Stop the Newest Border Screening Bill

Biometric screening, surveillance drones, social media snooping, license plate readers—all this and more would be required by new federal legislation to expand high-tech spying on U.S. citizens and immigrants alike at and near the U.S. border.

Sen. Charles Grassley (R-IA) introduced “the SECURE Act” (S. 2192) on December 5. It borrows liberally from two other federal bills—H.R. 3548 and S. 1757—that EFF opposed earlier this year. Those bills were respectively introduced by Rep. Michael McCaul (R-TX) in the House of Representatives and Sen. John Coryn (R-TX) in the Senate.

Sen. Coryn’s bill, called the Building America’s Trust Act, raises concerns about digital rights, many of which are likely to be ongoing issues in Sen. Grassley’s SECURE Act.

Sen. Coryn’s bill would require that the Department of Homeland Security:

  • Collect biometric information from all people who exit the U.S., including U.S. and foreign citizens.
  • Collect DNA and other biometric information from “any individual filing an application, petition, or other request for immigration benefit or status.”
  • Share biometric information about immigrants with the FBI, Defense Department, and State Department.
  • Review social media accounts of visa applicants from “high-risk countries.”
  • Deploy drones at the U.S. border.

As we stated in our opposition letter then:

“Any new statutory authority given to the government to ensure border security must be carefully balanced to ensure that it does not overreach and violate the privacy of the people it intends to protect. In EFF’s view, this bill does not achieve that balance. Instead, it expands biometric and other high-tech surveillance of U.S. citizens and foreign visitors at and near the U.S. border without regard to essential civil liberties.”

EFF worries that these same issues are at stake in Sen. Grassley’s SECURE Act. And we recently joined a group letter against the SECURE Act, for the additional reason that it will reduce public scrutiny of high-tech surveillance at the border.

The Department of Homeland Security’s current practices for screening immigrants and U.S. citizens needs severe curtailing, not expansion.

Team Internet Is Far From Done: What’s Next For Net Neutrality and How You Can Help

Defying the facts, the law, and the will of millions of Americans, the Federal Communications Commission has voted to repeal net neutrality protections. It’s difficult to understate how radical the FCC’s decision was.

The Internet has operated under formal and informal net neutrality principles for years. For the first time, the FCC has not only abdicated its role in enforcing those principles, it has rejected them altogether.

Here’s the good news: the fight is far from over, and Team Internet has plenty of paths forward.

Defending Net Neutrality in Congress

It’s not too late to stop the FCC’s rule change from going into effect. Poll after poll show that Americans overwhelmingly support net neutrality, and Congress has already been inundated with calls for them to take action. We need to keep up the pressure, and we will.

Under the Congressional Review Act (CRA), Congress can reverse a change in a federal regulation by a simple majority vote within 60 working days after that regulation is published in the official record. In other words, Congress can vote to overturn Pai’s rule change and bring back the Open Internet Order.

There are already members of Congress promoting compromised net neutrality bills that won’t give us all of the protections we need. Congress has a cleaner, faster path to real net neutrality: simply restore the 2015 Open Internet Order.

Technically, Congress can’t invoke the CRA until the final rule change is published in the Federal Register, which will take several weeks. Between now and then, we will be watching Congress closely to see which members make public commitments to use the CRA to restore the Order.

Defending Net Neutrality in Court

While the CRA process moves forward, the FCC will be facing multiple legal challenges. Public interest groups, state attorneys general, and members of Congress are already getting ready to go to court. The FCC is required to listen to the public in its rulemaking processes and show clear evidence for its decisions. The Commission did neither in its decision to roll back the Open Internet Order. Among other things, it ignored the technical evidence EFF and others submitted showing why the 2015 Order made sense given 21st century Internet realities, in favor of self-serving claims from the ISPs and organizations they support. It relied equally heavily on the absurd notion that a few large tech companies, combined with the theoretical possibility that incumbent ISPs might some day face competition, eliminated the need for regulation. And that’s just the beginning. The new Order is full of holes, and judges will be able to see them.

Defending Net Neutrality in the States

Lawmakers and executive branch leaders in multiple states are working to fill the gap the FCC is creating and protect their constituents from unfair ISP practices. Before the FCC’s vote, Washington Governor Jay Inslee announced a multi-tiered plan to preserve net neutrality for Washingtonians, including cutting down on state benefits to ISPs that don’t adhere to net neutrality principles and taking measures to bring more competition to the broadband marketplace. Just after the vote, State Senator Scott Wiener announced his plans to introduce a bill preserving net neutrality protections for Californians. And this is just the beginning.

Defending Net Neutrality at Home

Net neutrality begins at home. One of the most important ways that we can soften the blow of losing the FCC’s net neutrality protections is to push for local policies that offer users real choices and ISPs that adhere to net neutrality principles.

