AI Enables Data Brokers to Create “Detailed Dossiers”
AI Enables Data Brokers to Create “Detailed Dossiers”
Industry on an uphill growth curve; proposed acts in Congress seen as needed to elevate data privacy; software startup Onerep offers a consumer protection tool
By John P. Desmond, Editor, AI in Business
The headline on a recent article from The Brennan Center for Justice reads: “Data Brokers are Running Wild and Only Congress Can Rein Them In.”
The account describes how data brokers in a $200 billion annual industry assembles, analyzes and sells data from mobile apps, cookies and other sources “to create detailed dossiers on millions of Americans.”
The industry existed before AI went mainstream, and now, AI is making the data broker’s job easier. President Biden’s recent Executive Order on AI acknowledges that AI enables data brokers to more readily “extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires.”
The authors of the account, Elizabeth Goitein and Emile Ayoub, state, “The lack of a comprehensive data privacy protection law in the United States and a reliance on illusory “notice-and-consent” regimes have spawned a market for data brokers to trade in people’s personal data.”
Goitein, senior director of the Brennan Center for Justice’s Liberty & National Security Program, is a nationally-recognized expert on presidential emergency powers, government surveillance, and government secrecy. Ayoub, counsel in the center’s Liberty & National Security Program, focuses his work on surveillance and the impact of technology on civil rights and civil liberties.
Two Proposals in Congress Aim to Shore Up Privacy
The two identify two bills, detailed in a related account headlined, “Closing the Data Broker Loophole,” working their way through Congress: the Fourth Amendment Is Not For Sale Act and the American Data Privacy and Protection Act.
The Not for Sale Act would close the data broker loophole and update the Electronic Communications Privacy Act to bar law enforcement and intelligence agencies from purchasing certain communications-related information and location data, according to the Brennan account.
The Data Privacy Act comes from a consumer privacy point of view, and “promises to reduce the amount of personal information flowing into and out of the hands of data brokers,” the authors state, by restricting the collection of information to only what is necessary to provide a service.
The authors suggest ways to strengthen each bill. “These bills, with the modifications we suggest, point the way forward. The data broker loophole is growing wider by the day, and it threatens to swallow the privacy protections provided in statutes and even in the Constitution. Congress must intervene to bring the law in line with the modern world.”
Global Surveillance Network Enabled by Ad Industry
The actual state of affairs regarding person privacy may be a lot worse than the Brennan authors lay out. “It turns out that hundreds of thousands of apps, some of which are quite popular … are part of a global surveillance network that involves the ad industry, and uses these ads to create user profiles that can track all sorts of private and personal information,” stated Zia Muhammad, cybersecurity research and PhD scholar at the Institute for Cyber Security Education and Research at North Dakota State University, in a recent account in Digital Information World.
This state of affairs is due to use of a “mass monitoring tool” called Patternz, that was discovered during an investigation conducted by 404 Media that found small ad agencies up to Google itself involved. “This tool has turned people’s smartphones into tracking bracelets,” Muhammad stated.
The researchers found that Patternz processes an estimated 90 terabytes of data on a daily basis, and that 5 billion user IDs “have been scoured to create profiles that can be used for tracking purposes.” The investigation found that 600,000 apps are involved. The tool was created by Rafi Ton, who also runs the ad agency Nuviad, based in Israel, according to the account.
“Such a trend is extremely dangerous because of the fact that this is the sort of thing that could potentially end up creating a level of surveillance that no one thought possible in the past,” Muhammad stated.
Since these concerns were raised, Google has suspended Nuviad’s authorized buyer profile and Microsoft has terminated Nuviad’s access to its ad platform, Muhammad reported.
Onerep Offers to Remove Your Personal Information From Brokers
Individual users may be perplexed about what to do. One or more savvy software companies are likely to step into the breach, including Onerep, a startup based in Arlington, Virginia, offering an “AI-powered” service to remove an individual’s personal information from Google and 190 other sites. (A personal search performed on the company’s home page showed 77 profiles being offered by 66 data brokers.)
Dimitri Shelest, founder and CEO of Onerep, counts over 5,000 data brokers worldwide and a global industry expected to surpass $365 billion by 2029, in an account he wrote recently on the company blog. “Data broker companies represent a massive, yet often unknown, industry in the underbelly of the digital ecosystem … where information is the most valuable commodity,” he stated.
And naturally persons with evil intent can potentially inflict damage with this information, including targeting specific groups, such as senior citizens, with scams.
Data brokers make money by offering services, such as: identity verification, fraud detection, background checks, ad revenue, personal background reports and targeted consumer lists.
“Data brokers are legal and have the right to publish public information,” Shelest stated. “While data brokers in European Union countries must comply with GDPR (General Data Protection Regulation), the US doesn’t have federal data privacy laws governing information brokers.”
However, the federal Consumer Financial Protection Bureau is proposing restrictions on what information data brokers can sell, and the Federal Trade Commission has proposed regulations limits on how data brokers can collect and use information.
Some states are also taking action. For example, the California Delete Act could allow California residents to request that they be deleted from all data brokers at once; data brokers are then prevented from selling information from those who have opted out. Regulations are also enforced in Vermont, Oregon and Texas, to set limits on data brokers.
“Data brokers can and do expose your personal and sensitive data to other companies and individuals who are willing to pay for it,” Shelest stated in the account. “Even though they’re legal, information broker practices constitute severe privacy violations and put you at risk of becoming a victim of criminal activity.”
Comments from CEO Dimitri Shelest
AI in Business asked a spokesperson for Onerep where the idea for the company’s service came from, and how it employs AI. Here is an excerpt from an emailed response from CEO and founder Dimitri Shelest:
“Back in 2015, there were only two ways to fix privacy damage caused by these sites: spend weeks and months going through a labyrinth of opt-outs, or pay thousands of dollars to privacy and cybersecurity consultants who would take this burden off your shoulders. Only top-tier executives and celebrities could afford that, and, even then, the privacy problem wasn't entirely solved as removal was done from a fraction of the people-search sites only.
“This was when I decided to create my own company that would remove people’s names and other personal details from the biggest number of data brokers at the price of two cups of coffee, making it affordable for everyone. Nine years later, over 450,000 people have used our service.”
Comments from the CEO on how the AI-enabled data removal works: “It comes as no surprise that data brokers use novel technologies to scrape personal data, collect and profile it in order to make their business profitable. We combat their tactics with our own use of AI, allowing us to penetrate every data broker’s unique opt-out process. Likewise, each of our users gets their own highly customized AI-assisted removals.”
The AI is used to automate the removal process, and to customize for each data broker and for each user/customer of the service, Shelest indicated.
Read the source articles and information from The Brennan Center for Justice, in Closing the Data Broker Loophole, in Digital Information World, on the blog of Onerep, and in proposed restrictions on data brokers from the Consumer Financial Protection Bureau.