News: 1687876386

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

One year after Roe v Wade overturned and 'uterus surveillance' looks grim

(2023/06/27)


Analysis The US Supreme Court's decision a year ago to overturn Roe v Wade has shone a light on the amount of personal, sensitive data that tech companies collect every day – and how that information can be used for nefarious purposes.

Shortly after the [1]decision , which ended federal protections of abortion rights, it came to light that [2]private Facebook chats between a Nebraska mother and her daughter had been used by law enforcement to build a criminal case against the teen for getting a now-illegal abortion in her home state.

In March, a [3]Texas man sued three women for allegedly helping his wife buy medication to end her pregnancy after snooping on text messages with her friends. The Lone Star State, which prides itself on rugged individualism, now offers a $10,000 cash bounty for reporting on women exposed as seeking reproductive choice.

[4]

Meanwhile, [5]online pharmacies selling abortion pills and [6]fertility tracking apps continue sharing pregnancy status as well as search history and geolocation – information that can then be used to identify the websites' customers – by third parties.

[7]

[8]

And [9]data brokers track the "precise" whereabouts of hundreds of millions of mobile devices, making it possible to ID devices at reproductive health clinics and trace those to users' homes.

Governments are weaponizing the most personal and private data about women's bodies and healthcare and using it against them

US Senator Ron Wyden (D-OR), speaking on the Senate floor to mark the one-year anniversary of the Supreme Court striking down Roe v Wade, [10]called this a "crisis of digital privacy and the threat of uterus surveillance."

"Governments are weaponizing the most personal and private data about women's bodies and healthcare and using it against them. That's uterus surveillance," Wyden told his fellow lawmakers.

"I've been sounding the alarm for years that location data leached from phone apps is ripe for abuse," he continued. "In states where extremists have restricted or banned abortion, that goes straight to a five alarm crisis."

[11]

At the federal level, a group of US lawmakers including Wyden have introduced legislation called the [12]My Body, My Data Act , which would minimize the amount of sexual health data that is collected by non-HIPAA-covered organizations – apps, search engines, mobile devices, and the like – to prevent this information from being disclosed or misused.

This is the elected officials' second such attempt. The original My Body, My Data Act of 2022 died in Senate and House committees last year, and the 2023 version looks doomed to meet the same fate in the Republican-controlled House of Representatives.

"What we're seeing in the wake [13]of Dobbs is federal agencies filling the void where Congress has not acted," said Andrew Crawford, Center for Democracy and Technology (CDT) senior counsel for privacy and data.

[14]

Crawford noted the US Department of Health and Human Services' [15]proposed rule to boost abortion data privacy under Health Insurance Portability and Accountability Act (HIPAA), but their passage is far from certain.

Additionally, in the year following the Supreme Court decision, a patchwork of state laws protecting reproductive health data have been enacted in the usual-suspect states.

On the other end of the political spectrum, states including [16]Texas have tried to make it a criminal offense for internet service providers to provide access to websites that sell abortion pills or provide information about the procedure.

States pick up the data-privacy slack

Perhaps the most protective rules applying to reproductive health data will soon go into effect in the state of Washington.

Democratic governor Jay Inslee in April [17]signed into law a bill that will make it illegal for period-tracking apps, Google or any other website to sell consumers' health data, while also making it harder for them to collect and share this personal information. The law, which also bans mass geofences, goes into effect July 23.

"It's long overdue that we have increased data protections for our most sensitive health data, and it's taken on an increased urgency in a post-Dobbs world," [18]Democrat Representative Vandana Slatter told The Register shortly after introducing the legislation in January. "This information, if it's bought or sold, can do real harm."

Shields up

Meanwhile, California lawmakers have proposed legislation similar to the Washington bill that would prohibit companies from sharing, selling or using for marketing purposes medical information – including reproductive or sexual health info.

[19]California , [20]Washington, and New York have all adopted shield laws that prevent companies in those states from sharing communications and other information with out-of-state law enforcement agencies conducting abortion investigations.

[21]Massachusetts has two pieces of legislation related to health data privacy and geolocation moving through the state's legislature, and California has a bill in the state Assembly that aims to protect reproductive and gender-affirming care by outlawing so-called "reverse warrants" or "keyword warrants."

These allow law enforcement to request names and identities of all people whose digital data puts them near an abortion clinic or shows them searching for related information online.

"EFF believes these are unconstitutional types of warrants because you are asking for information from a lot of people based on no probable cause – sometimes hundreds of thousands of people, depending on the location," Hayley Tsukayama, senior legislative activist at the Electronic Frontier Foundation (EFF) told The Register . "We are very worried about them as dragnet surveillance tools."

Google alone received 5,764 of these between 2018 and 2020 from police in the states that had banned abortion as of July 2022.