The majority of Americans have only one option for a broadband Internet provider. If that provider decides to block or throttle its users’ traffic, users have no options. To make matters worse, those providers often have de facto monopolies thanks to local government policies.

EFF is working with policymakers and activists across the country to push for community broadband. We're working in particular with allies in San Francisco to develop a neutral infrastructure and policies for competition among providers that can serve as a model for cities across the country (.pdf). If cities invest in good Internet infrastructure—and allow multiple providers to access that infrastructure—then users can have recourse when a single provider acts unfairly.

It’s Not Over. Call Congress Now.

FCC may be abdicating its role in protecting the open Internet, but we will not. In the courts, in the halls of Congress, in our local communities, online and in the streets, Team Internet will fight for net neutrality – and we’ll be counting on you to join us.

You can start today: call your members of Congress and urge them to use the Congressional Review Act to save the Open Internet Order.

Take Action

Tell Congress to reinstate the Open Internet Order

Don’t Reauthorize NSA Spying in a Must-Pass Funding Bill

The next two weeks will be a flurry of activity in Congress. Before they can leave for the holidays, our government must—at minimum—pass at least one bill to keep the government running and also decide what to do about a controversial NSA spying authority called Section 702. Some legislators want to reauthorize Section 702, without meaningful reform, by attaching it to must-pass spending legislation. This is a terrible idea. The legislative process surrounding Section 702 already lacks necessary transparency and deliberation.                                              

The new legislative stratagem gets complicated very quickly. Here’s what you need to know.


On December 8th, Congress passed a temporary funding bill, or a “Continuing Resolution” (CR) to keep the government running until December 22. To prevent a government shutdown, Congress must either pass another CR by the new deadline, or ideally, finish writing the final funding bill for the rest of Fiscal Year 2018. This final funding bill is known as “the omnibus.”

Even though the Republican Party controls the House, the Senate, and the White House, GOP leadership has struggled to find enough consensus among their members to pass the omnibus. Instead, the government is limping along with a series of short-term CRs while avoiding hard decisions on longer term funding priorities. This constant negotiation on funding between the White House and Congressional leaders from both parties means that there is less time to negotiate other issues, like necessary reforms on Section 702 NSA spying program, which is scheduled to sunset at the end of this month.

Faced with multiple looming deadlines, legislators may be tempted to include Section 702 reauthorization in one of the funding bills. The allure of killing two (or more) birds with one stone often becomes overwhelming this time of year. Instead of taking the time to negotiate and navigate multiple difficult votes on various contentious bills, leadership finds it easier to find a majority only once.

Who will decide to include 702 reauthorization language in the CR? 

After consulting with the various Chairmen of Committees of jurisdiction (in this case, the Intelligence and Judiciary Committees), Congressional leadership, along with the White House, will decide what will help them get the votes they need.

For example, a member who is not inclined to support a spending bill on its own may decide to vote “yes” on a spending bill that includes language to prohibit the NSA’s controversial “about” searching. Of course, the reverse can also be true, which is why such discussions will happen behind closed doors.

Can anyone stop it? 

Yes and no. Individual members or groups of members (often called Caucuses) would have to tell their leadership that they would not vote for any spending package that contains language they don’t like. If the numbers work in their favor, and leadership believes them, this will keep the language out of the bill.

However, leadership may choose to call the members’ bluff. If the language is added over members’ objections, the members can still vote no on the whole bill. But that could cause the bill to fail and shut down the government. Government shutdowns are highly disruptive to many people, and thus politically risky. The members and the leadership take that into consideration. It’s a high-risk game of chicken—with very real and long-term consequences.

Can the language be amended once it is added?

Practically speaking, no. All the language in the CR is carefully negotiated behind closed doors, so leadership does not usually allow any amendments in case something accidentally passes that would cost them votes.

Is there any limit to what language can be included in a CR?   

Once again, practically speaking, no.

In theory, no spending bill – CR or omnibus – should contain language that isn’t related to funding the government. Of course, how we fund the government often has policy implications, which is why these bills are often so contentious and so tightly negotiated. For example, earlier this year Rep. Kevin Yoder (R-KS) sponsored language in a funding bill that would prevent law enforcement from using any taxpayer dollars to seize cloud-hosted documents (email, photos, etc) without a warrant. In practice, the policy impact of this language would have been quite similar to the Email Privacy Commutations Act, but Rep. Yoder’s language actually only prohibits funding these actions. Adding language that has nothing to do with government funding at all, like reauthorization of the Section 702 program, does happen, but it is rare.  

