Connect with us

Business

What is 'surveillance pricing,' and is it forcing some consumers to pay more? FTC investigates

Published

on

What is 'surveillance pricing,' and is it forcing some consumers to pay more? FTC investigates

It’s no secret that Californians pay more than the rest of the country for many goods and services — gas, housing, food, you name it. That’s part of the high cost of living in this state.

What’s less well known, though, is that consumers may be paying higher prices than their neighbors pay.

Tech firms and consultants have been offering companies the ability to set “personalized” prices online based on a customer’s ability or willingness to pay, using algorithms and artificial intelligence to sift through mountains of data to help maximize sales and profits. Advocates say the technology simply takes the principle of efficient pricing to its logical extreme; critics say it’s unfair, discriminatory and a perversion of free-market capitalism.

On Tuesday, the Federal Trade Commission launched an investigation that aims to determine how widespread this kind of “surveillance pricing” has become and what its effects have been. The five commissioners voted unanimously to order eight financial, tech and consulting companies to reveal what pricing services they offer, what data they collect to power these services, who is using their services and what effect that’s having on consumer prices.

FTC Chief Technology Officer Stephanie Nguyen said in an interview that the agency knows companies “are collecting massive amounts of data about consumers,” including very detailed, sensitive data about their demographics, where they go, what they look for and what they buy. The agency also knows that companies are able to use these data to specifically target information to individuals or groups.

Advertisement

Its new inquiry, she said, aims to determine whether, how and how often such data are being deployed to set prices. She added that the agency is just gathering information at this point, and that none of the companies are being accused of any wrongdoing.

Privacy advocates welcomed the investigation.

“This study is such a critical first step in a really important conversation about what we think the rules should be around pricing — what we think the norm should be,” said Lindsay Owens, executive director of Groundwork Collaborative, an economic policy think tank.

Rather than setting prices based on supply and demand, surveillance pricing looks at indicators of your ability and willingness to pay, such as your credit card and bank balances, or “whether it’s late at night and you’re looking for an Uber home,” said Lee Hepner, senior legal counsel for the American Economic Liberties Project.

“We have heard allegations that some companies are now able to charge you a different price based on how close you are to your next payday, or if you just got paid,” he said.

Advertisement

The eight companies ordered to submit information to the FTC are financial industry titans Mastercard and JPMorgan Chase, consultancies Accenture and McKinsey & Co., and tech companies Revionics, Bloomreach, Task Software and PROS.

JPMorgan Chase said Tuesday that it hadn’t heard from the agency yet. Mastercard said it would cooperate in the process, and the other six companies did not respond to requests, or could not be reached, for comment.

The unanimous vote of the commission reflects a bipartisan interest in exploring the issues around pricing based on personal data, which in turn mirrors public sentiment about online privacy. A survey last year by the Pew Research Center found that 81% of respondents were concerned about how companies use the data collected about them, and 67% had little to no understanding about what companies did with their data.

One of the threats posed by surveillance pricing is that it gives companies an incentive to collect even more data about customers because the information might be useful in these pricing systems, said R.J. Cross, the director of the consumer privacy program at the U.S. Public Interest Research Group.

“The overcollection of data already comes with security and privacy issues,” she said; the more data that’s collected, the more likely it is that the information will be exposed in a breach or hack. “It’s just going to add fuel to a fire that may have big, negative consequences for all of us down the line.”

Advertisement

Owens said another issue is how surveillance prices erode the longstanding practice of having a public price, which emerged when retailers stopped haggling over everything and started putting price tags on their goods. Public prices are important, Owens said, because they help ensure fairness and are transparent and predictable.

The absence of predictable prices, Hepner said, makes it hard for people to budget for what they need.

George Slover, senior counsel for competition policy at the Center for Democracy & Technology, said “bespoke pricing” amounts to an extreme reversal of a system that has worked for consumers since the advent of the price tag. Instead of sellers offering goods and services to anonymous buyers, he said, “the seller knows everything about the buyer, and what they are likely, willing and able to pay” — while keeping the buyer in the dark about what the seller is charging everyone else.

“It inverts, or you might say perverts, the assumptions at the very foundation of the justification for the free market,” he said.

The use of AI to power surveillance pricing systems is a potential hurdle to the FTC’s inquiry, observers say, because the systems’ inner workings may be difficult to unpack and understand.

Advertisement

“It makes the job a lot harder if the people who are making the AI systems can’t even clearly articulate why a system is making a decision,” Cross said. “That really puts regulators at a disadvantage.”

The legal landscape is murky, too.

There are federal laws that prohibit charging discriminatory prices in certain circumstances — for example, when people are charged different rents or mortgage interest rates based on their race — but Hepner said surveillance pricing may represent “a new frontier in price discrimination” not reached by those statutes.

The FTC may have the power to rein in surveillance pricing, though, if the agency determines that it violates the federal law against unfair and deceptive practices. And in Owens’ view, it is by nature deceptive because it’s done in secret — you don’t know you’re paying more online than someone else for the same goods, so “you have no idea that you should be upset.”

“Isolation and obfuscation,” she added, “are really essential to the practice.”

Advertisement

Business

Travelers Delayed or Stuck by the CrowdStrike Outage: What Did Your Airline Provide?

Published

on

The flight disruptions brought on by the global I.T. failure were deemed within the control of the airlines, meaning airlines have to reimburse passengers for meals, transportation and hotels. Did your carrier live up to the requirement?

Continue Reading

Business

Video game performers move closer to strike as SAG-AFTRA negotiations stall over AI

Published

on

Video game performers move closer to strike as SAG-AFTRA negotiations stall over AI

Video game actors are inching closer to a walkout as performers union SAG-AFTRA and the top video game companies struggle to reach a deal on contract terms related to artificial intelligence.

The Screen Actors Guild-American Federation of Television and Radio Artists announced over the weekend that its national board has granted its national executive director and chief negotiator, Duncan Crabtree-Ireland, the authority to call a strike if the union cannot obtain a settlement with the companies.

The announcement comes nearly a year after more than 30,000 union members voted 98% in favor of authorizing a strike while bargaining for a new Interactive Media Agreement.

The contract expired in November 2022 and covers about 2,600 performers doing voice and motion-capture work in the video game industry.

Advertisement

“Our resolve is unwavering and should not be tested,” Crabtree-Ireland said in a statement.

“We are steadfast in our commitment to our membership who work this contract and whose extraordinary performances are the heart and soul of the world’s most popular video games. Time is running out for the companies to make a deal.”

Crabtree-Ireland pressured video game producers to bring forth an offer that includes significant gains for performers, especially in the realm of AI. Game performers contend that they are particularly vulnerable to AI because many of them specialize in voice-over work.

“We are continuing to negotiate in good faith and have reached tentative agreements on the vast majority of proposals,” Audrey Cooling, a spokesperson for the video game producers, said in a statement.

“Based on that progress, we remain optimistic that a deal is within reach.”

Advertisement

The latest move by SAG-AFTRA comes about a year after TV and movie actors staged a strike that lasted 118 days. AI was also a major sticking point in that labor dispute.

The last time game actors went on strike was in October 2016.

Video game workers are seeking a contract that would require producers to get their consent before reproducing their voices or likenesses with AI. They are also demanding compensation when AI is used to replicate their performances.

Additionally, the performers are looking for wage increases to keep up with inflation, more rest time and set medics for stunts and hazardous jobs.

Former Times staff writer Sarah Parvini contributed to this report.

Advertisement
Continue Reading

Business

Column: The CrowdStrike meltdown reminds us that the hacking problem doesn't come only from outside

Published

on

Column: The CrowdStrike meltdown reminds us that the hacking problem doesn't come only from outside

Just last Wednesday, I posted a column reporting how our richest corporations, through sheer miserliness and profit-seeking, left millions of Americans vulnerable to technological attacks on their privacy and welfare.

I failed to raise one important question: What if the attacks come from inside the house?

That’s exactly what happened Friday. An ineptly designed update to a program rolled out by the cybersecurity company CrowdStrike and installed automatically on users’ machines instantly crashed millions of computers running Microsoft programs and left them disabled until manual fixes could be undertaken. Some haven’t been fixed yet.

Crowdstrike seemingly borrowed Boeing’s approach to quality control.

— Business blogger Ed Zitron

Advertisement

The fallout reached worldwide and affected people across the modern technological landscape. Thousands of flights were canceled. Doctors couldn’t perform surgeries. Banking transactions were frozen. Emergency 911 lines went silent.

The affected computers displayed what Microsoft Windows users know as the dreaded “blue screen of death.” Typically, this is a baby-blue screen bearing the message that Microsoft’s operating system hadn’t loaded correctly and the machine should be restarted.

That didn’t work this time: The errant CrowdStrike application was burrowed so deep within the Microsoft operating system — as it’s designed to do — that every time a machine restarted, it ran into the same glitch and went dead again in an infinite doom loop.

The CrowdStrike program — irony of ironies — is an anti-hacking application that identifies hacking attempts and fights them off. In the cat-and-mouse game pitting computer users against hackers, such applications have to be updated regularly. They reside in the bowels of the operating system, because in order to be effective, they have to load before almost any other function.

Advertisement

In this case, a coding error in the update delivered an order to the operating system that caused the system to shut down.

That’s a simplified explanation of what happened. Now let’s look at the lessons this episode teaches us — if we’re willing to learn them.

They have to do with our complacency about our dependence on digital systems, including those distributed by developers we’ve never heard of (CrowdStrike, for instance).

What few people are aware of as they go about their lives is how much crucial digital infrastructure is based on Microsoft programs and applications, and how much of those are supplemented by third-party programs and applications.

All of this must work together to work smoothly — or to appear to work smoothly. Here and there something goes wrong, but its ramifications are sufficiently constrained that it can be rectified quickly, and even invisibly.

Advertisement

A great deal of it, furthermore, is automated; it’s designed to run with a minimum of human intervention. In the view of the IT departments that are expected to monitor all this, humans are perpetual money pits — they need days off, get sick, demand raises, quit and must be replaced by newbies needing training, etc., etc. By comparison, machines look like a one-time capital expense — set it and forget it, is the goal.

Microsoft is the hub of these networks because Microsoft made them its business. It created an open architecture for third-party developers to piggyback on; the fundamental idea was that by extending the system’s capabilities, those other developers made Microsoft’s central system more valuable. Microsoft either outsourced some functions to independent developers, or allowed them to design applications that competed with Microsoft’s versions — but those still were designed to work with Microsoft operability.

Among those developers is Austin, Texas-based CrowdStrike, one of countless firms offering cybersecurity services to Windows users. (Microsoft’s own cybersecurity suite is known as Defender.)

Apple computers and devices don’t have the same vulnerabilities because that company does almost all its extensions in-house, and keeps a very close eye on what it allows to interact with its software and hardware; the company doesn’t allow outside applications to interact with its operating system at the fundamental level available with Microsoft’s systems.

But Apple doesn’t have anywhere near as large a footprint in enterprise services as Microsoft. A report issued in March by the government’s Cyber Safety Review Board about a major hacking intrusion into Microsoft’s cloud system in March 2023 asserted that the company’s “ubiquitous and critical products … underpin essential services that support national security, the foundations of our economy, and public health and safety.”

Advertisement

Anyone living in the modern world has to confront the drawbacks of our reliance on digital technology on almost a daily basis. In prehistoric days, back when our household appliances were mechanical or electric, not electronic, a breakdown was easy to diagnose and fix — switch out a tube or tighten a screw.

When a device ceases to function today, it’s often impossible to pinpoint the fault — did my TV go bad, or did the internet go down, or was it just the channel I was watching?

Yet many of us rely on a single company for multiple services. For example, I get my home phone service, broadband internet, and television/video (broadcast and cable channels and streaming) from a single provider. I don’t have much choice, since for most of these it’s the only provider in my neighborhood. But when it goes down, everything goes down.

That provider, Spectrum, has tried to sell me on its mobile phone service too. I’ve refused, because I figure I need at least one thread of access to the outside world that isn’t dependent on its all-in-one monopoly.

Microsoft’s near-dominance of cloud computing — the ecosystem through which all those enterprise computers that went dead last week communicate with each other and with the outside world — should make all of us queasy, because the company’s cybersafety record is atrocious.

Advertisement

The Cyber Safety Review Board investigation concluded that the March 2023 hack occurred because “Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations.”

The board mentioned, among other things, a “cascade of … avoidable errors” in the company’s cybersecurity program, its failure to detect the compromise by hackers of its own “cryptographic crown jewels,” but only acted after a customer — the U.S. State Department — discovered the incursion itself.

The board found that Microsoft’s security practices were inferior to those of “other cloud service providers.” The report mentioned Amazon, Google and Oracle as Microsoft rivals in cloud services with better security systems.

Microsoft pledged to “adopt a new culture of engineering security in our own networks” and said it had “mobilized our engineering teams to identify and mitigate legacy infrastructure, improve processes, and enforce security benchmarks.”

The CrowdStrike crash suggests that those efforts are still works in progress. It’s fair to say that much of the blame belongs to CrowdStrike, which allowed an update to a crucial application to be sent to users for automatic installation without doing the testing necessary to ensure that the update was operationally bulletproof.

Advertisement

Technology blogger Ed Zitron properly tied the disaster to the financialization of Big Business generally, in which pumping ever higher profits to shareholders becomes a higher priority than ensuring that one’s products meet quality standards.

“Crowdstrike seemingly borrowed Boeing’s approach to quality control,” Zitron wrote, “except instead of building planes where the doors fly off at the most inopportune times (specifically, when you’re cruising at 35,000ft), it released a piece of software that blew up the transportation and banking sectors, to name just a few.”

CrowdStrike Chief Executive George Kurtz moved promptly to “sincerely apologize” to all affected users, via a statement and an appearance on the NBC “Today” show. “We quickly identified the issue and deployed a fix, allowing us to focus diligently on restoring customer systems as our highest priority,” Kurtz said in a posting on the company’s website.

Microsoft placed the blame chiefly on CrowdStrike. “Although this was not a Microsoft incident, given it impacts our ecosystem, we want to provide an update on the steps we’ve taken with CrowdStrike and others to remediate and support our customers,” David Weston, a vice president for enterprise and security, wrote on the company’s website.

But Microsoft, plainly, failed to take on board the necessity of vetting every piece of third-party software that could have an effect on its own customers — before it blew up their computer systems.

Advertisement

No software system is immune from errors, especially now that they’re so complex and multilayered that not even their developers may know all their weak spots. (An error at Amazon’s cloud service incapacitated as many as 150,000 websites for several hours in February 2017 — a major problem, but not nearly on the scale of the CrowdStrike crash.)

But as these systems play an ever expanding role in modern life even as they become more complex, it’s incumbent on their providers to make security and safety their top priorities, not merely mouth the concept in marketing material without actually taking it seriously.

Cloud clients also need to pay more attention to what is getting automatically inserted into their systems. Who has the right to gloat over escaping the CrowdStrike meltdown last week? Amusingly, it’s Southwest Airlines. For decades, Southwest resisted Microsoft’s urgings that it upgrade its systems to the latest versions of Windows, relying on Windows 3.1, which is 32 years old — so antique that the CrowdStrike update wouldn’t even work on the airline’s systems.

So while affected carriers such as Delta, United and American had canceled nearly 2,400 flights by 6 p.m. Friday, Southwest had canceled three. (By midday Monday, the number of canceled flights reached beyond 12,300.) That doesn’t mean that Southwest gets everything right. After all, the airline suffered more than its competitors from the ferocious storm in December 2022 that snarled air traffic nationwide — precisely because it had not paid enough attention to keeping its computer systems updated.

In this case, however, Southwest’s cheapskate culture was its savior. That may only put it on the same level as the proverbial blind squirrel that occasionally finds a nut. But it shows that all of our Big Business squirrels need to keep their eyes open, and focused on the perils of inattention.

Advertisement
Continue Reading

Trending