Data Brokers: Last Week Tonight with John Oliver (HBO)

moving on our main story tonight

concerns computers there's one in my

house one in my pocket and one on my

wrist and fun fact if they all broke at

the same time i die

more specifically we're going to talk

about the fact that we've all had

unsettling moments when it became clear

that our computer was monitoring our

activities a little more closely than we

might like after financial planner rod

lawrence opened a new office he used a

credit card to buy baby wipes to clean

the place he says after picking up just

one canister he was shocked to be

bombarded with targeted online ads for

other baby wipes and more children's

products something this single guy

around town says he's definitely not

interested in at least not now

yeah it's true poor rod got roped into

the modern update of hemingway's classic

story for sale baby shoes click here and

look of course rod didn't want that

he was a man about town he was only

interested in three things getting laid

getting paid and rocking the hell out of

some wrap around shades

but we have all found ourselves being

targeted by ads for something oddly

specific and thought how on earth did

they know to show me that and tonight

we're going to talk about who makes that

possible data brokers it's a

multi-billion dollar industry

encompassing everyone from credit

reporting companies to these weird

people finding websites that pop up

whenever you google the name of your

friends sketchy new boyfriend to these

names that you may never have heard of

but what all these companies have in

common is they collect your personal

information and then resell or share it

with others as one expert puts it

they're the middlemen of surveillance

capitalism which sounds like both a

horrific profession and also a b-plus

jake gyllenhaal thriller he's not a spy

and he's not a civilian he's the middle

man and ladies in this one he shows

trunk and look

i know it is not news that you get

tracked online in fact roughly six in

ten u.s adults say that they don't think

it is possible to go through daily life

without having data collected about them

by companies or the government making

four out of ten us adults embarrassingly

wrong but this this isn't just about the

convenience and or irritation of

targeted ads data brokers operate in a

sprawling unregulated ecosystem which

can get very creepy very fast

the major u.s retailer officemax knew

not only that mike say's daughter was

dead but how she died it says mike say

daughter killed in car crash

or current business and this is my home

why would they have that kind of

information why would they need that

right and obviously that is completely

appalling but i will say it is not that

surprising to me that officemax was

behind that as they're clearly not

entirely on top of their if you

google officemax right now the people

also ask questions include and this is

true is officemax the same as office

depot

is office max and staples the same and

does officemax exist

the truth is when it comes to data

brokers they know significantly more

about you than you might like and do

significantly more with it than you

might think so tonight let's talk about

the whole industry and let's start with

how your information is collected

basically every time you interact with

society you are leaving little

breadcrumbs that can be gathered

together and sold and much of this

happens online thanks in large part to

cookies cookies were developed in the

early days of the internet and they're

actually one of the things that make it

slightly better a distinction that they

share with henry winkler's twitter feed

and literally nothing else

what they essentially do is enable

websites to remember you they are why

amazon remembers that you put a 106

complete box set of the mentalist in

your cart after eating an unexpectedly

strong weed gummy even if you don't

and if that's all cookies did it'd

honestly be fine but the practice

gradually evolved to invol to include

third-party cookies basically companies

other than the site that you are on

planting a piece of code in your browser

that allows them to track where else you

are going on the internet just watch as

a tech writer explains what they found

when they tried to learn just how many

companies were tracking them

so i started the day on google and did a

search and nine trackers were downloaded

onto my computer trackers do what it

sounds like they do they track you they

can get my ip address or the device i'm

using or the screen size they

were able to determine my location very

precisely next i went to huffpo and i

was swarmed the the trackers kind of

multiplied there were dozens and dozens

and they're just the trackers are just

kind of you know on my heels as i go

around the web yeah and i don't know

about you but i don't want a whole crowd

of strangers watching what i search for

on the internet not because it's gross

because it's private private doesn't

have to mean gross there's nothing gross

about looking up let's say are there any

shower heads with a contains pulp option

i wouldn't want it all the time i

wouldn't need it all the time that's why

it's an option the option to have some

pulp in the shower

it's can i finish

it's a normal shower most of the time

but occasionally i'll have the option to

get pelted with something that's got

some heft to it

just some weighted chunks of whatever

swamp for one flop something to wake me

up and keep me on my toes sometimes i

need it don't claim that you don't we'd

all love to pretend that the sun only

rises in peace time but things being

what they are we find ourselves again at

war so yeah start my day and rock me

with some juicy bits that's what i want

and i don't want anyone watching me when

i search to see how close we are to that

particular technology existing because

it is private

but data brokers often take all the

breadcrumbs that they have gathered