A CR is even less appropriate than an omnibus as a vehicle to make new policy. As it is designed only to be a temporary, short-term measure, a CR is theoretically only a continuation of current funding levels, with no major funding changes and no major policy changes. In practice, this rule gets waived (at the discretion of the leadership), especially when pushed up against a deadline and when the added language brings in needed votes.

How will we know if or what 702 reauthorization language has been added to the CR?   

Follow us on Twitter!

In normal circumstances, all legislation is supposed to be public for at least a day before Congress votes on it. Unfortunately, these are not normal circumstances.

When there is a difficult, tightly negotiated bill and a looming deadline (like with both the CR and Section 702 reauthorization), the House of Representatives may enact something called “martial law,” allowing leadership to move quickly through debate and final passage as soon as they have an agreement - before the media or the public have an opportunity to comment.

EFF is in constant communication with members interested in reforming Section 702, and we’re fighting alongside them to make sure Section 702 reauthorization does not sneak through in the dead of night. We’ll make sure to let you know when we know!

Is This Strategem OK?

No! While the legislative calendar may pose a challenge, it is completely unacceptable for Congressional leadership to shove Section 702 reauthorization into an end-of-year funding bill. This program invades the privacy of an untold number of Americans. Before it can be reauthorized, Congress must undertake a transparent and deliberative process to consider the impact this NSA surveillance has on Americans’ privacy.

It is troubling that a secretive NSA surveillance program may be reauthorized in a secret legislative backroom deal. But this program is too important to be hidden in a big funding bill, and members shouldn’t be forced to choose between shutting down the federal government or violating the Fourth Amendment.

FISC Assurances on Spying Leave Too Many Questions Unanswered

Last week, FBI Director Christopher Wray faced questions from the House Judiciary Committee about how his department is implementing one of the government’s most powerful surveillance tools. Despite repeated bipartisan requests, Director Wray refused to tell the Members of the Committee how many Americans have been impacted by Section 702, enacted as part of the FISA Amendments Act. This isn’t the first time the FBI has refused to answer to Congress.

EFF has long held that Section 702 is being used to violate the privacy guaranteed by the Fourth Amendment. Section 702 authorizes the acquisition of foreign intelligence information; however, because many Americans communicate with foreign persons outside the United States every day, our communications are also being captured and read without a warrant. 

How many Americans have had their communications “incidentally collected” under Section 702? We don’t know. In fact, not even Congress knows. Although the House Judiciary Committee has sent several bipartisan letters to the Office of the Director of National Intelligence asking this exact question, ODNI has refused to respond. 

At the hearing last week, Rep. Ted Poe (R-TX), asked Director Wray to provide information on the number of Americans impacted by Section 702, saying, “this committee has asked for a long time to give us that information. My opinion is that the FBI and the intelligence service is back-walking that information because they know FISA [i.e. Section 702] comes up at the end of this year, and then Congress will just reauthorize without knowing how many Americans are searched.” 

The FBI has also refused to estimate how often it warrantlessly queries databases containing incidentally collected communications using Americans’ identifiers as search terms, a practice known as “backdoor search.” Rep. Poe pressed Director Wray on backdoor searches as well, giving him an ultimatum: “I hope you can provide us that information before we reauthorize FISA, otherwise I'm going to vote against FISA.”

But Wray still didn’t answer these questions. Instead, he claimed that “every court” to have heard arguments against how the government uses Section 702 has found “no abuse” and concluded that it’s being done “consistent with the Fourth Amendment.”

Director Wray is wrong. In 2016, the Ninth Circuit Court of Appeals upheld the use of Section 702 in United States v. Mohamud, but the court specifically said that its decision did not “involve the retention and querying of incidentally collected communications,” i.e. backdoor searches. And when the Foreign Intelligence Surveillance Court of Review (FISCR) upheld warrantless acquisition of foreigners’ communications under an earlier law, it did so because it believed the government would “not maintain a database of incidentally collected information from non-targeted United States persons” that it could search without a warrant.

Meanwhile, the NSA and the FBI won’t even tell Congress how many non-targeted United States persons are impacted by “incidentally collected” information under the 702 program. The FBI may believe it is using Section 702 authority “lawfully and appropriately for the good and protection of the American people,” as Director Wray put it. But using a surveillance power lawfully and appropriately means following the Constitution, answering reasonable questions from Congressional oversight committees, and ensuring that all Americans have the freedom to communicate without fear of government surveillance. 

Chairman Goodlatte agreed with Rep. Poe, saying, “This is a reasonable request from the gentleman from Texas. It has been made in varying forms by this committee in a bipartisan way in the past, and we have not yet received the answers to those questions…. We think that you need to be forthcoming on this.” 

Bottom line: if Section 702 is going to be allowed to continue, Congress must consider the impact it has on Americans’ privacy. The FBI (and the NSA) need to answer the question. 

