Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Kindle Fire Draws Privacy Slam From Congressman

Massachusetts Rep. Ed Markey says Amazon needs to come clean about what it’s doing with user data generated by the hot-selling tablet.

Amazon Kindle Fire: Visual Tour
Amazon Kindle Fire: Visual Tour
(click image for larger view and for slideshow)
A senior Congressman said Amazon is dodging questions about how it's using what he called a "massive" trove of information collected from Kindle Fire users.

In an October letter to Amazon CEO Jeff Bezos, U.S. Rep. Edward Markey (D-Mass) asked for details on how Kindle Fire user data is collected, stored, and used. Amazon replied last month, but in a statement issued Tuesday Markey said the answers were insufficient.

"Amazon's responses to my inquiries do not provide enough detail about how the company intends to use customer information, beyond acknowledging that the company uses this valuable information," Markey said.

[ The consumerization of IT raises security issues. Read Kindle Fire Hits The Office: 5 Security Concerns. ]

The hubbub between Markey and Amazon arose following an Oct. 3rd report in the New York Times, in which the paper noted that Kindle Fire and its Silk browser, which splits page rendering between the device and Amazon's cloud-based AWS servers, "may give Amazon unique insights into the Web clicks, buying patterns, and media habits of Fire users."

In his letter to Bezos, Markey, who is co-chairman of the Congressional Bi-Partisan Privacy Caucus, said, "I am concerned that such a combination will enable Amazon to collect and utilize an extraordinary amount of information about its users' Internet surfing and buying habits." Markey demanded that Amazon provide Congress with details about how it's using the information.

In response, Amazon global public policy VP Paul Misener said the company takes a number of steps to ensure user privacy and security. He said Amazon separates data collected from users from customer identities, only caches content that Web site owners have tagged as acceptable for caching, and routes secure SSL page requests directly from Kindle Fire to the origin servers, bypassing the AWS platform.

"In addition to the other customer-focused protections described above, customers have the option to turn off the cloud acceleration feature of Silk. In that 'off cloud' mode, Web pages go directly to a user's device rather than pass through AWS servers, and customers still enjoy a good browsing experience (though it cannot be as fast as with cloud acceleration turned on)," Misener said in his letter, a copy of which was provided by Markey's office.

In his statement Tuesday, Markey said he wasn't satisfied. "Amazon states 'Customer information is an important part of our business,' but it is also important for customers to know how the company uses their personal information." Markey added, "Amazon is collecting a massive amount of information about Kindle Fire users, and it has a responsibility to be transparent with its customers."

Privacy concerns don't appear to be dampening demand for Kindle Fire, as the device was one of the hottest selling products over the Black Friday to Cyber Monday weekend.

Amazon said it sold four times as many Kindle products on Black Friday as it did last year, and that Kindle Fire, which features a color touchscreen and direct links to Amazon and third-party content like Netflix, topped all Kindle sales. And retail giant Target said the Kindle Fire outsold Apple's iPad 2 in its stores.

Markey said he planned to "follow up" with Amazon to get more information about how the company uses data generated by Kindle Fire users.

In today's uncertain and highly scrutinized financial services industry, achieving effective risk management is vital for survival. The report examines the need for enterprise risk management, the benefits of holistic data management, and ERM best practices. Download the report now. (Free registration required.)

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.