about you pair them with other data they

can obtain and then share all of it with

businesses who want to market to you and

they will frame this as a win-win here

is how epsilon one of the biggest data

broker firms positions itself

this is a person

so is this

here's another

and another they all look and act

different but people are fundamentally

the same

they all want respect protection and an

easier time getting the things they need

from brands

right the big three

it's all in maslow's famous hierarchy of

needs people want their physiological

needs met their safety accounted for and

their search history handed over

directly to the aflac duck

epsilon's ad even goes on to show how

that particular service of theirs works

demonstrating how they can create a

client id for someone that contains

everything they know about them like the

fact they're a vegan and that they make

45 to 50 000 a year or that they are a

41 year old male who is married with

kids at home and is googling snow globe

stuck in but what to do question mark

and once companies like epsilon collect

enough information about you they can

sort you into groups data broker firms

sell access to lists with names like

couples with clout ambitious singles

boomers and boomerangs potlucks and the

great outdoors golf carts and gourmets

and kids and cabernet those are all both

real names of groups compiled by a data

broker and as of now immediately

greenlit shows on tlc

and look you might not care if a company

wants to toss your data in a group

called kids and cabernet so marketers

can more effectively sell you things

that make you seem like a bad mom in a

fun way but

there is also a dark side here because

some companies can and do draw up even

more narrowly targeted lists like people

with certain ailments or sexual

preferences and then sell those lists to

anyone who wants to buy them and what

they can buy is pretty troubling

wreal bought thousands of names and

addresses of local people with serious

illnesses this group living in the 27607

zip code have diabetes these people in

27608

have cancer these residents of 27609

have high blood pressure and all of

these locals battle depression this list

is moms to be so we brought this data

and it and it tells us you're pregnant

yes and you are i am

yeah i am 18 weeks

that's pretty creepy isn't it i honestly

did not think there could be a worse

thing to ask a woman you don't know than

are you pregnant but you are pregnant

want to know who i paid to find out has

certainly entered the chat

and if you're thinking but that's

illegal under hipaa right

well no as one researcher pointed out

the medical information that you relate

to your physician is highly protected

but

if you go to a medical website and

search for terms like hiv or abortion

that information is not protected at all

it's a system that seems ripe for abuse

before you learn that some data brokers

have offered lists such as suffering

seniors payday loan central hispanic or

even help needed i am 90 days behind on

bills and some in this industry will

insist that they would never put people

at risk by selling their data remember

epsilon the company that collects clouds

of information about you in 2014 their

then ceo even went on 60 minutes to

reassure people that his business in

particular operated in a completely

above board manner if there are abuses

out there we don't believe those happen

within our company and we would be the

first to raise our hand oh really you

would be the first to raise your hand

would you that is interesting especially

because last year epsilon settled with

the doj for 150 million dollars for

facilitating elder fraud schemes after

admitting that it sold more than 30

million consumers data to clients who

employees knew were carrying out scams

and they were doing it for nearly a

decade so i guess that that guy really

should have been doing that entire

interview with his hand in the

air

and at this point you may be thinking

okay

i think i get it i am sufficiently

creeped out there is nothing more that

you need to tell me well hold on

what about the fact that apps on your

phone can give away your exact location

to third parties sometimes without you

even knowing it this free flashlight app

settles with the ftc for doing just that

and they are not alone take life360 an

app giving families the opportunity to

keep track of one another you may have

seen their ads featuring parents looking

relieved because they can see where

their kids are going and know when they

have safely reached their destination

well guess what in a report from the

website the markup says that life360

sells its location data to about a dozen

different brokers who then sell it to

marketers yeah it turns out they were

selling location data to around 12

different brokers it's like those old

commercials it's 10 o'clock do you know

where your children are because if so

same

and i have to tell you live 360 insist

that they are no longer doing that and

anyway they had de-identified their

users data before selling it that last

claim is actually very common among both

data brokers and the companies that they

work with and it is worth taking a look

at because while it sounds reassuring

the truth is it can be incredibly easy

to find out who is behind a number or a

code one team of researchers even found

that 99.9

of americans would be correctly

re-identified in any data set using just

15 demographic attributes among them age

gender and marital status and the ease

of de-anonymizing data is something that

we have actually known about for years

in 2006 aol turned over a bunch of these

anonymized search records of their users

to the public and it only took a few

short hours for reported decode who user

number

4417749 was between searches for things

like numb fingers 60 single men and dog

that urinates on everything the reporter

uncovered a woman named thelma arnold

she was age 62.

