users, may have peaked in the United States.

What do we know so far about the AR game? What has happened since the game's launch? What happens when a mobile fantasy game combines real-life locations? Are non-players affected? What might be the implications for future AR games? I looked for answers, found plenty, and organized my findings into good, bad, and ugly categories -- with apologies to Mr. Leone and Mr. Eastwood.

The Good

Niantic Labs developed the game for Apple iOS and Android devices. Earlier this month, the game debuted in Latin America. Reviewers have cited the game's addictive qualities:

"... Pokemon Go’s game designers have perfectly executed on the “Hook Model” — a framework for gamification and getting users to come back again and again and again."

Advocates have said that the game has gotten gamers off of their couches (e.g., butts) and out into the real world to get exercise, meet people, and explore locations they probably wouldn't have visited otherwise. Sounds good.

Within the game, PokeStops and gyms are located in publicly-accessible locations, such as theme parks, gardens, and museums. This has increased the sales at some nearby, small businesses. IGN reported on July 21:

"Bok Tower Gardens, a “contemplative garden” and National Historic Landmark located in Lake Wales, Fl, is saturated with PokeStops. The non-profit recorded a 10 to 15 percent increase in ticket sales during the first week of Pokemon Go’s release... So far, the only way to become a PokeStop or gym is to send in a request to Niantic Labs, but it isn't likely to be accepted unless the location is one of cultural significance or in a Pokemon Go deadzone."

The Twitter account Pokemon Archaeology catalogs Pokemon sightings in historic locations. The National Park Service (NPS) has welcomed gamers in many of its parks, but not at memorial sites. Some National Parks have featured programs with the game. Earlier this month, the Sleeping Bear Dunes National Lakeshore offered a new program called "Pokemon Hunt:"

"... to connect “Pokemon Go!” with real-world flora and fauna... This interactive, ranger-guided walk will allow visitors to uncover the creatures, both physical and virtual, that can be found within the National Lakeshore. They will learn how these creatures do or do not fit in with the rest of the environment, and what can be done to help them thrive. At the end of the program, visitors will be able to design their own Pokemon. “Trainers” of all ages are welcome."

This summer, the NPS celebrates 100 years of operations. Gamers should check the NPS site to learn about any discounts and programs before visiting a park.

Some local businesses near colleges and universities experienced increased sales from gamers. Minnesota Daily reported:

"Many local Minneapolis businesses have considered, or implemented, special promotions to attract more mobile-gamers. Last week, Sencha Tea Bar in Stadium Village released three special shakes in correspondence with the three color teams of the game — red, yellow and blue — said store manager Josh Suwaratana. Suwaratana said the store does special shakes for other occasions, so the Pokemon shakes weren’t anything out of the ordinary... Sencha is also located next to a Pokestop — a real-life location where players can obtain items in the game. Suwaratana said the proximity to the Pokestop has helped business attract players."

The BBC News reported that the game helped an autistic teenager. Autism Speaks published this perspective by a psychologist:

"... I would encourage parents to seize the opportunity for their children to capitalize on this gaming experience while at the park or when running errands. My advice is not to judge this new gaming experience as all bad and in need of limits. Rather let’s embrace a step toward video games and virtual reality that may one day be tailored to inspiring those we love with autism spectrum disorder (ASD) to leave the house and receive points/rewards/tokens for gathering information from other people they encounter in the store, at work, or at a place of leisure. To me that sounds an awful lot like what I have been trying to get them to do by learning social skills in my office each week..."

To focus the world's attention upon the impacts to citizens and children, activists have added Pokemon characters to images from war zones. C/Net reported on July 26 that Khaled Akil, a Syrian artist:

"... has taken Pokemon Go creatures and Photoshopped them into pictures of his war-torn homeland, presenting a stark contrast between the whimsy of the augmented-reality game and the sobering day-to-day realities of war... In one image, a young boy walks his bike through a street lined by bombed-out buildings, a Vaporeon by his side. In another, a Pikachu rests on a block of rubble next to a burning car... the activist group Revolutionary Forces of Syria Media Office has been tweeting poignant photos of kids holding up printouts of popular Pokemon creatures, along with their locations, which are identified as being near areas of heavy fighting, and the words 'save me'..."