Video: How the Court System Is Abused to Chill Activist Speech

One of the most pernicious forms of censorship in modern America is the abuse of the court system by corporations and wealthy individuals to harass, intimidate, and silence their critics.

We use the term “Strategic Lawsuit Against Public Participation,” more commonly known as a “SLAPP,” to describe this phenomenon.  With a SLAPP, a malicious party will file a lawsuit against a person whose speech is clearly protected by the First Amendment. The strategy isn’t to win on the legal merits, but to censor their victims through burdensome, distracting, and costly litigation. SLAPP suits often make spurious defamation claims and demand outrageous monetary penalties to bully their enemies.  

In EFF’s work, we’ve seen SLAPPs deployed against journalists and bloggers, cartoonists, and even people who have posted reviews on websites like Yelp and eBay. They’ve been used by election power players against their political opponents and by corporations against non-profits whose job is to hold them in check. In fact, EFF faced such a scheme when an Australian company filed a lawsuit to censor one of our “Stupid Patent of the Month” articles.  Although EFF won in court, the lawsuit required resources that we otherwise could have devoted to other battles.

This tactic is currently being used by energy and logging corporations to target environmental groups. For example, paper-producer Resolute Forest Products sued Greenpeace, claiming they violated racketeering laws because the organization had called the company a “forest destroyer.” After a 17-month legal battle, Greenpeace emerged victorious in October when the case was dismissed in federal court. Greenpeace faces a similar suit from Energy Transfer Partners, a company best known for running the controversial Dakota Access Pipeline project.


Privacy info. This embed will serve content from


Greenpeace is now among the many voices raising awareness of the danger of SLAPP suits, and it is offering a toolkit for environmental activists. In a new video, UC Berkeley public policy professor Robert Reich explains what’s at stake: "If the goal is to silence public-interest groups, the rest of us must speak out.  Wealthy corporations must know they can't SLAPP the public into silence." 

Greenpeace and its environmental allies are joined by many First Amendment groups—including EFF, the First Amendment Coalition, Freedom of the Press Foundation, and the ACLU—in this campaign to educate the public on the need to fight back against SLAPP suits.  Among the most important measures you can take is joining the Public Participation Project's efforts to pass anti-SLAPP legislation in Congress.

Anti-SLAPP laws are designed to allow defendants to quickly dismiss the frivolous claims brought against them based on a showing that they’re being targeted for engaging in protected First Amendment activity. The plaintiff bringing the suit then has to prove that they can actually substantiate their claims. If they can’t show that their legal claims have merit, a court must dismiss the suit. This allows defendants to avoid what can often be extremely costly and distracting civil discovery.

Further, most anti-SLAPP laws feature cost-shifting provisions, such that once a defendant successfully gets the claims against them dismissed, they can force the companies who sued them to pay their attorneys’ fees and other costs related to the litigation. The threat of paying the other side’s legal fees potentially stops companies from filing SLAPP suits in the first place.

Although some states, including California, have developed robust anti-SLAPP laws, a federal law is needed to protect and advance First Amendment protections for individuals or groups in federal court.  An anti-SLAPP bill introduced in 2015, the SPEAK FREE Act, featured many of the same protections for targets of these lawsuits described above. It would also help defendants sued in states that do not have anti-SLAPP laws or only offer extremely weak protections by allowing them to remove the case to federal court to obtain protections of the SPEAK FREE Act.

EFF is extremely troubled by the latest SLAPP suits filed against organizations such as Greenpeace. Yet we are heartened by the group’s resolve to fight back and to bring attention to this growing threat to free speech. 

How to Debug Your Content Blocker for Privacy Protection

Millions of users are trying to protect their privacy from commercial tracking online, be it through their choice of browser, installation of ad and tracker blocking extensions, or use of a Virtual Private Network (VPN). This guide focuses on how to correctly configure the blocking extension in your browser to ensure that it's giving you the privacy you expect. We believe that tools work best when you don't have to go under the hood. While there is software which meets that criteria (and several are listed in the final section of the guide), the most popular ad blockers do not protect privacy by default and must be reconfigured. We'll show you how.

AdBlock Plus (Firefox)

AdBlock Plus (Chrome)

Adblock (Chrome)


Tracker-Blocking Alternatives

AdBlock Plus (Firefox)

Adblock Plus participates in the Acceptable Ads initiative, in which companies have their ads whitelisted in exchange for meeting a set of format requirements and, in some cases, a cut of the revenue generated by being unblocked. Acceptable Ads conflicts with EasyPrivacy, the privacy protection filter popular among Adblock Plus users. In doing so, Acceptable Ads exposes Adblock Plus users to tracking unless it is disabled.

1. Click on the ABP icon in the top right-hand corner of the browser window. This will open an interface menu. Select Options at the bottom.

2. The Options menu begins with a section titled Privacy and Security, which contains two options: Block additional tracking and Block social media icons tracking. These are not selected by default, so check both boxes and turn them on.

The next section is called Acceptable Ads. The Allow Acceptable Ads box is checked by default - uncheck this box to turn it off. Acceptable Ads defines acceptability according to visual obtrusiveness, and disregards the privacy aspects of ads. So while these ads may not disrupt the reading experience, they may track you, and the list of "acceptable" ads is 10,000 domains long...

By enabling the first two blocking options, you have installed two additional privacy filters, EasyPrivacy and Fanboy's Social Blocking List. Acceptable Ads can interfere with EasyPrivacy, which is why Acceptable Ads must be disabled.

3. By clicking on the Advanced tab on the left-hand side, you can view the filters that are installed and active. EasyList blocks ads. EasyPrivacy blocks invisible trackers which are loaded regardless of whether ads are blocked. Fanboy's Social Blocking List replaces widgets such as the Facebook Like button that send information back to their owners whenever they are loaded on a web page.

AdBlock Plus (Chrome)

Adblock Plus participates in the Acceptable Ads initiative, in which companies have their ads whitelisted in exchange for meeting a set of format requirements and, in some cases, a cut of the revenue generated by being unblocked. Acceptable Ads conflicts with EasyPrivacy, the privacy protection filter popular among Adblock Plus users. In doing so, Acceptable Ads exposes Adblock Plus users to tracking unless it is disabled.

Adblock Plus for Chrome does not offer the EasyPrivacy filter list as a standard option, so it must be added manually.

1. Click on the ABP icon in the top right-hand corner of the browser window. This will open an interface menu. select Options at the bottom.

2. On the next screen, uncheck the Allow some non-intrusive advertising checkbox at the bottom. Next, click on the grey box above it marked ‘+ Add: filter subscription’.

3. This will open a drop-down list. Go to the bottom and select Add a different subscription.  This will then reveal an empty box marked Filter list location where you can enter text or a URL. Enter the following URL:

Now click Add.

4. You should now see EasyPrivacy added to the active filter list. Double check that Acceptable Ads is disabled, as it can overrule EasyPrivacy and allow tracking from domains on the AA list. This is how the settings should look:

AdBlock (Chrome)

Despite the similarity in names, Adblock is a different extension from Adblock Plus, and has separate ownership from Eyeo/ABP.

Adblock participates in the Acceptable Ads initiative, in which companies have their ads whitelisted in exchange for meeting a set of format requirements and, in some cases, a cut of the revenue generated by being unblocked. Acceptable Ads conflicts with EasyPrivacy, the privacy protection filter popular among Adblock users. In doing so, Acceptable Ads exposes Adblock users to tracking unless it is disabled.

1. To access the options interface, click on the icon with the hand against a red circle in the top right section of the browser. Next, click on Options.

2. The first box is Allow some non-intrusive advertising. We want to uncheck this.

3. Next, navigate to Filter Lists. Uncheck the box marked Acceptable Ads. Then, go down to the bottom and check EasyPrivacy and Fanboy's Annoyances. EasyPrivacy blocks invisible trackers which are loaded regardless of whether ads are blocked. Fanboy's Annoyances list replaces widgets such as the Facebook like button that send information back to their owners whenever they are loaded on a web page.


Unlike the clients listed above, Ghostery does not participate in the Acceptable Ads initiative.

We are covering Ghostery here because it blocks nothing by default. After installation, it displays the number of potential trackers on the page you're browsing, but without user configuration Ghostery is just a visualization tool. Blocking can be enforced at the level of an individual tracker, a class of tracker functionality, or against all trackers. We'll be blocking all of them.

1. Click on the Ghostery icon in the top right hand corner of the browser. An interface will appear. Select the second option, Advanced Blocking.

2. You are now in the Blocking Options section of the Settings. You can see the categories which Ghostery uses to classify trackers: Advertising, Site Analytics etc. Above the check boxes on the right, select the Block All option.

3. The checkboxes for every category of tracker should now be ticked. In addition, you should see a message stating that any additional trackers identified by Ghostery in the future will be blocked automatically.

Tracker-Blocking Alternatives

The following extensions require no configuration and will block trackers upon installation. Blockers may occasionally break sites which you visit. Usually this is minor, and all extensions offer the option to disable their activity on a given site if necessary.

Brave is a browser rather than extension, but tracker blocking has been part its core functionality since the beginning. Brave also integrates EFF's HTTPS Everywhere, protection against malware, and  an option protect against some forms of device fingerprinting.

Systems covered: Linux (Debian/Ubuntu/Fedora), OS X, Windows, Android, iOS

Disconnect offer both free and premium privacy tools. Their basic version is free and provides tracker blocking. Disconnect is a member of EFF's Do Not Track coalition, striving to persuade publishers and ad technology vendors to endorse responsible advertising that respects user privacy.

Browsers covered: Chrome, Firefox, Opera, Safari, Samsung mobile browser

Privacy Badger is developed by EFF and blocks third party tracking. Unlike other blockers, Privacy Badger does not rely on a blacklist. Instead, it dynamically spots trackers as you browse, identifying the ones that try to follow you across sites. Privacy Badger unblocks resources from domains that adopt EFF's Do Not Track policy, offering advertisers an incentive to give up their surveillance practices and take a privacy-positive approach.

Browsers covered: Chrome, Firefox, Opera

uBlock origin is an extension developed by Gorhill. It blocks all ads and tracking by default, and is widely admired by developers and users alike.

Browsers covered: Chrome, Firefox, Microsft Edge, Opera

Panopticlick 3.0

Today we’re launching a new version of Panopticlick, an EFF site which audits your browser privacy protection. Conceived to raise awareness about the threat of device fingerprinting, Panopticlick was extended in December 2015 to check for protection against tracking by ads and invisible beacons. This new update adds a test for trackers whitelisted by the so-called "Acceptable Ads" initiative. Acceptable Ads is a program involving the popular adblockers Adblock Plus and Adblock, whereby companies can have their ads deemed "acceptable" if they meet certain format criteria. These ads are then unblocked and any company operating above a certain threshold must agree to pay Eyeo, the owner of Adblock Plus, a fee of 30% of the resulting revenue from the ads for administering the process. This revenue is divided between the participating ad blockers.

By default, Panopticlick will now check browsers for trackers from the Acceptable Ads list by testing against a real tracker. If the browser fails, that tracker will receive some information about the user, but this minimal leakage is necessary to diagnose the problem. If you are uncomfortable with this, it is possible to opt out of the test. If Panopticlick detects inadequate protection, the user is linked to instructions to disable Acceptable Ads and fix their configuration.

What is Acceptable Ads?

Acceptable Ads is a whitelist of "non-intrusive" ads that meet requirements relating to format, size and placement on the page. The process has been operated on a for-profit basis since late 2011 by Eyeo. Large advertising companies like Amazon, Criteo, and Google make significant payments to this program, though the exact amounts are not public. Acceptable Ads serves an important policy purpose by identifying types of ads that are not visually intrusive. However, the payments that Eyeo demands for listings, and the fact that Eyeo has implemented Acceptable Ads in such a way that it silently overrides users' privacy settings, are huge problems.

The Problem with Ad Blockers as Privacy Tools

Many users install blockers not just to block obtrusive advertising but also for privacy and security reasons. Unlike tracker blockers (like Brave, Disconnect, Privacy Badger, or uBlock Origin), ad blockers offer only limited privacy protection by default. This functionality is easily extended through the addition of filters such as EasyPrivacy, a blacklist of invisible trackers. But since the launch of the Acceptable Ads Initiative in late 2011, the Acceptable Ads whitelist has been turned on by default for Adblock Plus users, as it has been for Adblock users since late 2015. The Acceptable Ads whitelist allows numerous tracking domains. Content blockers like Adblock Plus and Adblock function based on both whitelists and blacklists. When there is a conflict, the whitelist wins. This means that even though EasyPrivacy is intentionally installed and Acceptable Ads is enabled by default, whitelisted domains will not be blocked from tracking the user. With more than 10,000 domains on the Acceptable Ads whitelist, that’s a lot of tracking.

Who Benefits?

EasyPrivacy's protection is only effective if users disable the default Acceptable Ads whitelist, but the blockers offer no warning regarding the incompatibility of the two lists. This is despite the fact that tracker blocking was offered by ABP as an explicit option during installation until recently, and Adblock offers EasyPrivacy in the list of filters available for activation in its user settings. Because the Acceptable Ads whitelist is enabled by default, some EasyPrivacy users are likely unaware that Acceptable Ads is even enabled, never mind undermining their preferences. As a consequence, we believe millions of users have been unwittingly exposed to tracking.

In reality, the co-existence of Acceptable Ads and EasyPrivacy could only be logically consistent were EasyPrivacy to restrict the domains allowed from the Acceptable Ads list to those which are privacy-compliant. A setting just released for Adblock Plus on Firefox offers this option, but its details are still to be verified. 1

Dark Patterns

Part of the solution is better user interface design and clear information, that clearly outlines the different configuration options to users during installation. Better still, clients could offer a one-click option to enable meaningful privacy protection as part of the installation process, where most users are most likely to choose it. Otherwise, we know that only a minority of users change the default configuration of their software. Regardless of what options are available, the default options are key to how any software will be used in the wild. Manipulating defaults and interface design to influence user actions is a practice referred to as "dark patterns". An explanation for such behavior is close at hand: every user who opts out of Acceptable Ads represents a loss of income for the companies involved, which are simultaneously ad blockers and brokers of their users’ eyeballs.