Both Google and EFF have signed on in support of [22]California's AB 793 .

"In the context of reproductive healthcare, it's a tool that can be wielded very effectively," Tsukayama said, adding that while other California laws prohibit cops from seeking warrants for people at a Planned Parenthood clinic, "there's nothing stopping you from saying give me the gas station next to the Planned Parenthood."

Tsukayama said she's not aware of these types of reverse warrants being used to prosecute people seeking or providing abortions.

"But we've seen reverse demands be used against protesters, or being used to falsely arrest someone because they were in the wrong place at the wrong time," she added. "This seems like a logical next step."

Big Tech at the heart of the debate

The Dobbs decision leaks in May 2022 put privacy and abortion rights advocates on high alert.

"After the decision finally came down, CDT quickly realized just how much tech issues were going to be at stake in the implementation of that decision – and in the course of people's daily lives," said the center's CEO, Alexandra Reeve Givens.

"We also realized that this was going to be an issue for the tech companies," she added. "They are going to be right in the heart of an incredibly politicized debate."

To this end, privacy rights advocates have called on Big Tech to [23]implement end-to-end encryption and stop storing location data, among other measures, to better protect users from unwanted surveillance.

Google, in particular, has found itself embroiled in a [24]legal battle and positioned squarely in the middle of this debate, in part because of the amount of data it collects from users, but also because it took an early stand on protecting reproductive data rights and privacy.

The same month as the Dobbs ruling, [25]Google pledged to update its location history system so that visits to medical clinics and similarly sensitive places are automatically deleted.

As recently as May, however, two investigations, one by advocacy group [26]Accountable Tech and the other by the [27]Washington Post , found Google continued to track and store location history for trips to abortion clinics.

[28]Decision to hold women-in-cyber events in abortion-banning states sparks outcry

[29]90+ orgs tell Slack to stop slacking when it comes to full encryption

[30]US bill to protect reproductive health data is dead. Here's why you should care anyway

[31]Guess who is collecting and sharing abortion-related data?

Accountable Tech also found that Google continued to store its Maps search query data by default – for example, searches for words like "abortion" or "Planned Parenthood" – for 18 months.

When asked about the two reports back in May, a Google spokesperson directed The Register to [32]this blog for the company's official statement.

Shortly after, Democratic senators led by Senator Amy Klobuchar (D-MN) [33]sent a letter to Google demanding answers and asking the company to agree to a third-party audit to verify that it's keeping its promise to delete sensitive location data.

Google did not respond to The Register 's inquiries about the senators' letter.

"They [Google] set this trap for themselves," Nicole Gill, Accountable Tech co-founder and executive director, told The Register .

"That's the irony of it. They made this proclamation, and they're not living up to it. And so, understandably, there's more focus on them, but they're certainly not the only piece of tech that potentially could be used and weaponized against people seeking abortions."

'Surveillance advertising' business models

In addition to Google, there's Facebook, Apple and Amazon – or really any company that collects and monetizes user data as part of their business models, Gill added.

Yes, these companies collect consumer data with their consent, "but that model of consent is completely flawed," she said. "Companies really need to look at their business models, and I don't know that an advertising-based business model is also going to last for the long term."

As long as it does last, however, this type of "surveillance advertising," as Gill describes it, is going to be increasingly dangerous for people who live in states where abortion has been criminalized.

Plus, these are also the same regions with weak data protection laws.

"It's creating even more of a dramatic split between the haves and have-nots," Gill said. "And the have-nots are willingly restricting rights and putting people's health at incredible risk by restricting the access to abortion and then also their willingness to prosecute those who seek it." ®

Get our [34]Tech Resources



[1] https://www.theregister.com/2022/06/24/big_tech_post_roe_wade

[2] https://www.theregister.com/2022/08/10/meta_abortion_charges/

[3] https://www.texastribune.org/2023/03/10/texas-abortion-lawsuit/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZJsHndjH2hWds0bXTWclNgAAAY8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://www.theregister.com/2023/01/20/online_pharmacies_data_sharing/

[6] https://www.theregister.com/2023/05/19/abortion_data_tracking_cases/

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZJsHndjH2hWds0bXTWclNgAAAY8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZJsHndjH2hWds0bXTWclNgAAAY8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[9] https://www.theregister.com/2022/08/29/ftc_sues_kochava/

[10] https://twitter.com/RonWyden/status/1671632599440322562?s=20

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZJsHndjH2hWds0bXTWclNgAAAY8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[12] https://www.theregister.com/2023/05/28/my_body_my_data_act/