To view photos, follow the links in the C/Net article to Akil's website and Instagram account.

The Niantic Terms of Service policy clearly encourages safe game play and describes players' responsibilities:

"During game play, please be aware of your surroundings and play safely. You agree that your use of the App and play of the game is at your own risk, and it is your responsibility to maintain such health, liability, hazard, personal injury, medical, life, and other insurance policies as you deem reasonably necessary for any injuries that you may incur while using the Services. You also agree not to use the App to violate any applicable law, rule, or regulation (including but not limited to the laws of trespass) or the Trainer Guidelines, and you agree not to encourage or enable any other individual to violate any applicable law, rule, or regulation or the Trainer Guidelines. Without limiting the foregoing, you agree that in conjunction with your use of the App you will not inflict emotional distress on other people, will not humiliate other people (publicly or otherwise), will not assault or threaten other people, will not enter onto private property without permission, will not impersonate any other person or misrepresent your affiliation, title, or authority, and will not otherwise engage in any activity that may result in injury, death, property damage, and/or liability of any kind."

The "Conduct, General Prohibitions, and Niantic’s Enforcement Rights" section of the policy also lists the responsibilities of players, including players will not:

"... trespass, or in any manner attempt to gain or gain access to any property or location where you do not have a right or permission to be..."

So, it is important for players to know their responsibilities. Do they? Keep reading.

The Bad

Foot traffic by gamers in public parks hasn't been all good. Some gamers have ignored local laws and ordinances. WPRI in Providence, Rhode Island reported:

"Members of the East Providence Police Department said “Pokemon Go” has drawn huge crowds of people to local parks after hours... Officers say they have responded to several calls about the crowds. “They are very peaceful, they’re not causing problems, but it is in a public area – in public parks – and people who live in those areas do deserve to have their rest at night,” said Maj. William Nebus of the East Providence Police Department. “Our parks do close at 9 p.m. and just to have 200 people lurking in overnight hours is not peaceful to the residents.”

Law enforcement in Michigan ticketed players with misdemeanors after late-night, 12:30 a.m. game play. Nearby property owners have found players intrusive. There are two implications. First, it's important for players to understand and comply with local town ordinances and hour restrictions. Second, taxpayers will likely absorb the additional costs of park maintenance, clean-up, and law enforcement patrols to address the increased foot traffic in local parks.

It's critical for players to remain alert. In somewhat weird news, a gamer kept playing after being stabbed by a mugger. And a North-Texas teenager was bitten by a venomous snake while playing. In Missouri, criminals staked out known PokeStops and robbed players. A gamer in Riverton, Wyoming found a dead body.

While some gamers play on foot, others drive their vehicles. As you've probably guessed, there have been auto accidents. The Atlanta Journal-Constitution reported:

"A driver, distracted by a Squirtle or a Zubat, caught a tree, instead of a Pokemon. That collision occurred last month in Auburn, N.Y., near Syracuse. A few days later, a 28-year-old driver on a highway near Seattle told officials he was focused on the hunt for Pikachu when he ran into the rear end of a Chevrolet. Another distracted driver in Baltimore smashed into a police car. A parked police car."

Like any game, some gamers play by the rules while others don't. An entertaining video listing the ways players cheat has more than 6.7 million views. Niantic highlighted its policy toward cheaters:

"Your account was permanently terminated for violations of the Pokémon GO Terms of Service. This includes, but is not limited to: falsifying your location, using emulators, modified or unofficial software and/or accessing Pokémon GO clients or backends in an unauthorized manner including through the use of third party software."

Soon after the game's debut, privacy risks were discovered:

"Security researcher Adam Reeve noted that when some users sign into Pokemon Go through Google on Apple devices, they effectively give the game and its developer full access to their Google account; this means, that at least in theory, Niantic... can access players' Gmail-based email, Google Drive based files, photos and videos stored in Google Photos, and any other content within their Google accounts. From a technical perspective, Niantic could potentially send emails on your behalf, or copy and distribute your photos. This is obviously concerning. Perhaps even scarier - and more eye-opening - is that users are accepting such permissions en masse without regard for the risks."