Serve the User?

Earlier this year, Eyeo handed over control of the criteria for Acceptable Ads to an independent committee, though Eyeo remains in control of the business. In principle, this committee could serve the important public function of setting standards for visual unobtrusiveness, privacy-friendliness, and other types of good practice for online and mobile ads. 2 It could also be an important forum to encourage advertisers to switch to privacy-positive technologies compliant with the Do Not Track policy.  But the manner in which Acceptable Ads has operated reveals a conflict between the interests of the companies participating in the Acceptable Ads program and those of their users. To resolve this, the issues we identify above must be fixed quickly and comprehensively. A good place to start would be to disable Acceptable Ads for all existing users of EasyPrivacy, delivering them the privacy they seek.

Defenders of Acceptable Ads have argued that its rationale is to protect the user experience while allowing publishers to sustain themselves through advertising. This is a vital discussion and one in which EFF is keen to participate. Adblock Plus is free to try to persuade the public of the social value of Acceptable Ads for supporting publishers, but it must do so in the context of clear and non-confusing user interface choices for their users and resist the temptation to overrule clear user decisions. In the meantime, users who want to protect their privacy should either follow our configuration instructions or consider switching to more robust tracker blocking tools.

  • 1. ABP on Firefox's new settings offers the option of enabling both 'Acceptable Ads' and 'Only allow ads without third-party tracking'. Their FAQ explains that this means ads which either comply with DNT or are served by the site being visited itself.
  • 2. A full discussion of the policy problems that could reasonably be addressed by standards and blocking/unblocking mechanisms in the online advertising space is beyond the scope of this post. However it certainly includes privacy (which EFF has worked on with our Do Not Track standard); visual intrusiveness (which is what Acceptable Ads was designed to address); protection against malvertising (the OTA Alliance has done excellent work on this problem; and landing page quality (which is an issue that Google itself measures with algorithms).

CBP Reveals How Agents Implement New Policy Not to Access Cloud Content

President Trump’s nominee to be Commissioner of U.S. Customs and Border Protection (CBP), Kevin McAleenan, revealed during his confirmation process how the agency implements its new policy not to access cloud content during border searches of digital devices.

In response to written questions for the record submitted by Sen. Ron Wyden (D-OR) and other members of the Senate Finance Committee, McAleenan explained that in accordance with CBP’s new policy to access only information that is “physically resident” on a device, border agents must “ensure that network connectivity is disabled to limit access to remote systems” (page 92).

While McAleenan did not provide details, disabling network connectivity can mean a few things, such as putting a phone or other device into “airplane mode,” or individually toggling off cellular data and Wi-Fi. It could also mean making sure a laptop is not connected to an Ethernet cable, or bringing a device into a SCIF-type room that blocks electromagnetic signals.

This newly disclosed fact—that border agents must disable Internet connectivity before searching a digital device—provides a more complete picture of CBP’s new no-cloud-access policy.

The public first heard of this new policy when McAleenan submitted answers to a separate set of written questions from Sen. Wyden in June 2017. In that document, McAleenan stated that CBP “issued a nationwide muster in April 2017 reminding its officers” that they may only access data “physically resident” on a device. As we explained, CBP’s 2009 policy—the operative policy on border searches of digital devices—does not prohibit border agents from searching travelers’ cloud content. Rather, that policy broadly authorizes agents to search “information encountered at the border,” which apparently would include cloud data accessed via a digital device at the border. Thus the April 2017 muster is a new policy that for the first time bars cloud searches. We welcome the muster.

Because CBP did not make the muster itself public, we submitted a Freedom of Information Act (FOIA) request seeking the document. After filing our Alasaad v. Duke lawsuit challenging border device searches, we received a heavily redacted muster. We then filed an administrative appeal, and in response CBP released the one-page muster with significantly fewer redactions, as well as a two-page accompanying memo with some redactions.

The redacted muster states:

  • To avoid retrieving or accessing information stored remotely and not otherwise present on the device, where available, steps such as [REDACTED] must be taken prior to search.
  • Prior to conducting the search of an electronic device, an officer will [REDACTED].

Apparently, these muster redactions refer to what McAleenan has since said publicly: that border agents must disable Internet connectivity before searching a digital device.