[13] https://www.theregister.com/2023/01/20/online_pharmacies_data_sharing/

[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZJsHndjH2hWds0bXTWclNgAAAY8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[15] https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-reproductive-health-fact-sheet/index.html#:~:text=On%20April%2012%2C%202023%2C%20the,strengthen%20reproductive%20health%20care%20privacy

[16] https://www.theregister.com/2023/03/04/texas_abortion_info_law

[17] https://iapp.org/resources/article/washington-my-health-my-data-act-overview/

[18] https://www.theregister.com/2023/01/18/washington_period_tracking_apps/

[19] https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220AB1242

[20] https://cdt.org/insights/momentum-builds-against-abortion-surveillance-as-new-states-enact-shield-laws/

[21] https://ccianet.org/news/2023/06/ccia-asks-massachusetts-lawmakers-for-updates-to-privacy-bill/

[22] https://legiscan.com/CA/bill/AB793/2023

[23] https://www.theregister.com/2023/05/30/slack_e2ee_protest/

[24] https://www.theregister.com/2023/05/16/google_abortion_tracking_suit/

[25] https://www.theregister.com/2022/07/02/google_medical_privacy/

[26] https://accountabletech.org/research/googles-data-collection-and-policies-could-endanger-those-seeking-abortions/

[27] https://www.washingtonpost.com/technology/2023/05/09/google-privacy-abortion-data/

[28] https://www.theregister.com/2023/06/14/wicys_conference_backlash/

[29] https://www.theregister.com/2023/05/30/slack_e2ee_protest/

[30] https://www.theregister.com/2023/05/28/my_body_my_data_act/

[31] https://www.theregister.com/2023/05/19/abortion_data_tracking_cases/

[32] https://blog.google/technology/safety-security/protecting-peoples-privacy-on-health-topics/

[33] https://www.klobuchar.senate.gov/public/index.cfm/news-releases?ID=AB34273D-2E5E-4D06-96A1-3346328D22AC

[34] https://whitepapers.theregister.com/



That gives me an idea

Anonymous Coward

Is there any data on circumcisions ?

Names, address, location of nearest rail-head ideally.

It will really help with planning the concentration of facilities

"The Land of the Free"

gv

See title.

Re: "The Land of the Free"

Arthur the cat

It was an interesting experiment that now seems to be in end-stage failure mode.

Re: "The Land of the Free"

Yet Another Anonymous coward

If you're the one defining who is "The Free" it's pretty good

Disgusted Of Tunbridge Wells

Are people still pretending that the reversal of Roe V Wade is anything other than a reinterpretation by Supreme Court judges of whether the right to privacy confers a right to abortion ( but somehow doesn't confer the inherent right to, for instance, consume recreational drugs ).

Dinanziame

Yes, people are. This is because a lot of these Supreme Court arguments are shameless justifications for whatever people want to happen anyway. For instance, since you are bringing up recreational drugs, the fact that growing your own marijuana was ruled as something the Federal government may forbid under the interstate commerce clause of the constitution, arguing that people who grow their own marijuana have an influence on the illegal interstate commerce of marijuana because they stop participating in it:

[1]https://en.wikipedia.org/wiki/Gonzales_v._Raich

You may argue that two wrongs don't make a right, but one needs to be wilfully blind to ignore the political reasons for the reversal of Roe v Wade.

[1] https://en.wikipedia.org/wiki/Gonzales_v._Raich

Anonymous Coward

Me opening a window instead of turning on the air-conditioning involves interstate commerce since some portion of the electricity I could use is generated out of state.

jmch

Both Roe v Wade and the reversal of it came about because Democrats are too afraid of their left-wing extremists who promote abortion up to 24-26 weeks (basically right up to the point where the baby can survive, because at that point it is a baby, not a foetus), and Republicans are too afraid of their right-wing extremists who promote no abortion ever (even in cases of rape, incest, foetus abnormalities and danger to the mother). A vast, silent majority of Americans (around 60%+ I believe) are in favour of controlled abortion (more or less unconditional in first trimester ie 13 weeks, and in medical cases thereafter - similair to Europe though varies a bit depending on country).

The polarisation of left v right has left reasonable politicians unable to express reasonable views, because the reasonable middle in this case becomes BOTH a woman-enslaver AND a baby-murderer

Yet Another Anonymous coward

Or it's just an easy first step on their ultimate plans.

Negative data

jmch

" Google pledged to update its location history system so that visits to medical clinics and similarly sensitive places are automatically deleted."

So there is a trail of locations, then a gap within a standard distance from an abortion clinic, and then the trail picks up again some time later at the same standard distance from the clinic. Yes, that's perfectly private isn't it??

Google can't have it both ways, either they are collecting this intensely private data which can then be abused, or if they really want to protect their users, stop collecting it at all

I suggest a new strategy, Artoo: let the Wookie win.
-- C3P0