Since then, Niantic and the Pokemon Company notified Engadget that it fixed the bug in a subsequent update. Regardless, the Offensive Privacy blog warned players who have signed up using their Google credentials:

"... to review Google's guide on controlling and revoking app access to your account and check your account to see what permissions the game has. If it still has full access to your Google account, you can simply revoke access, then sign-in to the game again using your Google account. Your data will be safe and you can ensure your Google account is safe as well."

The Offensive Privacy blog offered privacy tips given the game's usage of smartphone cameras:

"While it's a bit outlandish to think that Niantic collects the video streams from every device, it is always a possibility that cannot be completely ruled out. This means anything your camera sees could, in theory, be stored by Niantic... I suggest some common sense tactics that apply to all cameras and video streams when using the AR mode of the game: 1) Never allow the camera to see personal ID such as your license, passport, or other sensitive document; 2) Never let the camera see a license plate or government building. This is especially true for those working in high-security environments; and 3) Avoid letting the camera see street signs, your house, house numbers, etc. It's also possible that metadata could be embedded in the image and made available if the image is shared publicly..."

Regular readers of this blog are already familiar with the privacy issues associated with metadata collection. Some players may be surprised that tips to maintain privacy while playing requires effort.

Yes, security researchers have already found malware embedded in a rogue version of the Pokemon Go app. So, shop wisely at reputable sites and follow these tips to avoid the malware.

One measure of popularity are parodies. There is a porn parody of the game titled, "Poke-mon Ho!" Depending upon your lifestyle, you might categorize this as "good." Yes, the parody reportedly is NSFW. No, I haven't seen it.

The Ugly

Some property owners view the game as inappropriate for their locations. CNN Reported in July:

"The United States Holocaust Memorial Museum and Arlington National Cemetery, both in Washington, DC area, have both issued appeals for players to avoid hunting Pokemon on their sites. "Playing Pokemon Go in a memorial dedicated to the victims of Nazism is extremely inappropriate," said Andy Hollinger, director of communications at the United States Holocaust Memorial Museum in Washington, D.C., in a statement sent to CNNMoney. "We are attempting to have the Museum removed from the game," the statement said... Pokemon Go has a link set up for people to report sensitive locations and contact on its website... According to a statement from The Pokemon Company International and Niantic -- the creators of Pokemon Go -- Pokestops and gyms in the app are found at publicly accessible places. That includes historical markers, public art installations, museums, monuments -- and apparently churches."

I see two problems with the approach the game's developers used. First, the approach seems to have treated all public spaces the same, without considering the unique needs of cemeteries, memorials, and similar places. Game-play isn't appropriate everywhere. Second, Niantic's approach automatically included real-life locations as PokeStops and gyms without first obtaining the property owners' permissions. This approach places the burden on property owners (who aren't players nor participants) to opt-out of the game. Not good. Maybe this was a slick attempt to force property owners to participate. Not good.

Some players have wandered onto nearby private properties. ComputerWorld reported on August 2:

"Jeffrey Marder, a resident of West Orange, N.J., found in the days after the release of the successful augmented reality game Pokémon Go, that strangers, phone in hand, had begun lingering outside his home. At least five of them knocked on Marder’s door and asked for access to his backyard to catch and add to their virtual collections of the Pokémon images, superimposed over the real world, that the game developer had placed at the residence without his permission."

Marder is part of a lawsuit alleging that the game included locations on private properties, without the owners' permissions. The Click on Detroit site reported on August 15:

"Scott Dodich and Jayme Gotts-Dodich, of St. Clair Shores, filed a class action lawsuit against Niantic, The Pokemon Company and Nintendo... The couple lives on a private cul-de-sac and alleges that over several weeks, Pokemon Go players parked their vehicles on their street and blocked driveways. The couple also alleges that players trespassed on lawns, trampled landscaping and peered into windows. The complaint also alleges that when Jayme Gotts-Dodich asked a Pokemon Go player to leave her property, the player told her to “shut up b****, or else... The suit alleges that the intentional, unauthorized placement of Pokestops and Pokemon gyms on or near private property constitutes a continuing invasion of use and enjoyment. Due to the ignored repeated requests for removal, the couple believes that Niantic is liable for nuisance and that all defendants have been unjustly enriched.”

