by Erin Smith, and Heather Vogell, ProPublica

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Kim Fuller needed to move. Her 83-year-old mom was struggling to get around the narrow, three-story row house they shared in Baltimore. Heart problems made climbing the stairs too arduous, cutting the older woman off from the kitchen where she’d loved to cook.

Fuller, 57, found an apartment complex 3 miles away that billed itself as “luxury living” for people 55 and older, and she applied for a unit in early 2021. She figured she’d be approved: Her salary as a mental health services coordinator for the state of Maryland met the income requirements. She’d never been evicted and had brought her credit score up to 632 — which is considered fair — after a health crisis had forced her to file for bankruptcy eight years earlier.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

Still, a few months later, when she logged into her online account with the property manager, she learned her application had been denied. No reason was given. She raised her credit score to 663 and applied to another complex owned by the same company, Habitat America, in August. Six days later her status again turned to “Declined.”

Fuller learned her rental application had been screened by RentGrow, one of more than a dozen companies that mine consumer databases to perform background checks on tenants. A form emailed to her said RentGrow determined she didn’t meet applicant screening requirements, highlighting in yellow the box labeled “credit history” as the reason.

The letter provided no further explanation. A RentGrow representative, through an executive at its parent company, declined to comment. Habitat America declined to respond to questions about Fuller’s application from ProPublica, citing privacy concerns.

“You don’t know why you got denied or if you were ever considered,” Fuller said. “It’s really murky out there.”

Fuller’s experience has become more common as landlords have increased their reliance on tenant screening to help them select renters. The industry has expanded dramatically as the number of renters has grown and new technology has made it easier to access vast troves of data, such as court records.

Tenant screening companies compile information beyond what’s in renters’ credit reports, including criminal and eviction filings. They say this data helps give landlords a better idea of who will pay on time and who will be a good tenant. The firms typically assign applicants scores or provide landlords a yes-or-no recommendation.

A ProPublica review found that such ratings have come to serve as shadow credit scores for renters. But compared to credit reporting, tenant screening is less regulated and offers fewer consumer protections — which can have dire consequences for applicants trying to secure housing.

Frequent errors on tenant screening reports, often related to false eviction reports or criminal records, led government watchdogs to admonish the industry last year to improve its accuracy. (The Markup reported a series of stories on the industry and regulators’ reactions to it.)

Yet errors are just one of the problems with tenant screening, ProPublica found. Tenants often can’t get enough information to understand why they were marked as a risk to landlords.

More than 40 renters responded to a ProPublica survey last year about tenant screening. Some were denied housing. Others were asked to pay double or triple deposits because of low tenant scores.

“It’s kind of chaos,” said Ariel Nelson, a staff attorney at the National Consumer Law Center. “It’s really hard to figure out if you were rejected, why was it rejected. If it’s something you can fix or if it’s an error.”

The algorithms some screening companies use aren’t scrutinized by regulators and, tenant advocates say, may not accurately predict a tenant’s likelihood of paying rent. While screening companies say their algorithms remove the subjectivity of human judgment, advocates say the companies use data that can introduce racial or other illegal biases.

Fuller, who is Black, worried she might have been a victim of racial discrimination.

Her case baffled Carol Ott at the Fair Housing Action Center of Maryland. “You’re fighting against the company that uses secret algorithms,” said Ott, the center’s tenant advocacy director. “Where do you even go with that?”

Regional Property Manager Karin Scott said in an email that Habitat America’s policy is to treat all residents and visitors fairly, and “any concerns that a denial was based upon racial discrimination are unfounded.”

To be sure, the credit reporting industry also draws criticism from consumer advocates for failing to keep errors off credit reports and for using algorithms that critics say perpetuate racial biases.

ProPublica found that tenant screening receives even less oversight than credit reporting, which has been litigated intensely and is watched by the courts and federal agencies in an effort to minimize unfair treatment.

Federal agencies have “supervisory authority” to review the internal records of financial institutions such as banks to ensure that their scoring methods are predictive, statistically sound and nondiscriminatory, experts said.

A parallel process does not exist for tenant screening.

“Nobody’s supervising. Nobody’s checking the data,” said Chi Chi Wu, an attorney at the National Consumer Law Center. “Nobody’s checking these algorithms.”

