Measurement Systems S. de R.L is a Panamanian company that recently made the news for distributing malicious code for use in apps on the Google Play Store. This company has links to the US intelligence community, including through a subsidiary called Packet Forensics LLC. Here's a quote from an article on the story:
The data-harvesting code reportedly ran on millions of Android devices and has been detected in well-known consumer apps, Muslim prayer apps, an app for detecting highway speed traps, and a QR code reader. The Panamanian firm reportedly paid developers to include its software development kit (SDK) code in their applications, and the kit handled data collection. The WSJ reports that it was able to look at data from a third-party company that showed the geographic distribution of users whose phones were running the Measurement Systems SDK, and it learned from the researchers that the buried code could obtain information down to location in addition to extracting info like email and phone numbers. The SDK could also view hashed data from WhatsApp image folders and even pull data about nearby computers and mobile devices, potentially mapping out who people meet with on a regular basis.
Developers were paid large sums of money to include this problematic code in their projects. That means the government was likely paying even larger sums for the data that this code ultimately collected. I wonder what kind of system this data was fed into. And if the government was collecting information about groups as varied as users of Muslim prayer apps, highway speed trap apps, and QR code readers, it seems like it would also be collecting this fine-grained data on a stunningly large variety of other types of individuals.
I imagine that all of this data is being fed into a complete social graph, where everyone's digital shadows can be secretly interrogated at any time. Querying this graph might require serious resources, disincentivizing its use for trivial matters. Still, it's now possible to put together a digital profile of anyone, even those who avoid online activity. I'd be surprised if intelligence agencies weren't taking advantage of this new capability.
The disappearance of privacy is something I once tried to fight. But obviously it couldn't be fought. If the government knows everything now, the big companies know more. They know, and they don't care unless they can profit from the information.
The data brokerage industry has interested me in the past. A few years ago, I tried to sell customized crypto market trade data, but market forces prevented the venture from going anywhere. In my case, the problem was a vendor who misrepresented the data and new services that made it easier for average users to access data from the marketplace. But trade data is very different from surveillance data.
The idea of these companies collecting surveillance data and sharing it with the government is uncomfortable. And things keep trending in that direction. When it comes to apps, I have a low expectation of privacy already. This latest revelation lowers that even further.
This surveillance data wasn't collected ethically. There's no reason to believe that it'll be used ethically. This particular data-harvesting operation became public knowledge. How many similar operations are underway now that we don't know about?
(Feature image from Pixabay.)
Read my novels:
Check out the comic I wrote:
Read my autobiographical monograph:
