This week, we saw a disturbing argument from a top US surveillance lawyer that technology has made the Fourth Amendment "outdated". One anonymous commenter won first place for insightful by refuting this as directly and bluntly as possible:

The 4th amendment doesn't become null and void just because you have an easier time violating it.

In second place, we've got a response to the crazy South Carolina anti-porn bill that would mandate filters on all devices and charge people $20 to remove them. Machin Shin wondered how exactly that would play out:

Maybe it was his intention all along "But any manufacturer or seller that didn't want to install the system could pay a $20 opt-out fee for each device sold."

To me that pretty much says "$20 tax is being added to every internet device" because charging an extra $20 is a lot easier and cheaper than jumping over the impossibly high bar set for filtering the entire internet with 100% accuracy.

For editor's choice on the insightful side, we start out with a comment from Jeremy Lyman on the subject of the monopolies and anti-net-neutrality actions of the big ISPs:

If other video providers don't like it, they're all free to build national wireless data distribution networks and unfairly leverage them as they see fit.

Oh, wait. No. No, they're not allowed to do that at all.

Next, after a tiresome and daft commenter made some simplistic and binary assertions about regulation and capitalism, Chuck responded with a thorough and measured response on the subject:

I'm just going to go ahead and say this plain: I am not most Techdirt readers, but actually, YES, I do hate Capitalism and I am pro-regulation.

Now, to be fair, I actually don't hate Capitalism. Capitalism, though, is like faith. If you have BLIND faith, that's a bad thing. It shows a complete and total lack of understanding of the nature of humanity. Faith, giuded by evidence and reason, can be a good thing. Like faith that the president won't start a nuclear war tomorrow. Sure, he totally could, but I have faith, based on the fact that he hasn't for 8 years and his policies are all diplomacy-first, that he won't.

BLIND Capitalism is no better. "Greed is good" may be a joke to most people, but to an alarmingly large part of the richest, both here in the US and the world abroad, these are words to live by. Capitalism is a system of risk and reward, and that's actually a BAD thing. It actively encourages people who can afford to risk their money to do so, and rewards them with even more money. The people who have to gamble the clothes on their back and the food in their bellies in order to "make it" lose more often than they win, and usually because the people who are already established can afford to shut them down with very little risk to themselves.

Moderated, tampered Capitalism can be very good. A system like the Nordic Model - which is neither free-market Capitalism nor outright Socialism - is the ideal system. It is not a difficult system to find fault in, but then neither is ours, and the difference is their elderly are more well cared for, their children are smarter, and they are overall happier people. Life, liberty, and the pursuit of happiness, as it were.

And yes, I am pro-regulation. I am actually pro-unionization. Unions and regulations fill the same role, which is to keep corporations in check. Without one or the other, companies have zero logical reason not to engage in the worst possible behavior in search of the almighty dollar. We don't need both unions and regulation, but since American is (now) one of the least unionized nations on earth, I'm happier with more regulation than neither. Unions are still the ideal solution, but regulation is a decent stand-in.

So yes, in a certain sense, I hate Capitalism and I am pro-regulation, if you want to be overly simplistic about it, but like most things, it's more complicated than that. In truth, I love workers and I am pro-union. But that may be such an unimportant nuance (to you) that you can't see the difference.

There is still a difference, though.

Over on the funny side, our first place comment comes in response to a dental firm that attempted to route around safe harbors and take down bad reviews by abusing trademark law (only to be SLAPPed down). One anonymous commenter posited what reviews might look like under such a regime:

Dr. [Name] did my [dental procedure]. Both Dr. [Name] and his assistant Miss [hygienist] were courteous and the [dental procedure] was done in [time period]. I have recommended him to both [family member's name], my [family member's relation] and to [coworker's name].

In second place, we've got another response to the South Carolina anti-porn bill, this time from a confused anonymous commenter:

But I was told it was democrats who wanted to regulate every aspect of our lives!

For editor's choice on the funny side, we remain on that post, where one commenter suggested that solving the issue might be as easy as re-installing Windows 10 to remove bloatware. David saw a contradiction in that idea:

"Getting rid of bloatware" does not jibe with "re-install Windows 10".

And finally, we've got one more response to the question of regulation and capitalism, but this time it's That One Guy taking a slightly more sarcastic approach:

Absolutely right, there are only two options, an all Encompassing Government with All the Power and No Government At All!

No middle grounds!

You're either for everything the government does(and you're wrong), or anything the government does is wrong and to be fought at all costs. No exceptions and no grey in between, it's literally impossible to think that some things the government does is good and some things are bad, and the first should be encouraged while the second should be called out and fought against.

Entertaining venting aside, when you want to discus what people actually say, in the articles and in the comments, you might find people willing to listen instead of just brushing you aside as dishonest.

That's all for this week, folks!

Five Years Ago

The anti-SOPA momentum continued to gain steam at an exponential rate this week in 2011. Both polls and wildly successful petitions were demonstrating that Americans across the political and demographic spectrum were opposed to the bill. And the list of high-profile voices realizing SOPA was a bad thing was growing by the day: the cable news networks figured it out, a CBS opinion piece went as far as calling for MPAA boss Chris Dodd to be fired over his position on it, and a Reuters columnist explained why SOPA is a cure worse than the disease. Long-retired political cartoonist David Rees picked up his pen again to oppose the bill, MythBusters' Adam Savage explained why it could destroy the internet, and Ashton Kutcher spoke up as well. Scribd launched a creative and aggressive campaign to educate its users, and all sorts of major internet infrastructure players started coming out of the woodwork to oppose SOPA. And, in a major surprise, the Heritage Foundation broke its pattern of support for the MPAA and opposed the bill too.

Moreover, the bill's supposed "support" was crumbling. Gibson Guitars and several other companies that were listed as "in favor" stated that they said no such thing. Law firms started removing their names from those lists too. And, in a high-profile example of successful public pressure, GoDaddy reversed its position and withdrew all support.

Ten Years Ago

This week in 2006, the recording industry was pursuing its more traditional strategy of just suing everyone. The RIAA dropped a case against a mom because it couldn't draw blood from a stone, and turned its attentions to her kids, while a bunch of record labels ganged up and sued Allofmp3.com despite already pressuring Russia into going after the site for them. Meanwhile, with even folks like Roger Ebert calling for eliminating movie release windows and giving customers more options, there was a mixed response from the industry: some folks, like Xbox, were offering actually good video download services, while others like Morgan Freeman (for some reason) were offering crappy competition.

Fifteen Years Ago

This week in 2001, Universal began releasing copy protected CDs in the US to block people from ripping MP3s (or... playing the CDs in Mac computers or DVD players, because that's how you make a good product). A few days later, of course, the protection was easily cracked. Meanwhile, much like 2006's crappy Hollywood-built online movie services, the record industry's new MusicNet and PressPlay offerings were by all accounts pretty terrible, which might explain why music listeners across the board were mostly ignoring them. At least we also saw the seeds of some more successful digital innovations too: people began to notice that Netflix was a strong survivor of the dot-com bubble burst, and rumblings were afoot about selling games for mobile devices.

As you head home for the holidays, perhaps passing through a checkpoint or two, take some time to think about U.S. Patent No. 6,888,460, "Advertising trays for security screening." The owner of this patent, SecurityPoint Holdings, Inc., has sued the United States government for infringement. SecurityPoint recently won a trial on validity [PDF] and the case will now proceed to a damages phase. So, unless the validity decision gets overturned on appeal, we'll soon be paying tax dollars for the idea of moving trays on carts.

Although the title of the patent mentions advertising, some of its claims do not require any ads at all. In fact, the patent is so broad it reads on almost any system of using trays and carts at a checkpoint. The first claim of the patent (with limitations labeled), reads as follows:

1. A method comprising:

[a] positioning a first tray cart containing trays at the proximate end of a scanning device through which objects may be passed, wherein said scanning device comprises a proximate end and a distal end,

[b] removing a tray from said first tray cart,

[c] passing said tray through said scanning device from said proximate end through to said distal end,

[d] providing a second tray cart at said distal end of said scanning device,

[e] receiving said tray passed through said scanning device in said second tray cart, and

[f] moving said second cart to said proximate end of said scanning device so that said trays in said second cart be passed through said scanning device at said proximate end.

In plain English, this claim means: send trays through a checkpoint and use two carts to move the trays back and forth. As is common with patents, the claim uses obtuse language for ordinary things. For example, the word-salad at limitation [f] pretty much just says: "use a cart to move trays from the end of the checkpoint back to the start."

In a trial before the Court of Federal Claims, the government argued that this claim was obvious because moving trays using carts was well-known in many contexts. The court disagreed. The court suggested that even if using carts to move trays was well-known, the government needed prior art specifically for security checkpoints (arguably the government had such evidence, but the court disagreed on that point too).

In fairness to SecurityPoint, evidence at trial suggested that it had developed a good system for managing trays and carts within the confined space of an airport security checkpoint. But the patent's claims are far broader than any specific solution. This is something we often see in patent law: someone develops a (fairly narrow) innovation, but then broadly claims it, capturing things that are well-known or banal. This sort of claiming hurts follow-on inventors who develop their own ideas that wouldn't infringe any narrower claim, and weren't invented by the patent holder. But because the broader claim is allowed, their own inventions become infringing. Here, claim 1 is not limited to any particular kind of cart, tray, or scanner. The claim really reads on using a couple of carts to move trays and, in our view, should have been found obvious.

Together with Public Knowledge, we recently filed an amicus brief [PDF] asking the Supreme Court to consider the obviousness standard in patent law. We argue that, as applied by the Federal Circuit, obviousness law has abandoned common sense. Specifically, we argue that the Federal Circuit has failed to apply a Supreme Court case called KSR v. Teleflex that calls for a flexible, common sense approach. We hope the Supreme Court takes that case. If it does, it might help us save some tax dollars that would otherwise have gone to SecurityPoint. Unfortunately, whatever happens, we'll likely still be stuck waiting at airport checkpoints.

Reposted from EFF's Stupid Patent of the Month series.

Never let it be said that Kamala Harris gives up after being told her totally bogus legal crusade is totally bogus. She's now filed brand new charges against the execs who run Backpage.com -- despite having the very same lawsuit thrown out a few weeks ago. As you may recall, for years, Harris (and some other state Attorneys General) have been crusading against the classified website Backpage, because some of its users use it to post illegal prostitution ads. As has been explained dozens of times, the proper thing to do in those situations is to use that information to go after those actually breaking the law. Instead, Harris and others have whined about their desire to put Backpage execs in jail instead (which won't actually stop any illegal activity -- since it will just move to another site).

Let's be crystal clear here: California Attorney General Kamala Harris (who in just a few weeks will become a US Senator) knows that she has no legal basis for arresting the execs behind Backpage. How do we know she knows this? Because three years ago she signed a letter whining about how she had no legal authority to arrest Backpage because it's (rightly) protected by Section 230 of the CDA, saying that you can't blame a site for the actions of its users. So it did seem weird, back in October, when Harris -- along with Texas Attorney General Ken Paxton -- decided to arrest Backpage's execs anyway, and charge them with "pimping." As we note at the time, the criminal complaint against them was laughable and almost completely bogus. Not only was Backpage protected by CDA 230, but the actual investigation into Backpage undercut the case they were bringing, because it showed a willingness by Backpage to delete prostitution ads when brought to their attention by law enforcement, and to block those users from reposting.

So it was no surprise at all when the court quickly tossed all the charges against the execs, and told Harris to take it up with Congress... which, of course, is where she'll be in a month. However, not content to just try to change the laws, Harris has chosen to file brand new charges against the three execs, Carl Ferrer, Michael Lacy, and James Larkin. The press release from Harris claims that the reason for the new charges is that she's "uncovered new evidence" but that's a load of hogwash.

The new charges still include bogus "pimping" charges, but now also have a bunch of "money laundering" charges as well. And that sounds scary, but once again the details look to be complete bullshit. Basically, the "money laundering" is that Backpage set up a separate operation to handle billing, after American Express (under pressure from grandstanding politicians) said it no longer wanted to work with Backpage. So, the lawsuit argues, Backpage set up a sort of shell corporation to accept AmEx charges, without it looking like they were coming from Backpage. But in order for it to be money laundering, it has to involve a situation where the money itself is coming from illegal activity, and over and over and over and over again the courts have said that Backpage's activity is not illegal. In fact, that's what a court told Harris just two weeks ago.

This is a frightening abuse of power to harass a company just because Harris doesn't like how people use that company, and because she and her staff can't be bothered to do the actual law enforcement work of using that information to go after the actual lawbreakers. It's shameful.

Two bipartisan Congressional committees are the latest to express their opposition to government-mandated encryption backdoors. The House Judiciary Committee and the House Energy and Commerce Committee have arrived at the same conclusion as the experts FBI director James Comey insists on ignoring: encryption backdoors are a net loss for everyone, no matter what gains might be experienced by law enforcement and intelligence agencies.

This is stated plainly in the first bullet point of its encryption report [PDF]:

Any measure that weakens encryption works against the national interest

While the committees acknowledge encryption can impede investigative efforts, the downsides of backdoors cannot be offset by making things easier for certain government agencies.

[S]takeholders from all perspectives acknowledged the importance of encryption to our personal, economic, and national security. Representatives of the national security community told the EWG that strong encryption is vital to the national defense and to securing vital assets, such as critical infrastructure. Civil society organizations highlighted the importance of encryption for individual privacy, freedom of speech, human rights, and protection against government intrusion at home and abroad. Private sector stakeholders—in particular, their information security officers—and members of the academic community approached the question from an engineering perspective—against a wide array of threats, foreign and domestic, encryption is one of the strongest cybersecurity tools available.

However, the committees still believe there might be a way to reconcile competing interests, even though it has more questions than answers at this point. The report suggests more "collaboration" between tech companies and law enforcement agencies -- a term that generally means most of the compromises will be made by the private sector. Whether this means companies collecting more data and communications and storing them where law enforcement can access them or creating "one time" backdoors in response to court orders remains to be seen.

More encouragingly, the report suggests the "smart guys" in law enforcement haven't fully taken advantage of the tools and data available to them.

It also remains unclear whether the law enforcement community is positioned to fully leverage the unencrypted information still held by many companies. A number of stakeholders acknowledged the potential benefit of improving law enforcement’s understanding of what data or information is available, who controls it, and how it could be useful to investigators. In particular, companies are often able to provide volumes of unencrypted metadata associated with their products or services. In some cases, this source of information could be useful to investigators. In others, one representative of a law enforcement agency told the EWG, access to a stream of metadata might be more like “looking for a particular grain of sand on the beach.”

This is probably the result of the law enforcement mindset. It often seems agencies are more interested in what is quickest and easiest, rather than what might be more productive, if just a bit more difficult. (A number of cases where warrants were never obtained, despite officers having both the time and probable cause to do so, is evidence of this mindset.) The report suggests this is one area where things could be improved by collaboration with private companies. It's not a terrible suggestion but it's one that requires agencies to move on from their defeatist attitudes and to stop pretending advances in technology are always far more beneficial to criminals than to law enforcement.

The report also inadvertently points out just how disingenuous it is to shrug off mass surveillance concerns by saying, "It's just metadata."

Metadata may not completely replace the loss of encrypted content, but metadata analysis could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations.

The report also touches on "legal hacking" as a potential solution -- albeit one with very limited practical application. If this is the route the government chooses to go more frequently in response to encrypted devices, it will signal the end of the already mostly-worthless Vulnerabilities Equity Process. It would also -- as the report acknowledges -- only further the "us vs. them" conflict between tech companies and law enforcement, as the government's interest in keeping vulnerabilities secret would tend to outweigh its obligation to divulge security holes to affected companies.

While the report breaks very little new ground in terms of issues raised, it does at least signal that legislative efforts to undermine encryption aren't likely to find much bipartisan support. So, for the time being, device encryption is still safe. It's the other issues raised -- legal hacking, compelled disclosure, etc. -- that will need to be watched closely in the future.

The Privacy and Civil Liberties Oversight Board (PCLOB) -- at least partially responsible for recent surveillance reforms -- is dead. The first hints of its demise were tucked away in the annual intelligence budget, which gave Congress direct control of the PCLOB's investigative activities.

The last vestiges of the board's independence have been stripped away and it seems unlikely the incoming president is going to have much interest in restoring this essential part of intelligence oversight. Congress now has the power to steer the PCLOB's investigations. A new stipulation requiring the PCLOB to report directly to legislators means intelligence officials will be less forthcoming when discussing surveillance efforts with board members.

At best, the PCLOB would have limped on -- understaffed and neutered. That was back when the news was still good (but only in comparison). The Associate Press reports that Donald Trump is being handed the keys to a well-oiled surveillance machine, but with hardly any of the pesky oversight that ruins the fun.

The five-member Privacy and Civil Liberties Oversight Board will have only two remaining members as of Jan. 7 — and zero Democrats even though it is required to operate as an independent, bipartisan agency. The vacancies mean it will lack the minimum three members required to conduct business and can work only on ongoing projects.

This could be fixed quickly, but it would require Trump nominating members and having the Senate approve them. It took well over a half-decade for President Obama to do this, so it wasn't even a priority for a president who promised to helm the "most transparent administration." These vacancies will probably be left open by an incoming president who seems largely uninterested in safeguarding civil liberties.

The PCLOB's report was instrumental in the challenged renewal of the Section 215 bulk collection program. The board might have played a similar role in the Section 702 renewal discussion in 2017, but with it out of the way, there's a good chance it won't receive as much of a challenge as the NSA's phone metadata program. (Then again, the PCLOB wasn't very critical of this internet backbone-tapping collection program, despite it harvesting far more than "just metadata.")

More critically, it left some work unfinished -- its investigation into the executive order underpinning the government's many intelligence programs.

Already in limbo is a public oversight report on the use of a Reagan-era executive order that since 1981 has authorized sweeping powers by intelligence agencies like the NSA to spy even on innocent Americans abroad and never has been subject to meaningful oversight from Congress or courts...

The privacy panel's report on the order is stalled and there's no work being done on it, according to the individual, who has knowledge about the project's status. Some individual agency reports related to the order were expected to be completed before the board loses its quorum, the person said.

The PCLOB is dead, for all intents and purposes. It survives in name only, awaiting presidential attention it's unlikely to receive. The last 15 years have shown what a lack of oversight can result in. The past couple of years have seen some encouraging movements towards accountability and transparency, but without the PCLOB's ability to perform its own investigations and, more importantly, deliver its findings to the public, further reform efforts are likely to be snuffed out.

Another government has decided to "protect" local businesses by forcing them to install surveillance cameras.

All commercial businesses located here will now be required to install and maintain security cameras or face a fine or jail following passage of a new citywide ordinance by the Mayor and Board of Aldermen Tuesday night.

“A matter that has been of increasing concern to the board lately is keeping the citizens of Madison safe, as well as the people who come here to visit our stores, through the use of security cameras,” City Attorney John Hedglin said. “It’s very important to have a record of what happens in as many places as possible.”

The ordinance has 30 days before it takes effect.

"Here" is Madison, Mississippi, a city with some very low crime rates -- one frequently named to "safest cities" and "best towns for families" lists. Why it's suddenly concerned about business-focused criminal activity is unclear, but the city's government has decided it should be able to force businesses to install CCTV systems, whether or not they need them… or can even pay for them.

Renee Burns, manager of Hop and Habanas, voiced concerns about the cost of surveillance equipment in an interview with WAPT News.

“Surveillance cameras are very expensive, to get everything set up and it could have people close their stores because they can’t afford it,” Burns said.

And if they can't afford them, the new statute will make sure they can't afford to stay in business.

Existing businesses will have one year after the ordinance goes into effect to comply. Those that fail to comply may be subject to a $500 fine and/or up to 90 days in jail. Each day of noncompliance is a different violation.

While there have been similar statutes enacted in other cities, these have generally been targeted at businesses already subject to extra regulation, like pawn shops, gun stores, and pharmacies. There has been some mission creep in recent years, leading to other businesses being ordered to install surveillance systems, like cellphone resellers and scrap metal dealers.

On top of that, many of these ordinances also allow for on-demand law enforcement access, allowing the government to extend its surveillance reach without having to pay for the equipment. The specifics of Madison's new statute haven't been made available yet, so it's unclear whether the collection of footage from businesses will be voluntary and tied only to investigations requested by business owners, or whether law enforcement will just be able to show up and demand to see recordings.

Then there are other privacy concerns to address. The city's attorney has stated that the ordinance covers businesses like doctor's offices and law offices -- places where patient/client confidentiality has long been assumed. Forcing businesses like these to record interactions with their customers would perhaps prevent more-privacy conscious individuals from seeking help. And this new collection of footage could be abused/misused to identify people who thought their requests for legal/medical assistance wouldn't be turned over to law enforcement.

Give your IT career a big boost with the $59 Cisco Complete Network Certification Training. Through instructor-led videos, hands-on exercises and self-assessment tools, you'll learn everything you need to know about how to build and scale wireless networks, troubleshoot, and improve network resilience. The courses will help prepare you to take the Cisco CCNA, CCNP, and CCENT certification exams.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

The speed with which the prevailing opinion of Denuvo, the DRM unicorn de jour, has changed has been nearly enough to make one's head spin. It was only at the start of 2016 that the software was being rolled out en masse by many game publishers, leading some normally bombastic cracking groups to predict that the video game industry had finally found its final solution to piracy. That lasted until roughly the middle months of the year, when several games using the DRM were cracked. While Denuvo's makers remained fairly silent, the opinion of it shifted from "final solution" to "hey, it's still the hardest DRM to crack." Cracking groups that typically measure their work in weeks were finding cracking Denuvo to be a project measured in months. That likely explained why so many big-ticket games still used it. Until, somewhat suddenly, multiple big-name games began dropping Denuvo from their code via patches and updates. The latest example of this was Doom silently nixing Denuvo, with id Software not even referencing the move in its patch notes.

And so the speculation began as to what was going on. Some said the game makers were finally realizing that DRM is pretty much useless at everything other than being a minor inconvenience for cracking groups and a major inconvenience for many legitimate customers. Others suggested that perhaps Denuvo offered some kind of money-back deal if a game using it was cracked within a certain time-frame. Still others claimed that publishers were only using the DRM during the initial release window of the game to protect it during the most crucial sales period, and then dropping it afterwards.

Denuvo, just recently, publicly endorsed the last theory.

“The simple reason why Denuvo Anti Tamper was removed from Doom was because it had accomplished its purpose by keeping the game safe from piracy during the initial sales window,” Denuvo’s Robert Hernandez said to me in an email. “The protection on Doom held up for nearly four months, which is an impressive accomplishment for such a high-profile game.”

Hernandez also insisted there is nothing like a money-back program if a game using Denuvo is cracked. And perhaps he's correct about why these games are suddenly dropping the DRM, although it should be clear that this theory is the best one available for Denuvo's business. The other two theories mean Denuvo is a failure. At least the idea that game publishers are using it during the initial release window allows the company to claim it's still providing a benefit to publishers.

But for how long? Given the precipitous drop in the posturing around Denuvo from "un-crackable" to "hey, we kept the game safe from piracy for a couple of months", it's reasonable to wonder why that downward trend shouldn't continue in that direction. Unless the company has some serious tricks up its corporate sleeve, it's not like cracking times are going get longer rather than shorter.

And the bigger question is one of math. If Denuvo carries negatives in its use, as its being dropped by several games clearly suggests, are those negatives really made up for by a couple of month's worth of protection? At four months, perhaps id Software thought it was. But if that protection window shrinks, there is going to be a line which, once crossed, makes Denuvo more trouble than its worth. You know, like every other DRM ever created. Denuvo's business still relies on its software being a unicorn, although one it already acknowledges has a horn much less shiny than originally believed.

The internet of really broken things is raising no limit of privacy questions. As in, companies are hoovering up personal data on smart-device usage, often transmitting it (unencrypted) to the cloud, then failing to really inform or empower consumers as to how that data is being used and shared. Though this problem applies to nearly all IoT devices, it tends to most frequently come up when talking about the rise of smart toys that hoover up your kids' ramblings, then sell that collected data to all manner of third parties. A company named Genesis toys is facing a new lawsuit for just this reason.

Since your toys, fridge, tea kettle and car are all collecting your data while laughing at your privacy and security concerns, it only makes sense that your sex toys are doing the same thing.

Back in September, a company by the name of Standard Innovation was sued because its We-Vibe vibrator collected sensitive data about usage. More specifically, the device and its corresponding smartphone app collect data on how often and how long users enjoyed the toy, the "selected vibration settings," the device's battery life, and even the vibrator's "temperature." All of this data was collected and sent off to the company's Canadian servers. Unlike many IoT products, Standard Innovation does encrypt this data in transit, but like most IoT companies it failed to fully and clearly disclose the scope of data collection.

One of the product's users sued the company (pdf), claiming the data collection violates Illinois consumer fraud laws and the federal Wiretap Act by not fully detailing data collection. That forced the company to issue a statement saying it was taking a closer look at ensuring that user data remained secure:

"Over the course of the last few weeks, we have taken steps to further enhance the data security and privacy measures for our product offering. As part of this effort, we have engaged external security and privacy experts to conduct a thorough review of our data practices with a view of further strengthening data protection and privacy for our customers. We are also committed to better communicating our data practices. We are updating the We-Connect app later this month, and the update will include new in-app communication regarding our privacy and data practices and a new feature for consumers to control how their data may be used."

Again, Standard Innovation appears to have done more than most Internet of Things companies (not that this would be hard) by actually encrypting the data. That said, there's still a certain amount of tone-deafness in collecting this much private sexual data for "research" without thinking it might come back to bite your brand on the posterior. And we're increasingly seeing that these privacy policies aren't clear, change frequently without warning, and don't give consumers enough control over their personal data.

Regardless, the company decided to settle the lawsuit this week anyway, with court documents (pdf) indicating the proposed class action is no more. At the end of the day, it's just another example of how quite often the smart, secure choice is older, dumber, disconnected tech. Even when we're talking about purple vibrators.