FCC Rollback: What just happened? And what is next?

Today (Tuesday the 28th) the senate and the house, under the Trump administration, voted to repeal the Federal Communications Commission (FCC) rules which past last October under the previous administration. If you find yourself a bit confused regarding what exactly is going on, you came to the right place. In this post I will attempt to breakdown how this legislation might affect the simple user, what you should be worried about (if at all), and what you can do about it today.

Also, for now, lets leave the political bashing out of this and avoid Armageddon analogies.

What Just Happened?

The bottom line for all of this is: it is now legal for your internet service provider (ISP, the technical term for AT&T, Verizon, T-Mobile...) to collect, store, and sell data regarding your internet usage. This includes but is not limited to: Web browsing history, App usage history, Content of communications such as messages, emails and online chats.

This is ofcourse in addition to the social security number of the consumer and bank information, so technically anyone that buys this data could know is was specifically you. Not to mention, they can now also sell your geo-data (the GPS data from your phone).

What Really Changed Though?

Under the FCC rules the companies needed your permission to sell this information. Now they don't take a look at this excerpt from the FCC press release explaining what data the companies need your permission in order to collect and sell:

Will they though?

Yeh man, probably they will. When FCC was first putting together the bill CTIA (The Wireless Association, a lobbyist group representing AT&T, Verizon Wireless, T-Mobile USA, and Sprint) claimed "Web browsing and app usage history are not 'sensitive information" and pushed very hard against the legislation. Since this data allows advertiser to engage in targeted marketing like never before, you can bet there will be quite a market for your data.

Also, here is what we know for sure the companies are already keeping:

• Comcast: Believed to retain IP addresses that connected to BitTorrent for 180 days.
• Verizon: IP address assignment (What IP belonged to which user) are retained for 18 months.
• Qwest/Century: Same logs as Verizon, up until one year.
• Cox: Same as Qwest. 

 

Inconvenient, But I Have Nothing to Hide...

Maybe, but we have seen time and time again that private companies often fail to stop hackers from gaining access to their database. Do you really trust an advertising company to protect your internet usage history and even content of communications? What someone gains access and leaks everything? What if someone decides he dislikes a comment you have made, finds the leaks and decides to dox you?

For example, angry users are already making plans to purchase the internet search history of Senator Mitch McConnell and Paul Ryan.

Ok, What Now then?

Lets break this down by application:

Protect your Browsing Data:

Luckily, there are different options that provide different levels of security. Lets go from easiest to hardest:

Incognito Browsing

Does NOT help for shit, you are just asking your computer not to remember the you went to that porn website. The Version/AT&T/T-Mobile server knows its is you and can now legally store this information.

HTTPS

If you glance at your URL bar you will probably find that the website begins with either http or https. These are different protocols that your computer is using to communicate with the blogger internet server. HTTPS is quite a lot more secure, it encrypts most of the data being transferred but the server will still know which websites (and which pages in that websites) you went to. Basically, the content of your messages, as well as username and password are now probably encrypted, but the URL and your GPS location are still transparent.

The good thing about the HTTPS is that you can probably set-up your PC to always use is it in under a minute. First and foremost, latest versions of Firefox, and Chrome have https enabled by default and now warn users when the websites use insecure http login (meaning, your ISP can see your username and password).

Most importantly, the "Electronic Frontier Foundation", a non-profit digital rights group, have released an firefox / chrome extension called "HTTPS Everywhere" which will make sure you are always have this essential level of protection.

Still confused? Check out this HTTPS ON, HTTPS OFF Gif from the Electronic Frontier Foundation:

TOR

Sadly, things get complicated fast, as seen in the GIF above, even with HTTPS everyone can still tell which websites you are visiting (and which pages in these websites). The only way to make sure no one knows the name of that site you go to late at night is to use TOR.

Here is an excellent step by step guide courtesy of the DarkNetMarketsNoobs sub-reddit.

Also, check out this TOR ON, TOR OFF Gif (again from the Electronic Frontier Foundation):

Protect your Phone Messaging Data: WhatsApp Vs Telegram:

While Telegram was traditionally seen as a more secure messaging app, the fact that it does not encrypt messages by default (which whatsapp does), in addition to recent vulnerability concerns and the fact that it does not use any well known encryption standard causes most to prefer whatsApp.

Btw, unrelated, but Snapchat can legally store anything sent via it's app so keep it PG.

Conclusion

Remember how we left out the political bashing at the beginning? Well here it comes.

This issue is beyond partisan alignment, it has the potential to hurt all Americans and the only reason it was passed now is the current political climate being too chaotic for us have the sufficient bandwidth to tackle such issues. Meredith Baker, the current CEO of CTIA (the wireless lobby group responsible for pushing this repeal) is a republican that was appointed by president Obama as the a member of the United States Federal Communications Commission. I suspect that neither the democrats nor the republicans really understand much of the legislation, and dount how much they would care if they did. Your only option is to educate yourself, protect yourself, and when the fight for net neutrally comes (and this is definitely the next item on the CTIA agenda) make sure your voice is heard.