EFF data protection report criticises WhatsApp but praises Apple
|
Version 0 of 1. Apple, Dropbox and Automattic are amongst the companies earning a five-star rating for their defence of user data in the latest edition of the Electronic Frontier Foundation’s annual report, “Who has your back?” The report, which assesses companies on five criteria, ranging from their support for pro-privacy public policy to their disclosure of government data demands, also gives high marks to Yahoo! and Wikimedia, the body behind the online encyclopedia Wikipedia. But two companies, WhatsApp (rated separately from parent company Facebook) and AT&T get just one star, with both losing marks for not telling users about government data demands and not disclosing their policies on data retention, amongst other criticisms. The report, now in its fifth year, has tightened up the criteria required to get a five-star rating, after the wide-ranging success of the EFF’s previous demands. “The criteria we used to judge companies in 2011 were ambitious for the time, but they’ve been almost universally adopted in the years since then,” the group declared. “Now, users should expect companies to far exceed the standards articulated in the original Who Has Your Back report. Users should look to companies like Google, Apple, Facebook, and Amazon to be transparent about the types of content that is blocked or censored in response to government requests, as well as what deleted data is kept around in case government agents seek it in the future. We also look to these companies to take a principled stance against government-mandated backdoors.” Five stars available The report awards companies a star for each one of five criteria they satisfy. The first is awarded for following “industry-accepted best practices” on government data requests, such as requiring a warrant before it will hand over data, publishing regular transparency reports, and establishing public guidelines explaining how they respond to data requests. In previous years, each of those three were a standalone criteria, but in keeping with the EFF’s desire to raise standards, companies must now fulfil all three before they are awarded a star. The second criterion is for companies to inform users about government data requests “unless prohibited by law, in very narrow and defined emergency situations, or unless doing so would be futile or ineffective”. Additionally, the report requires companies to give that notice in advance, so that the user has the opportunity to defend themselves against government demands for data. Third, the EFF requires companies to publicly disclose their data retention policies, so that users can know how long information, including logged IP addresses and deleted content, stay on the companies servers in a form accessible to law enforcement. Fourth, a star is awarded for companies who disclose “the number of times governments seek the removal of user content or accounts and how often the company complies”. Finally, the report awards a star to companies who take a specific pro-user public policy position – this year, that entails opposing “the compelled inclusion of deliberate security weaknesses or other compelled back doors”. WhatsApp, one of the two companies with the joint-worst score, gets its only star for the public position taken by its parent company Facebook against back doors. Apart from that, “there is room for WhatsApp to improve”, the report says. “WhatsApp should publicly require a warrant before turning over user content, publish a law enforcement guide and transparency report, have a stronger policy of informing users of government requests, and disclose its data retention policies.” |