If a disagreement arises between Niantic and a player, that may not be resolved in court in front of a jury of the gamer's peers. The Niantic Terms of Service policy strips gamers of that right:

"ARBITRATION NOTICE: EXCEPT IF YOU OPT OUT AND EXCEPT FOR CERTAIN TYPES OF DISPUTES DESCRIBED IN THE “AGREEMENT TO ARBITRATE” SECTION BELOW, YOU AGREE THAT DISPUTES BETWEEN YOU AND NIANTIC WILL BE RESOLVED BY BINDING, INDIVIDUAL ARBITRATION, AND YOU ARE WAIVING YOUR RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS ACTION OR REPRESENTATIVE PROCEEDING."

To opt out of binding arbitration, players must do so within 30 days of sign up. This BoingBong explained how to opt out, and the associated issues. Of course, players should read all game policies in their entirety before sign up. (You did, right?) Regular readers of this blog are familiar with the issues with binding arbitration.

The Future

Given the success so far of Pokemon Go, it seems wise to expect copycats. The Motely Fool speculated:

"Pokemon Go has added a new layer of excitement to a day at Disney World for those who seek that variety of enchantment. Disney is benefiting from the craze, even as non-players shake their heads while swerving around distracted gamers. This also could and should be just the beginning. It's only a matter of time before it rolls out its own augmented-reality app... A Disney app likely also wouldn't include a Pokemon-like battle element, at least not in terms of pitting Pluto against Yoda in combat. However, the Disney gym equivalent could be mini-game stations offering everything from speed Disney trivia matches to Virtual Magic Kingdom-type competitions... There are more than 200 Disney Store locations scattered across North America, and more than 120 overseas. These stores can also serve as character-collecting hubs, giving players a local connection for special events. It would also keep interest active outside of theme park visits..."

You can bet we'll see many more AR games with fantasy or fictional characters; probably with co-marketing agreements between AR games, movies, fast-food restaurants, toy stores, and the few remaining shopping malls. Experts estimate the global AR market to be $117.4 billion by 2022.

It's not just fantasy characters. Experts have estimated the augmented reality and virtual reality market within healthcare to be $2.54 billion by 2020. Hopefully, more games (and other services) will offer in their policies opt-out mechanisms from restrictive binding arbitration clauses.

What are your opinions of Pokemon Go? Of AR games? What advantages and disadvantages have you found? Does the good outweigh the bad?


Data Breaches At HEI Hotels & Resorts Affects 20 Properties In At Least 10 States

HEI Hotels and Resorts logo On Friday, Hei Hotels and Resorts (HEI) announced data breaches that affected 20 properties in 11 states. According to the company's breach notice, hackers installed malware within the company's payment processing systems to collect customers' payment data.

The payment information stolen included the names, payment card account numbers, card expiration dates, and verification codes of customers who used their payment cards at point-of-sale terminals. The list of hotels by state:

State City & Property
California La Jolla: San Diego Marriott La Jolla
Pasadena: The Westin Pasadena
San Diego: Renaissance San Diego Downtown Hotel
San Francisco: Le Meridien San Francisco
Santa Barbara: Hyatt Centri Santa Barbara
Colorado Snowmass Village: The Westin Snowmass Resort
District of Columbia Washington: The Westin Washington DC City Center
Florida Boca Raton: Boca Raton Marriott at Boca Center
Fort Lauderdale: The Westin Fort Lauderdale
Miami: Royal Palm South Beach Miami
Tampa: InterContinental Tampa Bay
Illinois Chicago: Hotel Chicago Downtown
Minnesota Minneapolis: The Hotel Minneapolis Autograph Collection
Minneapolis: The Westin Minneapolis
Pennsylvania Philadelphia: The Westin Philadelphia
Tennessee Nashville: Sheraton Music City Hotel
Texas Fort Worth: Dallas Fort Worth Marriott Hotel & Golf Club
Vermont Manchester Village; Equinox Resort Golf Resort & Spa
Virginia Arlington: Le Meridien Arlington
Arlington: Sheraton Pentagon City

The exact date of the breaches varied by property. Some breaches occurred as early as March, 2015 while others continued until as recent as June 17, 2016. A card processor notified HEI of the breach. The HEI breach notice stated:

"We are treating this matter as a top priority, and took steps to address and contain this incident promptly after it was discovered, including engaging outside data forensic experts to assist us in investigating and re mediating the situation and promptly transitioning payment card processing to a stand-alone system that is completely separated from the rest of our network. In addition, we have disabled the malware and are in the process of re configuring various components of our network and payment systems to enhance the security of these systems. We have contacted law enforcement and will continue to cooperate with their investigation. We are also coordinating with the banks and payment card companies. While we are continuing to review and enhance our security measures, the incident has now been contained and customers can safely use payment cards at all HEI properties."

