Slashdot Mirror
California Sues Delta Air Lines Over Mobile Privacy
New submitter mrheckman writes "California is suing Delta Air Lines for violation of California's on-line privacy law. Delta failed to 'conspicuously post a privacy policy within their mobile app that informs users of what personally identifiable information is being collected and what will be done with it' after a 30-day notice. Delta's app collects 'substantial personally identifiable information such as a user's full name, telephone number, email address, frequent flyer account number and pin code, photographs, and geo-location.' Why is it we still can't control what permissions an app has on our phones? It's absurd and disturbing that an app for checking flights and baggage demands all of those permissions."
You install or do not install.
Sad
California passed this law nine years ago. Everyone had plenty of time to comply. They got warnings. Now they get this.
Like the law that ensures you're told not to smoke on airplanes because few people even have a living memory of that being permitted at all any more.
Remember smoking on airplanes or throwing a virgin child into the volcano is a violation of Federal Law.
I wonder how Delta, a Georgia based company can be subject to California law with respect to online privacy? What about Los Angeles law? Are they subject to that too?
Does Slashdot have to worry about their website complying with Fresno law?
The whole thing just seems a little bit odd. Like when the US goes after foreign-based online gambling companies.
Aside from the photos, I can think of a logical reason for each of the other permissions listed.
Name is needed for check-in and boarding pass creation.
Delta will send flight updates via text message, for which a phone number is required. Ditto for email.
Frequent flyer number and PIN code are used to access your Delta account.
Geolocation so it knows which airport you're in.
They should disclose what information they collect as required by law, but the assertion that these permissions are "absurd and disturbing" is ludicrous and obviously the opinion of someone who does not travel often, or is uninterested in utilizing technology tools when they do.
Eagles may soar, but weasels don't get sucked into jet engines.
His point is valid, on my Samsung bada phone I can assign which apps have permission to get the GPS location for example. On my Android phone, I don't get that choice. I either accept it wants the location and give it all the time, or I don't install it. I can't turn off the GPS permission just for that app.
There's some really amazing stinky apps out there too. You wouldn't give your bank account details to a stranger, yet people install messaging apps, and immediately give them the email login. No doubt full of email confirms from their bank, and other details that could be used for phishing attempts on the bank account, or to grab your email account from you.
When I dug into where these apps were developed, I found 3 of the most popular free ones are developed in Russia, Bulgaria, and Israel. It's not difficult to figure out why they're free.
I can't turn off the GPS permission just for that app.
You can however leave GPS switched off when using that app. You should have it disabled the majority of the time anyway if you want to conserve power.
which is totally what she said
I have this app on my iPhone. You can use it as a guest, but really its for frequent flyers that already have Delta sky miles accounts. The majority of people using this app have already provided most of the mentioned personal information, if not more because they have a SkyMiles Account and they have bought plane tickets. So this lawsuit is kind of silly in my opinion.
I agree you read the permissions and decide to install or not. putting a sandbox around the app? sure, but then more people will complain about broken apps and support will be even more difficult. i could list lots of examples where people set a control and forget they did, and then complain that something is broken, when it is in fact their fault its broken.
now what i want to know is why this is news on /. Calif. did this on Dec 6, and delta updated their app on Dec 7 (http://www.androidcentral.com/delta-updates-their-app-privacy-policy-california-safe-again) so why is this a current news item for us?
I think GP used GPS permission as an example... Why can't I feed apps incorrect GPS data or an empty address book?
The two fanboi "cult-of-technology" companies.
Imagine that.
That is one advantage to using a BlackBerry: you can pick which permissions you want an app to have.
This is one area where the Blackberry OS has very soundly beaten every other mobile OS I'm aware of. Any OS even remotely considering corporate/enterprise usage really ought to have this sort of ACL for apps.
But, they don't.
It's because the apps are paid for with marketing money instead of operations money. Businesses don't feel the need to offer you better service unless you pay them for it. Here you are selling your PPI in return for the ability to see when you flight is arriving. A little off base in my book.
You actually can control what permissions an App has on Android phones. At least ones that are unlocked/rooted. I don't remember offhand the name of the app, maybe appjail? or something like that... all the phones apps are shown in a list, clicking on the app brings up all of it's permissions and a checkbox to enable or disable them. Sometimes changing things might just crash the app, or stop it from working at all, but it does show you can indeed control what things on your phone do.
I see some people commenting on how Blackberry(ROFL) beats everyone else in protecting against this? No Idea personally, I despise Blackberry phones. (nothing against blackberry, I just think their phones are crap). A lot of people seem to completely forget that Android is a Linux based distro(well distro'ish? that work?) What I mean by that, is it uses UNIX file permissions for file access (aside from normal phone permissions as in the article), but depending on what files you want to secure, you can change the file permissions to prevent access, or modification of whatever you want.
"Why is it we still can't control what permissions an app has on our phones?"
When the fines exceed the cost of developing this feature, it will exist. It doesn't exist now because there was no reason to build it.
"It's absurd and disturbing that an app for checking flights and baggage demands all of those permissions."
No, it's lazy grab-everything, and there was no reason in the past not to snag all of these things. Now there is a reason.
The photos on your phone aren't personal information but they are copyrighted material. Are they copying the photos are the metadata?
The answer to this question should be painfully obvious. You didn't pay for the phone, it was subsidized, and even if you did you're using it on their network. When it comes to phones in general and especially smartphones, you're the product that's being sold to anyone willing to pay even a penny for every last scrap of personal information they can possibly glean from it. That's why you should never provide real identities in these cases, but rather use aliases and other fake information. Now, thanks to the laws in some states that now allow bank accounts to be opened without Social Security numbers, it's even easier to set up an alter ego complete with credit cards and mail drops. The Mexican Matrícula Consular is especially easy to fake and is accepted for these purposes by many institutions in the aforementioned states.
Why is it we still can't control what permissions an app has on our phones? It's absurd and disturbing that an app for checking flights and baggage demands all of those permissions.
If you are not running CyanogenMOD then it is your own fault for installing 3rd party apps that cannot be trusted.
You can fake GPS data on Android.
or better, feed the apps an address book from the Spamhaus Zen list...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
The fact that Delta respects our privacy and has a company-wide policy means nothing to the anti-business liberals. They only care that the company hasn't wasted money to make a mobile-specific policy. There are no accusations of abuse, only the accusation that they haven't followed some ridiculous bureaucratic requirement.
http://research.microsoft.com/pubs/149596/AppFence.pdf
Linked: Paper for Android OS retrofit from Microsoft Research and Univ of Washington that makes the app think you've given it full permissions, then substitutes junk data when the app requests information you don't want to give.
Under any reasonable standard "to throw the child into a volcano" is an immoral purpose. So, while I think you are correct about the limitation, I don't think it makes the Mann Act inapplicable.
"Active" volcano has a lot of different definitions, but by any of the usual ones that's not true. See, e.g., this page on USGS volcano monitoring priorities.
J2ME phones can do this.
And what if you need to use GPS for another app at the same time?
Most of the information collected is exempt from disclosure under the TSA Rules. I suspect this will be dismissed shortly.
J2ME phones have the highest app security of any platform. If there are no apps for it, there is no way for information to be input much less leaked.
Why is it we still can't control what permissions an app has on our phones?
I agree, while I can see a stopwatch app needed the ability to prevent the device from sleeping, why does it need to be able to access the internet and send premium SMS messages? The user should be able to "turn off" any permissions he doesn't think a particular app should have, even more so if he paid money for it.
Cut the 'Nuts' of Delta's CEO.
That one act will get a lot of synergy going.
Then round up the CEO, CFO, CTO, COB and B and have a very merry St. Valentines Day Massacre.
None of them will be missed.
No More Tears.
Last I checked, GPS and photos needed user permission on an iPhone and the rest of the information you have o niter. Yet bother reason why I won't switch to android.
As for the lawsuit, it's more ridiculous California craziness being imposed on others.
or better, feed the apps an address book from the Spamhaus Zen list...
We should make an App for that :)