Bloomberg accused of "snooping" on customers for journalistic gain

Filed Under: Featured, Privacy

A bit of a media brouhaha is, er, brewing after a New York Times story late last week claimed that financial media giant Bloomberg had been using its proprietary data terminals to snoop on customers.

Actually, the NYT started out by calling it a "privacy breach on Bloomberg's data terminals".

The offence was only upgraded to "snooping" after the weekend, once Bloomberg made a public statement on the issue.

The Bloomberg Terminal is something of an anachronism in these the-web-shall-be-free times.

Although you can use a regular keyboard on a Windows computer to access the service, a dedicated "Bloomberg" keyboard still exists, with numerous extra keys to make it really easy to find stock prices and catch up on breaking news in the financial markets.

Whereas a modern laptop might have special keys to adjust, say, the keyboard backlight (Fn+F5 and Fn+F6 on my Mac, for example), Bloombergs have keys like GOVT, EQUITY and CURRNCY so you can zoom in on specific market sectors in an instant.

As Wikipedia drily notes, "the Bloomberg keyboard is heavier and sturdier than standard keyboards," and if you've ever seen a trader working at a computer, you'll know why: IT equipment lives a harsh life amid the frenzy of the markets.

But the system is now in the news for all the wrong reasons, following Matthew Winkler's admission that so-called snooping "is inexcusable."

Winkler, editor of Bloomberg News, the global news arm of the Bloomberg operation, also wrote:

Now let’s also be clear what our reporters had access to. First, they could see a user’s login history and when a login was created. Second, they could see high-level types of user functions on an aggregated basis, with no ability to look into specific security information. This is akin to being able to see how many times someone used Microsoft Word vs. Excel. And, finally, they could see information about help desk inquiries.

In short, the "snooping" didn't let Bloombergers look inside the actual transactions that their customers carried out, any more than Google is able to look inside a web transaction you start after finding your way to a site via the Google search engine.

So why is it OK for Google to learn and retain vast tranches of data about what you search for, with an almost surgical precision, provided it doesn't intercept your subsequent traffic with the sites you find, but not for Bloomberg to do something similar?

One answer, of course, is the expectation of Bloomberg's customers, and the very purpose of subscribing to a proprietary, closed news system like Bloomberg's that is specific to an industry sector.

Intriguingly, and rather importantly, the Bloomberg fuss is as much about what you didn't say or search for as what you did.

The fuss, in fact, isn't new, with the New York Times recounting how Bloomberg reporters were quickly onto troubled financial services giant JPMorgan Chase last year, after it suffered a vast trading loss, to dig for details about whether the company had sacked any rogue traders.

Bloomberg's newshounds apparently used the fact that certain traders had suddenly gone silent, no longer logging in and using their terminals in their usual patterns.

→ This approach, relying not on knowing what was said, but that it was said at all, is known as traffic analysis. It is hard to defend against, since in extreme cases (often the most interesting and important to an attacker), you may urgently need to send many more messages than usual, or be unable through circumstances to keep up with usual patterns.

The NYT also quotes a former trader, Michael Driscoll, on the topic of how appropriate it was for Bloomberg to monitor its customers' online activity:

On Wall Street, anonymity is critically important. Secrecy and the ability to cover one's tracks is paramount.

Thousands of cybercrooks, millions of pirates, and hundreds of millions of law-abiding internet citizens would probably agree with this sentiment (though they might often wish for a bit less secrecy and covering-of-tracks by Wall Street).

But the 2010s are an era in which we seem to be under increasing pressure to give up much of our anonymity and secrecy online, for a few very good but very many bad reasons.

Ironically, Bloomberg is now in hot water for just the sort of tracking that online web services do all the time.

Who searched for what, and when? What did they do last time they were here?

How long have they been away? What will they want to buy now they're back?

Would now be a good time to email them?

Limiting just how much any major website learns about you across multiple visits can be tricky, but if you're looking for some quick wins, try these:

  • Use your browser's Clear History option regularly. This dumps the cookies and other locally-stored data that your browser remembers about you and sends back to your favourite websites every time you return.
  • Use Private Browsing as much as you can. It doesn't stop websites tracking you when you're logged in, but it provides a convenient way of auto-cleansing your browsing history afterwards, in case you forget.
  • Don't stay logged in to sites all day long. It's a lot less convenient to have to log back into Facebook every time you want to "Like" something, but it'll prevent you giving out information to the wrong person by accident or through trickery.

We're working as we speak on a digestible, educational and not-too-technical paper about how to keep cookies and locally-stored browser data under control: if you want to learn more about this much-misunderstood topic, watch this space!

, , ,

You might like

4 Responses to Bloomberg accused of "snooping" on customers for journalistic gain

  1. Nigel · 534 days ago

    "Clear history" might be a good security measure for some folks, but it would be a major inconvenience for me. I rely on my history for all kinds of information about what I did, and when. I use NoScript and Ghostery to help insulate me from trackers, and I try to manage my cookies to exclude the most intrusive ones except for the immediate session, and only for as long as I need them. (For example, I delete Facebag cookies immediately.)

    If there's any browser that has a feature like "Hide history" or "Protect history" --- something that keeps the history hidden from prying eyes --- I'm not aware of it. That would be a handy thing to have. I don't mind logging in multiple times in one day (or at least in one browsing session) as a security measure, but I still would like to keep a record of where I've been, and when. Clearing my entire history is a high price to pay just to keep others from getting their hands on that information.

    • Paul Ducklin · 534 days ago

      Many browsers let you choose a subset of history items to delete, so you can zap cookies but not browsing history, and so forth.

      If you really want your history to be a historical record, why not run a local logging web proxy...with something like (say) privoxy, I suspect you could have your cake (keep a record) and eat it (manage the more egregious cookie-setting efforts).

      Problem with leaving your history in the browser is that it can be used for/with all sort of JavaScript jiggery-pokery...so keeping outside the browser might be a good alternative (and easier to archive :-).

      • Nigel · 534 days ago

        I agree. Even with NoScript running I'm uneasy about having all the history in the browser. There are some sites that simply don't work unless I temporarily allow them to run scripts (many of which involve "google"), and there goes the ball game. I can delete the cookies afterward, but in the meantime, they've come inside and rummaged around to find what they want.

        I just visited privoxy.org and it looks like that's a great solution. Thanks!

  2. Spryte · 532 days ago

    If anonymity is that important, I believe these transactions should be taken off the internet.

    Hire a lawyer, set up a shell company to set up more shell companies to set up accounts...

    Everything is tracked and/or logged by somebody and if you are banking or investing it can be traced back to you no matter what you did to disguise your entry to the site.

    We not only have regular browser cookies to worry about but 'Persistent Storage' from Flash, Silverlight and who knows what else.

    It is important to know where these are stored and how to clear them.

    I make sure delete all transactional information after every session and as soon as I log off any site that has my personal info. (The Opera browser has customizable function 'Delete Private Data' for this that actually works!!)

    There are also third party tools to help you do this.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Paul Ducklin is a passionate security proselytiser. (That's like an evangelist, but more so!) He lives and breathes computer security, and would be happy for you to do so, too. Paul won the inaugural AusCERT Director's Award for Individual Excellence in Computer Security in 2009. Follow him on Twitter: @duckblog