Additionally, in his most recent responses (page 89), McAleenan stated that CBP’s no-cloud-access policy goes “above and beyond [that which is] constitutionally required.” We couldn’t disagree more. While we believe that warrantless and suspicionless searches of digital data on a device violate the Fourth Amendment, warrantless and suspicionless searches of cloud data are even more intrusive. The Supreme Court in Riley v. California (2014) agreed, stating, “Such a search would be like finding a key in a suspect’s pocket and arguing that it allowed law enforcement to unlock and search a house.”

We urge travelers to report to us ( when they believe that CBP agents searched their cloud data by failing to put a device in airplane mode or otherwise ensure that the device did not have Internet access. We also urge travelers to submit a FOIA/Privacy Act request to CBP to learn additional details about what border agents might have done with their devices.

Sen. Wyden called on McAleenan to make the entire muster public (page 92). We echo that call. Americans and other travelers have a right to know exactly how the federal government intends to protect this critical aspect of our digital privacy.

The Safest Conversation You'll Have This Holiday

Do your friends and family rope you into providing tech support when you're home for the holidays? Use this opportunity to be a digital security hero and rescue your family from tracking cookies, unencrypted disks, insecure chats, and recycled passwords.

Check out EFF’s Security Education Companion for ideas and inspiration. And remember: People learn by doing! Encourage friends and family members to walk through new security concepts and tools with you, and avoid the pitfalls of taking over their devices and doing it yourself.

  • Did a family member or friend get a fancy new phone, tablet, or computer? Are they worried about losing it or someone stealing it? Help give them peace of mind and keep other people out of their device: show them how to turn on full-disk encryption and password protection.

  • Help others find the software update feature on their operating systems and favorite browsers. Explain that it’s best security practice to regularly update their software, rather than dismissing the reminder box.

Keep in mind that security concepts and tools like these might be completely new to your friends and family. Be prepared to walk through the ideas slowly, and don’t be disappointed if someone is not quite ready to change their routine yet. There’s always next Thanksgiving!

Let EFF know how it went! Use the hashtags #TheSafestConversationYoullHaveThisHoliday or #BadgerYourFamily.

SSD ChangeLog

We're happy to share that Surveillance Self-Defense is now available in 10 languages, including recently released Portuguese. We are grateful to all who have worked to make these translations available. SSD's other recent updates and changes include:

Keeping Your Data Safe

We've added a warning to our Keeping Your Data Safe guide about trusting Microsoft's BitLocker in order to capture various threat models.

BitLocker's code is closed and proprietary, which means it is hard for external reviewers to know exactly how secure it is. Using BitLocker requires you trust that Microsoft provides a secure storage system without hidden vulnerabilities. On the other hand, if you're already using Windows, you are already trusting Microsoft to the same extent. If you are worried about surveillance from the kind of attackers who might know of or benefit from a back door in either Windows or BitLocker, you may wish to consider an alternative open source operating system such as GNU/Linux or BSD, especially a version that has been hardened against security attacks, such Tails or Qubes OS.

How to: Encrypt Your Windows Device

Our How to: Encrypt Your Windows Device outlines how to use open-source encryption suite, DiskCryptor, to encrypt your device. Please note that users have reported serious problems with DiskCryptor on Windows 8 with UEFI boot. We suggest you create a bootable disk image before attempting full disk encryption on these machines. 

Surveillance Self-Defense Video Animations

As we mentioned before, EFF collaborated with AJ+ to create four video animations that have now been incorporated into SSD as standalone overviews.

Why Metadata Matters

Those who collect or demand access to metadata, such as governments or telecommunications companies, argue that the disclosure (and collection) of metadata is no big deal. Unfortunately, these claims are just not true. Even a tiny sample of metadata can provide an intimate lens into a person’s life. Find out why metadata matters, who can access the metadata you transmit when you communicate, and how it might be used by checking out our new guide.

How to: Use OTR for Linux

We've added a new, step-by-step guide that explains how to use OTR for Linux.  If you're a Mac or Windows user, please reference our other guides, How to: Use OTR for Mac and How to: Use OTR for Windows.

In the News

  • A recent Citizen Lab report reveals a sophisticated phishing campaign targeting Iranian diaspora.
  • A fake EFF site has been used as bait to distribute malware whose use has been connected to the Russian state.
  • Peru’s executive branch adopted a legislative decree (DL 1182) dubbed "Ley Acosadora," or in English, "the Stalker Law," that allows warrantless access to Peruvians' location data.
  • German domestic intelligence agency have been accused of trading its own data about their German citizens for access to the NSA's XKEYSCORE spying program.
  • The UK government is looking to introduce an investigatory powers bill—a revival of the Snoopers' Charter with even more spying powers for the police and GCHQ.


JavaScript license information