Risk
12/1/2011
10:52 AM
50%
50%

Kindle Fire Draws Privacy Slam From Congressman

Massachusetts Rep. Ed Markey says Amazon needs to come clean about what it’s doing with user data generated by the hot-selling tablet.

Amazon Kindle Fire: Visual Tour
Amazon Kindle Fire: Visual Tour
(click image for larger view and for slideshow)
A senior Congressman said Amazon is dodging questions about how it's using what he called a "massive" trove of information collected from Kindle Fire users.

In an October letter to Amazon CEO Jeff Bezos, U.S. Rep. Edward Markey (D-Mass) asked for details on how Kindle Fire user data is collected, stored, and used. Amazon replied last month, but in a statement issued Tuesday Markey said the answers were insufficient.

"Amazon's responses to my inquiries do not provide enough detail about how the company intends to use customer information, beyond acknowledging that the company uses this valuable information," Markey said.

[ The consumerization of IT raises security issues. Read Kindle Fire Hits The Office: 5 Security Concerns. ]

The hubbub between Markey and Amazon arose following an Oct. 3rd report in the New York Times, in which the paper noted that Kindle Fire and its Silk browser, which splits page rendering between the device and Amazon's cloud-based AWS servers, "may give Amazon unique insights into the Web clicks, buying patterns, and media habits of Fire users."

In his letter to Bezos, Markey, who is co-chairman of the Congressional Bi-Partisan Privacy Caucus, said, "I am concerned that such a combination will enable Amazon to collect and utilize an extraordinary amount of information about its users' Internet surfing and buying habits." Markey demanded that Amazon provide Congress with details about how it's using the information.

In response, Amazon global public policy VP Paul Misener said the company takes a number of steps to ensure user privacy and security. He said Amazon separates data collected from users from customer identities, only caches content that Web site owners have tagged as acceptable for caching, and routes secure SSL page requests directly from Kindle Fire to the origin servers, bypassing the AWS platform.

"In addition to the other customer-focused protections described above, customers have the option to turn off the cloud acceleration feature of Silk. In that 'off cloud' mode, Web pages go directly to a user's device rather than pass through AWS servers, and customers still enjoy a good browsing experience (though it cannot be as fast as with cloud acceleration turned on)," Misener said in his letter, a copy of which was provided by Markey's office.

In his statement Tuesday, Markey said he wasn't satisfied. "Amazon states 'Customer information is an important part of our business,' but it is also important for customers to know how the company uses their personal information." Markey added, "Amazon is collecting a massive amount of information about Kindle Fire users, and it has a responsibility to be transparent with its customers."

Privacy concerns don't appear to be dampening demand for Kindle Fire, as the device was one of the hottest selling products over the Black Friday to Cyber Monday weekend.

Amazon said it sold four times as many Kindle products on Black Friday as it did last year, and that Kindle Fire, which features a color touchscreen and direct links to Amazon and third-party content like Netflix, topped all Kindle sales. And retail giant Target said the Kindle Fire outsold Apple's iPad 2 in its stores.

Markey said he planned to "follow up" with Amazon to get more information about how the company uses data generated by Kindle Fire users.

In today's uncertain and highly scrutinized financial services industry, achieving effective risk management is vital for survival. The report examines the need for enterprise risk management, the benefits of holistic data management, and ERM best practices. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7421
Published: 2015-03-02
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.

CVE-2014-8160
Published: 2015-03-02
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disall...

CVE-2014-9644
Published: 2015-03-02
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-201...

CVE-2015-0239
Published: 2015-03-02
The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYS...

CVE-2014-8921
Published: 2015-03-01
The IBM Notes Traveler Companion application 1.0 and 1.1 before 201411010515 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by c...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.