Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spanish football league defends phone 'spying'

bbc.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Spanish football league defends phone 'spying'

#21

Post by pdkl95 »

lightbyte wrote: post #6

The actual statement from La Liga is in spanish, I translated it with DeepL [1] here: >Privacy policy of the LaLiga app. >Regarding the new privacy policy of the LaLiga app, we would like to make some clarifications. >Origin >LaLiga has the responsibility to protect clubs and their fans from fraud in the broadcasting of football matches by public institutions (HORECA). These fraudulent activities represent an estimat…

>>LaLiga does not access the audio fragments picked up by the device's microphone, as they are automatically converted into binary code on the device itself. LaLiga only accesses this binary code

Audio fragments are a "binary code", usually pulse code modulation samples. In this case, JorgeGT's link[1] shows that the app is reading PCM data with Android's AudioRecord API.

If they mean that they are hashing or otherwise obscuring the data (which probably can be reversed or correlated to other data in some situation), they need to say that. This statement could be interpreted that they "only access this binary [PCM samples]", not the "[raw, analog] audio fragments".

>>If this code matches a previous control code

Maybe this is a translation issue, but they seem to be conflating "codes" representing audio patterns with identification codes such as "your IP address and the specific ID assigned by the PPP when you register". The last part also admits they are "referring to your name" that you used when registering. They are simply using a synthetic key as a proxy. This is confirmed by this function in the code[2]:

    public void linkUserIds(String fluroId, String adId)
that sends a GET request specifically for the purpose of linking their "fluroId" to what is presumably some type of ad tracker id.

[1] https://reversecodes.wordpress.com/2018/06/12/analizando-la-...

[2] Ibid.

Re: Spanish football league defends phone 'spying'

#22

Post by godelski »

severine wrote: post #17
lightbyte wrote: post #6

The actual statement from La Liga is in spanish, I translated it with DeepL [1] here: >Privacy policy of the LaLiga app. >Regarding the new privacy policy of the LaLiga app, we would like to make some clarifications. >Origin >LaLiga has the responsibility to protect clubs and their fans from fraud in the broadcasting of football matches by public institutions (HORECA). These fraudulent activities represent an estimat…

This would be the corresponding translation of the analysis linked upthread, from https://reversecodes.wordpress.com/2018/06/12/analizando-la-... : Leaving aside the first part where they try to justify themselves by talking about economic losses and other stories, in the third paragraph they already begin to say things that do not agree with reality. This new functionality for fraud detection is enabled in the app s…

Why couldn't you do it on device? All you would need to do it have some distinct sounds playing during the broadcast that the phone would pick up and you wouldn't notice. Kind of like how Amazon didn't set off everyone's Alexa during the super bowl.

Re: Spanish football league defends phone 'spying'

#23

Post by JorgeGT »

hartator wrote: post #19
JorgeGT wrote: post #5

Earlier quoted context omitted.

This was indeed discovered because as per GPDR, they had to specify why they were using the mic and GPS. As soon as the update hit the store (after the GPDR entered into effect) and some users saw the changelog and user permission requests disclosing this use, it started to hit the news here in Spain. The Spanish regulator, AEPD, has stated that preliminary steps to begin an official investigation are being conducted…

You mean they were using the mic to see if you were watching the game?

Yes. Then, they would try to pinpoint your location and if you were watching the game at a bar that doesn't have a license from them, they would sue the owner.

Now that they need your consent, they have named this feature "protect your team!" since the teams get royalties from bar licenses...

Re: Spanish football league defends phone 'spying'

#24

Post by graeme »

Larrikin wrote: post #20
throw2016 wrote: post #18

Interesting only Android users are targeted thanks to Google's frivolous approach to privacy and surveillance. At what point does Google take responsibility? Here is an OS and permission system that works against its users based on open source technology by a surveillance loving company actively involved in building a techno dystopia. That summarizes everything wrong with tech today. But even worse is the army of sho…

Android has had the exact same permission model as Apple for years now

The app is using the app for background audio monitoring. Ios apps can't do that without displaying a big bar showing they are recording.

I'm assuming la liga app is background audio.

Re: Spanish football league defends phone 'spying'

#25

Post by danbruc »

If you generate a fingerprint of the audio on the phone, you would not leak too much information about the environment. Shazam, for example, computes the spectrum, picks the strongest peaks, and uses the relative positions of small groups of peaks in time and frequency as features to search for in known recordings. Those features are quite sparse and you can not reconstruct the audio from them. You could however identify more or less every audio signal in the environment you have a copy of to compare against.

You could do better by sending out the fingerprint you are looking for and compare it against the past couple of seconds or minutes on the phone so that you could only report a match if one occurred. This would avoid leaking what music you are listening to or what you are watching on TV unless it is what they are looking for. If you report a match with GPS coordinates, the server could throw away everything but the position so that the position is not easily linked to a user.

This still reveals all the living rooms in which someone watched the match and used the app, so it's not perfect. If you have a map of all relevant businesses, you could just count matches in the proximity for each or you could only keep matches from locations from which a certain minimum number of matches were reported which should also get rid of most living rooms. This is still not perfect, it, for example, potentially leaks how popular different places are but from a privacy perspective of app users it seems acceptable to me, at least given you trust them to do it right.

The real issue, at least in my opinion, is that they turn the app users against the business owners of the places they like to watch matches at. I am not against them trying to track the ones down that are not paying, they have a legitimate interest in that. But the way they are trying to do it seems wrong to me. There are probably some app users that would welcome if everyone had to pay but I guess most don't really care whether their favorite sports bar pays or not and even more would not want to cause trouble for the business owner even if they think they should pay. In consequence this is a feature that many if not most app users would not want to use even if there were no privacy issues. They still put it in hoping that nobody would take notice and that they could get away with it, at least for some time.

Re: Spanish football league defends phone 'spying'

#26

Post by narag »

throw2016 wrote: post #18

Interesting only Android users are targeted thanks to Google's frivolous approach to privacy and surveillance. At what point does Google take responsibility? Here is an OS and permission system that works against its users based on open source technology by a surveillance loving company actively involved in building a techno dystopia. That summarizes everything wrong with tech today. But even worse is the army of sho…

iPhones in Spain are absurdly expensive.

Re: Spanish football league defends phone 'spying'

#27

Post by narag »

pdkl95 wrote: post #21
lightbyte wrote: post #6

The actual statement from La Liga is in spanish, I translated it with DeepL [1] here: >Privacy policy of the LaLiga app. >Regarding the new privacy policy of the LaLiga app, we would like to make some clarifications. >Origin >LaLiga has the responsibility to protect clubs and their fans from fraud in the broadcasting of football matches by public institutions (HORECA). These fraudulent activities represent an estimat…

>>LaLiga does not access the audio fragments picked up by the device's microphone, as they are automatically converted into binary code on the device itself. LaLiga only accesses this binary code Audio fragments are a "binary code", usually pulse code modulation samples. In this case, JorgeGT's link[1] shows that the app is reading PCM data with Android's AudioRecord API. If they mean that they are hashing or otherwi…

They're pretty much describing a hash. The statement is for general public, don't expect technical jargon.

Re: Spanish football league defends phone 'spying'

#28

Post by narag »

severine wrote: post #17
lightbyte wrote: post #6

The actual statement from La Liga is in spanish, I translated it with DeepL [1] here: >Privacy policy of the LaLiga app. >Regarding the new privacy policy of the LaLiga app, we would like to make some clarifications. >Origin >LaLiga has the responsibility to protect clubs and their fans from fraud in the broadcasting of football matches by public institutions (HORECA). These fraudulent activities represent an estimat…

This would be the corresponding translation of the analysis linked upthread, from https://reversecodes.wordpress.com/2018/06/12/analizando-la-... : Leaving aside the first part where they try to justify themselves by talking about economic losses and other stories, in the third paragraph they already begin to say things that do not agree with reality. This new functionality for fraud detection is enabled in the app s…

The signal for public broadcast is different from the home licenses. They can choose a few seconds fragment where they know volume peaks at certain points and create a hash. Then calc probabilities. Seems feasible.

Re: Spanish football league defends phone 'spying'

#29

Post by narag »

danbruc wrote: post #25

If you generate a fingerprint of the audio on the phone, you would not leak too much information about the environment. Shazam, for example, computes the spectrum, picks the strongest peaks, and uses the relative positions of small groups of peaks in time and frequency as features to search for in known recordings. Those features are quite sparse and you can not reconstruct the audio from them. You could however iden…

Private home licenses are different from public locals licenses and signals are also slightly different. Actually what bars do is buy a home license and use it for public locals.

What I would find infuriating is they get away with it. Data Protection laws are very strict for the little guy, we will see what they do with the 500 pound gorilla.

I'm not optimist. These laws did nothing to curb "legal spam" until GDPR. I'm very satisfied with how all the idiots that flooded us with spam are now begging me to allow them to keep doing it. Good riddance!

Re: Spanish football league defends phone 'spying'

#30

Post by Scoundreller »

narag wrote: post #26
throw2016 wrote: post #18

Interesting only Android users are targeted thanks to Google's frivolous approach to privacy and surveillance. At what point does Google take responsibility? Here is an OS and permission system that works against its users based on open source technology by a surveillance loving company actively involved in building a techno dystopia. That summarizes everything wrong with tech today. But even worse is the army of sho…

iPhones in Spain are absurdly expensive.

My other thinking is ROI. The people with the $100 Android phones were perceived as more likely to watch a black-market broadcast.
Post reply on HN