In RetroTech: NetLingo Blog

The use of fitness apps “has exploded in recent years,” but you aren't the only one keeping an eye on the data.

The use of apps that track your health and fitness “has exploded in recent years,” said Emily Steel and April Dembosky in the Financial Times. But do you really know who else is keeping an eye on how much you run, sleep, eat, smoke, and weigh? According to new research our newspaper commissioned, health and fitness apps routinely share user data with digital analytics and advertising firms; one of the most popular, MapMyRun, shares data with 11 outside companies.

The developer, like most others in the sector, says that only aggregated data is sold to advertisers, and that no “personally identifiable information” goes to third parties without the user’s explicit permission. In fact, that’s how many of the apps make money. Developers often profit from actively collaborating with insurance firms, which use authorized personal data to set fitness and health goals for employee health plans. “When users meet certain fitness benchmarks, they are offered discounts on their health premiums.” Some employers even offer incentives like “vacuum cleaners or luxury vacations.”

“This isn’t a surprise,” said Stuart Dredge in The Guardian (U.K). In this privacy day and age, data sharing is inevitable. “Developers know this, and so do tech-savvy app users.” But providing—or selling—data to insurance providers is clearly “a particularly sensitive area.” Not everyone will want such information to get out. That’s why app developers “should be as transparent as possible with their users about how their data is being shared.” And before you start oversharing with your health app, ask yourself who might own that data down the road. “If your favorite fitness apps take off, they may be acquired by bigger fish in the health-care or insurance industry in the next few years.” Your data may well be part of the deal.

There are ways to minimize the risk of your health data going where you don’t want it to go, said Ann Carrns in The New York Times. Consumers should “consider the credibility of the health apps they choose.” Look for apps from better-known brands that have a track record and “more resources to spend on comprehensive data security.” Smaller developers might not encrypt your data before transmitting it to their servers, for instance. Inspect an app’s privacy policy; you may be able to opt out of certain information-sharing practices that raise a red flag. But don’t count on the law to be on your side—“there’s little regulatory protection for health information shared over consumer apps.”

Subscribe to the NetLingo Blog via Email or RSS here!

The Syrian Electronic Army struck us last year, said Matt Buchanan in NewYorker.com. If you were on Twitter or NYTimes.com, you may well have seen the mysterious hacker collective’s coat of arms instead of the news you sought. Twitter recovered quickly, but the Times’ website remained down for almost a day. It’s far from the first time the SEA has waged war on media organizations. Last year, it hijacked Al Jazeera’s website, Twitter accounts, and SMS text service.

It also commandeered the Twitter accounts of numerous media outlets, and directly vandalized sites belonging to Time, CNN, The Washington Post, and NPR. In its most recent attacks, it gained access to an Australia-based domain-name registration service used to manage the Times’ and Twitter’s Web addresses, a feat one Times official compared to “breaking into Fort Knox.” Its method was surprisingly simple: It acquired a legitimate login for the Melbourne facility by spear phishing, or tricking people “into voluntarily revealing information in response to what appears to be a message from a legitimate website or service.”

Here’s more proof, as if we’d needed it, that borders in cyberspace are “badly defended,” said James Lewis in CNN.com. The message of these most recent attacks on Western media has been “one of scorn, ridicule, and belittlement.” But make no mistake—these attacks can have consequences. When the SEA hijacked the AP’s Twitter account in April and tweeted, “Breaking: Two explosions in the White House and Barack Obama injured,” the Dow Jones industrial average briefly plunged more than 150 points, temporarily wiping out $136.5 billion in stock value. And “if the Syrian Electronic Army can slip by feeble defenses to make fun of the media, someone else might be able to get in and cause more serious disruption.”

Website owners should take the hint, said Steven J. Vaughan-Nichols in ZDNet.com. All employees should be warned against phishing emails and reminded to always double-check emails and links from service providers or websites to make sure they’re not handing over passwords to hackers or thieves. There’s an easy fix to make sure your website doesn’t suffer the same fate as the Times’: Ask your domain registrar to set up a “registry lock,” which prevents anyone from making changes alone. If you don’t take that precaution, maybe you’ll risk only the inconvenience of your site being down for a few hours. But there could be a far higher cost: “having your online reputation ruined and your customers buried in malware.”

Subscribe to the NetLingo Blog via Email or RSS here!