HEI is notifying affected customers and consumers that may have been affected:

"... We recommend that customers review credit and debit card account statements as soon as possible in order to determine if there are any discrepancies or unusual activity listed. We urge customers to remain vigilant and continue to monitor statements for unusual activity going forward. If they see anything they do not understand or that looks suspicious, or if they suspect that any fraudulent transactions have taken place, customers should immediately notify the issuer of the credit or debit card. In instances of payment card fraud, it is important to note that federal laws and cardholder policies may limit cardholders’ responsibility for fraudulent activity; we therefore recommend reporting any suspicious activity in a timely fashion to the bank that issued the card..."

The HEI breach notice contains more information for affected consumers to review their credit reports, place Fraud Alerts, and place Credit Freezes.

HEI appears to have been caught unprepared. It did not detect the intrusion, and its breach notice did not arrange for any free credit monitoring for affected consumers. Hopefully, more information is forthcoming.

If you received a breach notice from HEI, what are your opinions of the breach? Of HEI's response so far?


Federal Court Upholds State Laws To Restrict And Prevent City-Run Broadband Services

Last week, a federal appeals court overturned a Federal Communications Commission (FCC) ruling allowing community (a/k/a "city-run" or municipal) high-speed Internet service providers (ISPs) to expand into areas not served by commercial providers. The court decision immediately affects the expansion plans of community ISPs in Tennessee and North Carolina.

Community high-speed or broadband ISPs typically provide faster speeds (e.g., upload, download) and lower prices compared to commercial ISPs. Both states had passed laws preventing community ISPs from expanding, or making it onerous to expand. he FCC sought to stop such laws to encourage more competition, more choices, and lower prices for consumers.

The initial Reuters news report did not explain the rationale the court used. ABC News reported:

"The appeals court said that the FCC's order pre-empted the state laws and "the allocation of power between a state and its subdivisions." The court said the FCC's action requires a "clear statement" of authority in federal law, but the law does not contain a clear statement authorizing pre-emption of Tennessee's and North Carolina's laws... The appeals court said its ruling was a limited one, and it does not address other issues debated in the case, including whether the FCC has any pre-emptive power at all under the Telecommunications Act of 1996."

Chattanooga, Tennessee advertises itself as "Gig City," and is proud of its fiber broadband network:

"Only in Chattanooga, Tennessee is 1 Gigabit-per-second Internet speed available to every home and business - over 150,000 of them - throughout the entire community. Urban or rural, business or residence, Internet speeds that are unsurpassed in the Western Hemisphere – from 50 Megabits-per-second all the way up to one gigabit-per-second are accessible here. Today... Chattanooga's Fiber Optic network enables upload and download speeds 200 times faster than the current national average, and 10 times faster than the FCC's National Broadband Plan (a decade ahead of schedule)."

How fast is that? You can download a full-length movie in about 2 minutes. Is that faster than the broadband speed you get in your town or city? Probably. Is it cheaper than what you're paying? Probably.

The Attorneys Generals in several states have worked to prevent their residents from forming city-run ISPs. Tennessee Attorney General Herbert H. Slattery III released a statement:

"We are pleased with the 6th Circuit decision reversing the FCC’s Order. As we have stated from the outset, this case was not about access to broadband. Instead, it was about preventing the federal government from exercising power over the state of Tennessee that it does not have. Current state law allows a municipal Power Board to provide internet service only within its electric service area. Today’s decision preserves Tennessee’s right to determine the authority and market area of a political subdivision organized under Tennessee law."