okay i'm not saying that it is at all

pleasant that that happened but for the

record i am glad that it introduced me

to thelma arnold because i love that

woman she hasn't given up despite her

numb fingers lackluster love life an

utterly broken dog none of that is

stopping her from shooting her shot and

looking for single men in her area

we stan a middle-aged queen with stamina

as we looked into this story we

constantly got reminders that none of us

are really anonymous online at one point

a researcher clicked on this company's

website didn't do anything else just

went there on his browser and later that

day got this email saying that they knew

he visited and that we offer a pretty

cool service called website visitor

identification which helps brands

identify who's browsing their website in

fact it's how we knew how to send you

this quick email

which is just objectively unsettling i

don't want anyone tracking what my staff

members are doing online mainly because

i don't want to know how many of them

have looked up what is john oliver like

and

it is not like data brokers are super

careful about who gets your sensitive

information you have already seen a

local news station ambush a pregnant

woman and a few years ago cbs bought

some location data from brokers and it

did not take much for them to find out

whose it was where they lived and what

they were doing no names or phone

numbers were tied to the data but it was

easy to figure out who each phone

belongs to based on where they spend

their nights here in greenwich one phone

pinged in the morning inside a seven

million dollar mansion the person then

visited a country club before heading

downtown and returning home yeah that

doesn't feel great does it although i

will say that particular example is not

that surprising to me if you told me an

individual woke up in a 7 million

mansion in greenwich connecticut and

made me guess where they went next i'd

have gone with i don't know um

a country club

downtown to hunt humans for sport and

then home again and i'd have been pretty

sure that i was right

and the thing is that kind of

identifying information can cause huge

problems just last year a priest was

forced to resign after a catholic

newsletter said it used app data signals

from grinder to monitor his activity and

matching his phone to his residence

essentially outing him which is a

massive harmful invasion of privacy and

definitely the worst scandal ever to hit

the catholic church

also just quick side note here catholic

church are you absolutely sure that

jesus was homophobic think about it he

had mutually respectful friendships with

women a distant relationship with his

father and when he found out he was

going to be betrayed he invited everyone

to a confrontational dinner

i'm just saying it might be worth

re-examining your thesis there

and look you might still think i don't

care about this my life is an open book

i have no secrets so data brokers can

just have at it

even if that is true for you though

consider that there are others out there

who might have very good reasons to not

want to be found

donna is a domestic violence victim

we're protecting her identity one of her

addresses came up on a data broker site

she says that's frightening if you have

someone that's

tried to kill you

for them to be able to just type in your

name and any known address that you've

ever stayed in

can pop up

it's scary because now they know ways

to start trying to find you

right and that's not just theoretical it

has happened in new hampshire a stalker

killed a former classmate after finding

her with information that he bought from

a data broker for 45

and if you have a stalker or you're a

victim of domestic violence it is

understandable to want your information

removed from these people search sites

unfortunately each has its own specific

and sometimes very complex process of

requesting the removal of information

and there is no federal law requiring

that they honor an opt-out request at

all and the lack of regulation here

doesn't just benefit individuals who

might mean you harm it benefits the

government too because it gives them a

very attractive loophole to the fourth

amendment protection against

unreasonable searches and seizures

because under that the government

typically needs a warrant to collect

information about you without your

consent

but if it is not forcing someone to turn

over your data if it's simply buying it

from a data broker that is apparently

fine no warrant necessary and you can

see how valuable that would be to them

it happens all the time in fact federal

agencies from the fbi to ice have

purchased data without warrants public

disclosures or robust oversight to carry

out everything from criminal

investigations to deportations and the

thing is you might not know if your

information has been supplied to the

government by an app even the company

behind the app might not know because it

might sell your info to a broker which

then resells it to someone else which

then supplies it to the government i'll

give you an example a couple of years

back vice found that the app muslim pro

which lets muslims know when to pray

have been selling user location data to

a broker that supplied information to

the us government and while because the

chain is so opaque it is hard to know

what exactly was sold or what the

government did with it the app's users

were understandably pretty alarmed

feeling disturbed

appalled

but not surprised sarah mustafa used

muslim pro that app has since reportedly

severed ties with its data partners so

intrusive you know my conversation with

god

is not information that the government

needs

yeah of course it's not information the

government needs there is a reason the

book wasn't called are you there god

it's me margaret and homeland security's

on the line as well hope that's cool

so to recap here we've got shady data

brokers with virtually no oversight

collecting your data and building

profiles that can track who you are

where you are and what you are most

likely to do or buy you cannot edit this

dossier and others from cops to

