Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Kindle Fire Draws Privacy Slam From Congressman

Massachusetts Rep. Ed Markey says Amazon needs to come clean about what it’s doing with user data generated by the hot-selling tablet.

Amazon Kindle Fire: Visual Tour
Amazon Kindle Fire: Visual Tour
(click image for larger view and for slideshow)
A senior Congressman said Amazon is dodging questions about how it's using what he called a "massive" trove of information collected from Kindle Fire users.

In an October letter to Amazon CEO Jeff Bezos, U.S. Rep. Edward Markey (D-Mass) asked for details on how Kindle Fire user data is collected, stored, and used. Amazon replied last month, but in a statement issued Tuesday Markey said the answers were insufficient.

"Amazon's responses to my inquiries do not provide enough detail about how the company intends to use customer information, beyond acknowledging that the company uses this valuable information," Markey said.

[ The consumerization of IT raises security issues. Read Kindle Fire Hits The Office: 5 Security Concerns. ]

The hubbub between Markey and Amazon arose following an Oct. 3rd report in the New York Times, in which the paper noted that Kindle Fire and its Silk browser, which splits page rendering between the device and Amazon's cloud-based AWS servers, "may give Amazon unique insights into the Web clicks, buying patterns, and media habits of Fire users."

In his letter to Bezos, Markey, who is co-chairman of the Congressional Bi-Partisan Privacy Caucus, said, "I am concerned that such a combination will enable Amazon to collect and utilize an extraordinary amount of information about its users' Internet surfing and buying habits." Markey demanded that Amazon provide Congress with details about how it's using the information.

In response, Amazon global public policy VP Paul Misener said the company takes a number of steps to ensure user privacy and security. He said Amazon separates data collected from users from customer identities, only caches content that Web site owners have tagged as acceptable for caching, and routes secure SSL page requests directly from Kindle Fire to the origin servers, bypassing the AWS platform.

"In addition to the other customer-focused protections described above, customers have the option to turn off the cloud acceleration feature of Silk. In that 'off cloud' mode, Web pages go directly to a user's device rather than pass through AWS servers, and customers still enjoy a good browsing experience (though it cannot be as fast as with cloud acceleration turned on)," Misener said in his letter, a copy of which was provided by Markey's office.

In his statement Tuesday, Markey said he wasn't satisfied. "Amazon states 'Customer information is an important part of our business,' but it is also important for customers to know how the company uses their personal information." Markey added, "Amazon is collecting a massive amount of information about Kindle Fire users, and it has a responsibility to be transparent with its customers."

Privacy concerns don't appear to be dampening demand for Kindle Fire, as the device was one of the hottest selling products over the Black Friday to Cyber Monday weekend.

Amazon said it sold four times as many Kindle products on Black Friday as it did last year, and that Kindle Fire, which features a color touchscreen and direct links to Amazon and third-party content like Netflix, topped all Kindle sales. And retail giant Target said the Kindle Fire outsold Apple's iPad 2 in its stores.

Markey said he planned to "follow up" with Amazon to get more information about how the company uses data generated by Kindle Fire users.

In today's uncertain and highly scrutinized financial services industry, achieving effective risk management is vital for survival. The report examines the need for enterprise risk management, the benefits of holistic data management, and ERM best practices. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.