Congress presses Tim Cook and Larry Page for answers on security and privacy

In response to reports that Google collected location data on Android even when location services were turned off, the committee cited Android users' "reasonable expectation of privacy" and called the alleged tracking behavior "troubling."

Congressional Republicans sent letters Monday to Apple CEO Tim Cook and Alphabet CEO Larry Page asking for answers on the collection and use of location and audio data by iPhone and Android devices as well as third-party access to consumer data.

The two letters came out of the House Energy and Commerce Committee. They were signed by four members: Chairman Greg Walden, R-Ore., Communications and Technology Subcommittee Chairwoman Marsha Blackburn, R-Tenn., Oversight and Investigations Subcommittee Chairman Gregg Harper, R-Miss., and Digital Commerce and Consumer Protection Subcommittee Chairman Bob Latta, R-Ohio.

In response to reports that Google collected location data on Android devices even when location services were turned off, the committee cited Android users’ “reasonable expectation of privacy” and called the alleged tracking behavior “troubling.”

“In June 2017, Google announced changes to Gmail that would halt scanning the contents of a user’s email to personalize advertisements to ‘keep privacy and security paramount,'” the letter to Alphabet read. “Last week, reports surfaced that in spite of this policy change, Google still permitted third parties to access the contents of users’ emails, including message text, email signatures, and receipt data, to personalize content. In the context of free services offered by third parties, these practices raise questions about how representations made by a platform are carried out in practice.”

A major focal point of the letters was a July 2 Wall Street Journal report on third-party software developers scanning around 100 million emails per day in Gmail.

Apple’s Tim Cook has spent the recent years of his reign as CEO championing the company’s privacy-focused bona fides in stark contrast to its many Silicon Valley competitors who mine, move and monetize user data as deeply as they can. Much of the letter to Cook is simply an echo of the sentiment expressed to Page. It seems as though while Congress is checking on Google’s stance on privacy, it also wants to know the status of Apple’s products as well.

The letter to Cook points to recent iOS App Store changes to rules limiting third-party developer access to data which, the committee said, raises questions about how Apple user data is protected when it’s shared.

The letters, both of which you can read in full below, laid out 16 overarching questions to Cook and 18 to Page. The committee asked for a full briefing from the staffs of both executives. Answers are requested by July 23.

https://www.documentcloud.org/documents/4588388-070918-Android-Letter.html

https://www.documentcloud.org/documents/4588389-070918-Apple-Letter.html

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure