Then there was someone from the Pentagon, discussing how anyone could do an ad-buy targeting "people enlisted in the armed forces who have gambling problems." Sure, I thought, and you don't even need these explicit categories: if you served an ad to "people 25-40 with Ivy League/Big Ten law or political science degrees within 5 miles of Congress," you could serve an ad with a malicious payload to every Congressional staffer.

3/

Now, that's just the data brokers. The real action is in ad-tech, a sector dominated by two giant companies, Meta and Google. These companies claim that they are better than the unregulated data-broker cowboys at the bottom of the food-chain. They say they're responsible wielders of unregulated monopoly surveillance power. Reader, they are not.

4/

Meta has been repeatedly caught offering ad-targeting like "depressed teenagers" (great for your next incel recruiting drive):

technologyreview.com/2017/05/0…

And Google? They just keep on getting caught with both hands in the creepy commercial surveillance cookie-jar. Today, *Wired*'s Dell Cameron and Dhruv Mehrotra report on a way to use Google to target people with chronic illnesses, people in financial distress, and national security "decision makers":

wired.com/story/google-dv360-b…

5/

Google Ad-Tech Users Can Target National Security ‘Decision Makers’ and People With Chronic Diseases

Google enables marketers to target people with serious illnesses and crushing debt—against its policies—as well as the makers of classified defense technology, a WIRED investigation has found.

^{Dell Cameron (WIRED)}

Google doesn't offer these categories itself, they just allow data-brokers to assemble them and offer them for sale via Google. Just as it's possible to generate a target of "Congressional staffers" by using location and education data, it's possible to target people with chronic illnesses based on things like whether they regularly travel to clinics that treat HIV, asthma, chronic pain, etc.

6/

Google claims that this violates their policies, and that they have best-of-breed technical measures to prevent this from happening, but when *Wired* asked how this data-broker was able to sell these audiences - including people in menopause, or with "chronic pain, fibromyalgia, psoriasis, arthritis, high cholesterol, and hypertension" - Google did not reply.

7/

The data broker in the report also sold access to people based on which medications they took (including Ambien), people who abuse opioids or are recovering from opioid addiction, people with endocrine disorders, and "contractors with access to restricted US defense-related technologies."

It's easy to see how these categories could enable blackmail, spear-phishing, scams, malvertising, and many other crimes that threaten individuals, groups, and the nation as a whole.

8/

The US Office of Naval Intelligence has already published details of how "anonymous" people targeted by ads can be identified:

odni.gov/files/ODNI/documents/…

The most amazing part is how the 33,000 targeting segments came to public light: an activist just pretended to be an ad buyer, and the data-broker sent him the whole package, no questions asked. Johnny Ryan is a brilliant Irish privacy activist with the Irish Council for Civil Liberties.

9/

He created a fake data analytics website for a company that wasn't registered anywhere, then sent out a sales query to a brokerage (the brokerage isn't identified in the piece, to prevent bad actors from using it to attack targeted categories of people).

Foreign states, including China - a favorite boogeyman of the US national security establishment - can buy Google's data and target users based on Google ad-tech stack.

10/

In the past, Chinese spies have used malvertising - serving targeted ads loaded with malware - to attack their adversaries. Chinese firms spend billions every year to target ads to Americans:

nytimes.com/2024/03/06/busines…

Google and Meta have no meaningful checks to prevent anyone from establishing a shell company that buys and targets ads with their services, and the data-brokers that feed into those services are even less well-protected against fraud and other malicious act.

11/

Big American Tech Profits From Chinese Ad Spending Spree

Temu, Shein, and streaming and gaming apps looking to break into the U.S. market are spending huge sums to get their wares in front of American consumers.

^{Daisuke Wakabayashi (The New York Times)}

All of this is only possible because Congress has failed to act on privacy since 1988. That's the year that Congress passed the Video Privacy Protection Act, which bans video store clerks from telling the newspapers which VHS cassettes you have at home. That's also the last time Congress passed a federal consumer privacy law:

en.wikipedia.org/wiki/Video_Pr…

12/

The history of the VPPA is telling: it was passed after a newspaper published the leaked video-rental history of a far-right judge named Robert Bork, whom Reagan hoped to elevate to the Supreme Court. Bork failed his Senate confirmation hearings, but not because of his video rentals (he actually had pretty good taste in movies). Rather, it was because he was a Nixonite criminal and virulent loudmouth racist whose record was strewn with the most disgusting nonsense imaginable.

13/

But the leak of Bork's video-rental history gave Congress the cold grue. *His* video rental history wasn't embarrassing, but it sure seemed like *Congress* had some stuff in its video-rental records that they didn't want voters finding out about. They beat all land-speed records in making it a crime to tell anyone what kind of movies they (and we) were watching.

14/

And that was it. For 37 years, Congress has completely failed to pass another consumer privacy law. Which is how we got here - to this moment where you can target ads to suicidal teens, gambling addicted soldiers in Minuteman silos, grannies with Alzheimer's, and every Congressional staffer on the Hill.

Some people think the problem with mass surveillance is a kind of machine-driven, automated mind-control ray.

15/

They believe the self-aggrandizing claims of tech bros to have finally perfected the elusive mind-control ray, using big data and machine learning.

But you don't need to accept these outlandish claims - which come from Big Tech's sales literature, wherein they boast to potential advertisers that surveillance ads are devastatingly effective - to understand how and why this is harmful.

16/

If you're struggling with opioid addiction and I target an ad to you for a fake cure or rehab center, I haven't brainwashed you - I've just tricked you. We don't have to believe in mind-control to believe that targeted lies can cause unlimited harms.

And those harms are indeed grave. Stein's Law predicts that "anything that can't go on forever eventually stops." Congress's failure on privacy has put us all at risk - including Congress.

17/

It's only a matter of time until the commercial surveillance industry is responsible for a massive leak, targeted phishing campaign, or a ghastly national security incident involving Congress. Perhaps then we will get action.

18/

In the meantime, the coalition of people whose problems can be blamed on the failure to update privacy law continues to grow. That coalition includes protesters whose identities were served up to cops, teenagers who were tracked to out-of-state abortion clinics, people of color who were discriminated against in hiring and lending, and anyone who's been harassed with deepfake porn:

pluralistic.net/2023/12/06/pri…

19/

I'm on a 20+ city book tour for my new novel *Picks and Shovels*.

Catch me in SEATTLE TONIGHT (Feb 19) with Dan Savage:

eventbrite.com/e/cory-doctorow…

And in TORONTO on SUNDAY (Feb 23) at Another Story Books:

eventbrite.ca/e/picks-shovels-…

More tour dates here:

martinhench.com

20/

Image:
Cryteria (modified)
commons.wikimedia.org/wiki/Fil…

CC BY 3.0
creativecommons.org/licenses/b…

eof/

File:HAL9000.svg - Wikimedia Commons

^{commons.wikimedia.org}