The trade associations that represents corporate ISPs, US Telecom released a statement:

"Today’s decision is a victory for the rule of law. The FCC’s authority is not unbridled, it is limited to powers specifically delegated by the Congress, and it does not extend to preemption of state legislatures’ exercise of jurisdiction over their own political subdivisions. As an industry that shares the commission’s interest in accelerating broadband deployment, we would suggest that the best way for the FCC to accomplish its goals is to concentrate on eliminating federal regulatory impediments to innovation and investment – where there remains to be much that can and should be done."

Of course, the trade group is happy with the court decision. State laws that restrict or prevent city-run ISPs mean less competition, which makes it easier for corporate ISPs to maintain higher prices and slower speeds (which equals greater profits).

Community ISPs provide benefits for small businesses, and not only consumers. The benefits include more jobs, better services, and the ability of local towns to attract new businesses and start-ups. These benefits apply to rural areas, too; especially rural areas not served by corporate ISPs.

The Community Broadband Networks site described the benefits for small businesses of community broadband in North Carolina:

"... Speed is important, but so is Internet choice, reliable service, and respectful customer service... Before Greenlight began serving Pinetops, the best community members could get was sluggish Centurylink DSL - or Internet access offered over the phone lines... Suzanne Coker Craig, owner of CuriosiTees, described the situation... Her business, a custom screen printing shop, uses an “on-time” inventory system, so speed and reliability is critical for last-minute or late orders... She also subscribes to Greenlight from home and her fiber connection is able to manage data intense uploads required for sending artwork, sales reports, and other large document transfers... Brent Wooten is a sales agent and Manager for Mercer Transportation, a freight management business... moving freight across the country via trucks, requires being on time; he’s an information worker in a knowledge economy... Before Greenlight came to town, Brent’s business paid Centurylink $425 per month for a few phone lines, long distance, an 800 number, and Internet access at 10 Megabits per second (Mbps) download and 1.5 Mbps upload. He was also wasting hours and even days each month trying to get his Internet fixed... When Greenlight came to the community, Centurylink changed their tune. Within hours of his business phone being ported to Greenlight, a Centurylink representative called him. “He offered to cut my current prices in half and double my Internet speed, from 10 to 20 Mbps…My Centurylink 10 Mbps speed never tested at more than 6 Mbps.” Brent chose to keep his Centurylink phone service, but he kept his 25 Mbps symmetrical Greenlight Internet service because upload speed is critical to his business..."

Will these rural consumers and small businesses lose their community broadband services? Given the court decision, that is possible. Will the court decision negatively affect jobs? Probably, since many small businesses depend upon the faster community ISPs. FCC Chairman Wheeler stated:

"While we continue to review the decision, it appears to halt the promise of jobs, investment and opportunity that community broadband has provided in Tennessee and North Carolina. In the end, I believe the Commission’s decision to champion municipal efforts highlighted the benefits of competition and the need of communities to take their broadband futures in their own hands.

In the past 18 months, over 50 communities have taken steps to build their own bridges across the digital divide. The efforts of communities wanting better broadband should not be thwarted by the political power of those who, by protecting their monopoly, have failed to deliver acceptable service at an acceptable price. The FCC’s mandate is to make sure that Americans have access to the best possible broadband. We will consider all our legal and policy options to remove barriers to broadband deployment wherever they exist so that all Americans can have access to 21st Century communications. Should states seek to repeal their anti-competitive broadband statutes, I will be happy to testify on behalf of better broadband and consumer choice. Should states seek to limit the right of people to act for better broadband, I will be happy to testify on behalf of consumer choice...”

In January 2015, several U.S. Senators introduced the Community Broadband Act legislation in to block these restrictive laws in 20 states and to encourage more competition and lower prices for more consumers by allowing residents the right to operate city-run ISPs offering faster speeds and lower prices. Last week, Senator Ron Wyden (Oregon - Democrat) tweeted about the federal court decision:

Tweet by Senator Ron Wyden about Community Broadband Act

The legislation has stalled in the Republican-led Congress. Once again, you will hear politicians shout about the importance of defending state's rights against the FCC, while ignoring the rights of rural and small town residents to form community ISPs. Hypocritical politicians do this to protect their corporate ISPs donors from competition, which basically screws over residents by keeping prices high and speeds slow.

Residents in rural areas, small towns, and cities can claim, "we've been mugged" by state' legislatures that enacted laws preventing competition (and lower prices) from community ISPs.