reporters to your own abusers can find

and use this information it's not a

great situation

so what do we do well it is a bit tricky

especially given the fact that the

entire economy of the internet right now

is basically built on this practice all

the free stuff that you take for granted

online is only free because you are the

product they make money by selling your

data but experts say that there are

actually some small steps that you can

personally take you can use web browsers

like these to help better protect you

against third-party tracking and if you

have an iphone you can go to the privacy

menu hit the tracking button and turn

off allow apps to request to track but

this should not be your responsibility

your privacy should be the default

setting here and there should be legal

fixes to this other countries have

actually tried the eu passed a law to

force sites to disclose cookies and

allow you to opt out but i will say

companies now often cleverly present

those options in the most annoying way

possible with accept all cookies and

easy default but if you want to reject

them forcing you to go through multiple

confusing steps for no clear reason

which is very smart to be honest no one

is going to put in the work to reject

cookies just to sneak a peek at an

article titled five times andrew

garfield's just was

you'd much rather just hit accept and

enjoy your remaining time on this earth

gazing at the most emotionally connected

spider-man to ever splooge the ooze

now

as for here in the u.s individual states

have tried to limit data brokers but

advocates say that what is really needed

is a comprehensive federal privacy law

governing them this has been proposed

for years now but nothing has happened

for a couple of key reasons first

data brokers spending on lobbying in

2020 rivaled that of facebook and google

but also politicians now famously build

their campaigns on data obtained from

brokers both parties regularly boast

about how much they use data in fact

just listen to former rnc chair reince

priebus openly bragging about it

everything about almost every potential

voter in georgia is known and it's not

even a joke they they know what beer

they drink what car they drive how many

kids they have and all that data is used

to target every single voter in georgia

it's true politicians rely on data to be

able to target our interests with

pinpoint precision although therefore i

do wonder why no presidential candidate

has yet targeted me personally with as

promising to fight for the shower of

morning chunks that i so richly deserve

i google it all the time you would have

my vote instantly

but it is very frustrating that the

people who could do something about data

brokers are so actively incentivized not

to but here is where

we may actually be able to help because

interestingly the one time that congress

has acted quickly to safeguard people's

privacy was in the 1980s when robert

bork was nominated to the supreme court

and a reporter walked into a local video

store and asked the manager whether he

could have a peek at books video rental

history and he got it

as soon as congress realized there was

nothing stopping anyone from retrieving

their video rental records too they

freaked the out

and lo and behold the video privacy

protection act was passed with quite

deliberate speed

so it seems when congress's own privacy

is at risk they somehow find a way to

act and it also seems like they're not

entirely aware just how easy it is for

anyone and i do mean anyone

to get their personal information which

brings me

to me because

in researching this story we realized

there is any number of perfectly legal

bits of that we could engage in

we could for example

use data brokers to go fishing for

members of congress by creating a

demographic group consisting of men aged

45 and up in a five mile radius of the

u.s capital who had previously visited

sites regarding or searched for terms

including divorce massage hair loss and

midlife crisis we could we could call

that group congress and cabinet and then

target that list with ads that might

attract those men to click like marriage

shouldn't be a prison or can you vote

twice

we could also throw in do you want to

read ted cruz erotic fan fiction

just to see what would happen and if

anyone clicked we'd be able to harvest

even more data from them which we could

then theoretically take steps to

de-anonymize now am i saying

that we're actually going to do that

collect all that raw information and

store it in let's say a manila envelope

somewhere well i am sorry to disappoint

you we are not going to do that

why would we when we have already done

it because

all that raw data

is currently right in here and honestly

this whole exercise was creepy

we ran those three targeted ads this

week in the capitol hill area and to

give you a sense of just how many clicks

we got it was very much not zero

do you want to see more because i do

please come with me because

let's

let's start with the very first hit that

we got it came at 3 35 pm on tuesday

afternoon from around the embassy row

area when a man fitting our demographic

description clicked on the ted cruz ad

meaning that we now have his ip address

and device id and also know that he did

it on an android phone so we could now

take steps to identify him just like we

could with all these others who clicked

on one of our ads in the capitol hill

area this week including at least three

who may have been inside the capitol

building itself

one of whom clicked on the can you vote

twice ad one of whom clicked on the

divorce one and another who clicked on

the ted cruz erotic fanfiction which was

distressingly popular if you're thinking

how on earth is any of this legal i

totally agree with you it shouldn't be

and if you happen to be a legislator who

is feeling a little nervous right now

about whether your information is in

this envelope and you are terrified

about what i might do with it you might

want to channel that worry into making

sure that i can't do anything anyway

sleep well

that's our show thank you so much for

watching we'll see you next week

good night

you