Risk

12/1/2011
10:52 AM
50%
50%

Kindle Fire Draws Privacy Slam From Congressman

Massachusetts Rep. Ed Markey says Amazon needs to come clean about what it’s doing with user data generated by the hot-selling tablet.

Amazon Kindle Fire: Visual Tour
Amazon Kindle Fire: Visual Tour
(click image for larger view and for slideshow)
A senior Congressman said Amazon is dodging questions about how it's using what he called a "massive" trove of information collected from Kindle Fire users.

In an October letter to Amazon CEO Jeff Bezos, U.S. Rep. Edward Markey (D-Mass) asked for details on how Kindle Fire user data is collected, stored, and used. Amazon replied last month, but in a statement issued Tuesday Markey said the answers were insufficient.

"Amazon's responses to my inquiries do not provide enough detail about how the company intends to use customer information, beyond acknowledging that the company uses this valuable information," Markey said.

[ The consumerization of IT raises security issues. Read Kindle Fire Hits The Office: 5 Security Concerns. ]

The hubbub between Markey and Amazon arose following an Oct. 3rd report in the New York Times, in which the paper noted that Kindle Fire and its Silk browser, which splits page rendering between the device and Amazon's cloud-based AWS servers, "may give Amazon unique insights into the Web clicks, buying patterns, and media habits of Fire users."

In his letter to Bezos, Markey, who is co-chairman of the Congressional Bi-Partisan Privacy Caucus, said, "I am concerned that such a combination will enable Amazon to collect and utilize an extraordinary amount of information about its users' Internet surfing and buying habits." Markey demanded that Amazon provide Congress with details about how it's using the information.

In response, Amazon global public policy VP Paul Misener said the company takes a number of steps to ensure user privacy and security. He said Amazon separates data collected from users from customer identities, only caches content that Web site owners have tagged as acceptable for caching, and routes secure SSL page requests directly from Kindle Fire to the origin servers, bypassing the AWS platform.

"In addition to the other customer-focused protections described above, customers have the option to turn off the cloud acceleration feature of Silk. In that 'off cloud' mode, Web pages go directly to a user's device rather than pass through AWS servers, and customers still enjoy a good browsing experience (though it cannot be as fast as with cloud acceleration turned on)," Misener said in his letter, a copy of which was provided by Markey's office.

In his statement Tuesday, Markey said he wasn't satisfied. "Amazon states 'Customer information is an important part of our business,' but it is also important for customers to know how the company uses their personal information." Markey added, "Amazon is collecting a massive amount of information about Kindle Fire users, and it has a responsibility to be transparent with its customers."

Privacy concerns don't appear to be dampening demand for Kindle Fire, as the device was one of the hottest selling products over the Black Friday to Cyber Monday weekend.

Amazon said it sold four times as many Kindle products on Black Friday as it did last year, and that Kindle Fire, which features a color touchscreen and direct links to Amazon and third-party content like Netflix, topped all Kindle sales. And retail giant Target said the Kindle Fire outsold Apple's iPad 2 in its stores.

Markey said he planned to "follow up" with Amazon to get more information about how the company uses data generated by Kindle Fire users.

In today's uncertain and highly scrutinized financial services industry, achieving effective risk management is vital for survival. The report examines the need for enterprise risk management, the benefits of holistic data management, and ERM best practices. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12697
PUBLISHED: 2018-06-23
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.
CVE-2018-12698
PUBLISHED: 2018-06-23
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.
CVE-2018-12699
PUBLISHED: 2018-06-23
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.
CVE-2018-12700
PUBLISHED: 2018-06-23
A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.
CVE-2018-11560
PUBLISHED: 2018-06-23
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.