Researchers compared high-speed Internet services worldwide, and found that consumers in the USA pay more and get slower speedsAnd Get Slower Speeds. That's great for corporate ISP profits and bad for consumers. The Community Broadband Act is an attempt to solve this problem.

Read the court decision: State of Tennessee, and the State of North Carolina; versus the U.S. Federal Communications Commission - (Adobe PDF). The FCC is reviewing the court's decision, and has not decided whether to appeal it.

The court decision is definitely pro-state law and anti-consumer. The court decision basically allows states to continue with laws that deny residents in local cities and towns the right to form, operate, and expand their own municipal broadband services to get lower prices and better services. That means less competition and higher prices for consumers living in states with these laws. Consider that when you vote in November.


The U.S. Copyright Office Commented on The FCC's Set-top Box Proposal

Federal communications Commission logo After the U.S. Federal Communications Commission proposed in February new set-top box rules for cable TV providers to encourage innovation, choices, and lower prices for consumer, the pay TV industry countered with its own proposal in June. Earlier this month, the U.S. Copyright Office shared its views about the matter.

Maria A. Pallante, a United States register of Copyrights and Director, provided the agency's views in a detailed 18-page letter to the FCC. The FCC used "Multi-Channel Video Programming Distributors" (MBPD) in its proposal to refer to the variety of companies (e.g., cable TV, wireless, Internet distributors, etc.) that distribute TV,, film, and video content. Pallante's letter is available at the Electronic Frontier Foundation (EFF) website:

"As requested, our comments pertain to the potential copyright implications of the Proposed Rule, as well as the general copyright principles at issue. Please note that although the Copyright Office did not file public comments in the FCC proceeding, the FCC did request our advice on the copyright issues raised by its proposal... we have no doubt that a number of the third-party products facilitated by the FCCs rule would enable fair and other nonfringing consumer uses of MVPD programming. The Copyright Office is therefore focused on whether these goals can be accomplished without overriding other concerns of copyright law and policy. The Office's principal reservation is that, as currently proposed, the rule could interfere with copyright owners' rights to license their works as provided by copyright law, and restrict their ability to impose reasonable conditions on the use of those works through the private negotiations that are the hallmark of the vibrant and dynamic MVPD marketplace..."

In short, the TV landscape today consists of many, secret, complicated licensing agreements between content producers and distributors. A Forbes Magazine article by Larry Downes described the landscape:

"Hollywood, for better and for worse, is built on a complicated legal regime of content licensing. That licensing limits when, where, and how programs are broadcast, and to whom. It includes limitations of the number and types of commercials that can be inserted into the programming, and even where in the channel line-up the programs will appear to consumers. Licensing agreements between producers and distributors are long, complicated, and mostly secret.

Opening the information flows for undefined new forms of access through new set-top boxes will almost certainly undermine those agreements. Third party boxes may change the channel line-up, replace the commercials, or offer programs on-demand that aren’t licensed for that use. Existing security and consumer privacy protections, mandated by law for pay TV providers, can’t be enforced by the FCC against new unregulated providers."

What we consumers see on TV, when we see it, how often we wee it, the number of commercials we see during shows, whether the show can be recorded (e.g., time shifted), whether the show can be device shifted (e.g., from television to a phone, tablet), and whether we see the show on pay-per-view, on-demand, on an Internet site, and/or on our phones are all governed by those private contracts.

Pallante's letter described the landscape similarly, but in greater detail. It also analyzed the FCC's proposed set-top box rule:

"In its most basic form, the rule contemplated by the FCC would seem to take a valuable good -- bundled video programming created through private effort and agreement under the protections of the Copyright Act -- and deliver it to third parties who are not in privity with the copyright owners, but who may nonetheless exploit the content for profit. Under the Proposed Rule, this would be accomplished without compensation to the creators or licensors of the copyrighted programming, and without requiring the third party to adhere to agreed-upon license terms. Indeed, a third party would have no way of knowing all of the requirements and liitations imposed under that license. As a result, it appears inevitable that many negotiated conditions upon which copyright owners license their works to MVPDs would not be honored under the Proposed Rule..."

"The FCC has stated that the Proposed Rule is not intended to negate these private contractual arrangements. However, it is not clear how the FCC wold prevent such an outcome under the Proposed Rule, for it appears to obligate MVPDs to deliver licensed works to third parties that could then unfairly exploit the works in ways that would be contrary to the essential conditions upon which the works were originally licensed... Thus, rather than being passive conduits for licensed programming, it seems that a broad array of the third-party devices and services would be enabled by the Proposed Rule would essentially be given access to a valuable bundle of copyrighted works, and could repackage and re-transmit those works for a profit, without having to comply with agreed contractual terms. And even though such activities -- for instance, competing or incompatible advertising -- could easily lessen the value of the rights licensed by program producers to the MVPDs, no offsetting compensation would flow back to the copyright holders or their actual licensees. THe Proposed Rule would thus appear to inappropriately restrict copyright owners' exclusive right to authorize parties of their choosing to publicly perform, display, reproduce and distribute their works according to agreed conditions, and to seek remuneration for additional uses of their works."

The Copyright Office's letter also discussed enforcement issues:

"... there already exists today a variety of third-party set-top box devices, mainly produced overseas, that are used to view pirated content delivered over the Internet. A reasonable concern is that, in response to the Proposed Rule, this market might expand to encompass devices designed to exploit the more readily available MVPD programming streams without adhering to the prescribed security measures. In addition, some commenters have suggested that limiting options for content security in this manner could jeopardize robust content security regimes -- including innovations to those systems -- thereby opening doors for third parties to acquire content illegally..."

Pallante and the Copyright Office concluded:

"We note that at the July 12th Congressional oversight hearing, FCC Commissioners acknowledged that they might choose to follow a different approach to achieve the FCC's objectives than that outlined in the NPRM, and that emerging alternative proposals showed promise. The Copyright Office is therefore hopeful that the FCC will refine its approach as necessary to avoid conflicts with copyright law and authors' interests under that law... it seems critical that any revised proposal respect the authority of creators to manage the exploitation of their copyrighted works through private licensing arrangements, because regulatory actions that undermine such arrangements would be inconsistent with the rights granted under the Copyright Act..."

So, the FCC's set-top box rule as initially proposed is too disruptive, and is effectively dead, since it would interfere with copyright owners' rights to license their content. Hopefully, the FCC won't give up and will refine its set-top box approach.

Pallante's letter to the FCC is also available here (Adobe PDF; 278.1K).


Security Flaws Place 900 Million Android Phones And Tablets At Risk

Researchers have found a security flaws that could place as many as 900 million Android operating system (OS) phones and tablets at risk. The four vulnerabilities, called "Quadrooter," allows attackers to take complete control of phones which use the Qualcomm chip. Which phones are affected? C/Net reported:

"Google's own branded Nexus 5X, Nexus 6, and Nexus 6P devices are affected, as are Samsung's Galaxy S7 and S7 Edge, to name just a few of the models in question. The recently-announced BlackBerry DTEK50, which the company touts as the "most secure Android smartphone," is also vulnerable to one of the flaws."

Researchers at Check Point discovered the security flaws. The Check Point blog explained:

"QuadRooter is a set of four vulnerabilities affecting Android devices built using Qualcomm chipsets. Qualcomm is the world’s leading designer of LTE chipsets with a 65% share of the LTE modem baseband market. If any one of the four vulnerabilities is exploited, an attacker can trigger privilege escalations for the purpose of gaining root access to a device... Since the vulnerable drivers are pre-installed on devices at the point of manufacture, they can only be fixed by installing a patch from the distributor or carrier. Distributors and carriers issuing patches can only do so after receiving fixed driver packs from Qualcomm..."

The Check Point blog listed affected phones and tablets. It also emphasized:

"This situation highlights the inherent risks in the Android security model. Critical security updates must pass through the entire supply chain before they can be made available to end users. Once available, the end users must then be sure to install these updates to protect their devices and data."

Wow! There it is in writing for all to read. And we know from prior reports that manufacturers and wireless carriers don't provide OS updates for all Android phones.

Reportedly, Google said the security patch will be available in September.

We've been here before. Google needs to fix its Android security model. If it doesn't (or can't), that may make consumers doubt the reliability and trustworthiness of Google driverless cars.