A spokesperson for the Consumer Data Industry Association, which represents consumer reporting agencies, including screening companies, said in an emailed statement that the competitive tenant screening market pushes companies to continuously improve their tools for helping landlords comply with fair housing and other laws.

“Consumers expect and demand safe places to live, and our tenant screening members help protect residential communities, especially their most vulnerable populations,” the statement said.

The National Apartment Association, a trade group representing apartment owners and managers, said it supports new technology for rental operations and encourages members to research vendors to make sure they comply with regulations, according to a statement from Senior Vice President Greg Brown.

“Rental housing providers are committed to equal housing opportunity and utilize resident screening tools through this lens to balance risks that could impact the entire community,” Brown said.

“High-Risk Renters”

The rapid rise of tenant screening is one of the seismic changes to hit the rental market since the Great Recession. As ProPublica has reported, private equity firms have poured into the multifamily apartment market, often driving up rents in search of greater profits than those typically sought by mom-and-pop landlords. Algorithms now often replace human judgment in deciding who qualifies for housing and how much rent costs.

Bob Withers, a retired executive for corporate landlords and regional property managers, said when he left the industry temporarily in 2006, credit checks were still landlords’ main tool for assessing applicants.

“When I came back in 2010 or 2011, things had changed so much that everyone I knew was using tenant screening companies,” he said.

Nearly 2,000 companies offered background screening in 2019, most for either employment or tenant purposes, an industry survey found. It estimated that tenant screening brought in roughly $1 billion in annual revenue.

RealPage, a leading Texas-based property management tech firm, boasts that its algorithm uses artificial intelligence to “identify high-risk renters with greater accuracy.” The company says it uses a massive, proprietary database of 30 million lease outcomes, paired with consumer financial data, to evaluate rental applicants.

“This model is materially more effective than traditional screening solutions, with an average proven savings of $31 per apartment per year without negative impact to occupancy or revenue,” a company media release said.

RealPage did not respond to questions about the release.

Tenant score algorithms try to predict how risky it is to rent to a potential tenant based on characteristics they share with other tenants, according to Jean Noonan, an attorney and former Federal Trade Commission official whose law firm represents tenant screening companies.

Property managers are supposed to provide an “adverse action notice” (left) to applicants who are rejected because of their tenant screening score, but the notices typically provide little information. Renters often don’t see detailed screening reports like this one (right), from On-Site, which shows their score and the reasons for rejection. Even this detailed report does not show how the algorithm weighted each factor. (Obtained with permission by ProPublica. Red circles added by ProPublica.)

“A scoring model may find that certain characteristics help predict risk,” said Noonan. “They don’t predict it perfectly for every individual. Overall, they do a satisfactory job of predicting risk.”

Yet Withers, the retired regional property manager, said it was typical that several times a month he would need to override denial recommendations from the screening service his firm used. Often, it was because people had medical debt, foreclosures or student loans but otherwise looked like good candidates.

“If everything else looked clean to me, I would do an override,” said Withers, who oversaw thousands of apartments in Maryland and Virginia. Busy property managers may not realize that the screening service’s algorithm was set up in a way that would reject people who might be viable candidates, he added.

Tenant advocates say the consumer data used by screening companies too often results in negative recommendations for reasons that are not proven indicators of how good a tenant someone would be. One tenant in Washington state who contacted ProPublica received a screening letter that listed “too many different phone numbers reported” as a risk factor that contributed to lowering her tenant score.

Some of the personal details that screening companies are plugging into algorithms to rate potential tenants may reflect racial biases, tenant advocates said.

“We don’t know whether they’re predictive,” Nelson said. “Based on what little information we have about what factors go into them, we are concerned about racial disparities.”

A negative screening can not only result in a denial, it can also prompt a landlord to demand a higher deposit, potentially deterring the renter from taking the apartment at all.

Chloe Crawford is an artist who found an apartment to live in while she worked on her masters degree at Rutgers University. But when she arrived at her new building near campus in September 2018, possessions in tow, her new landlord asked for an extra month’s rent as a deposit because of her low tenant screening score, she said. The total deposit added up to more than $1,000. It was more than she planned to spend on a month’s worth of groceries, and her car needed repairs.

Though Crawford expected to devote a high percentage of her income to rent because she was attending classes, she had money in the bank, had lined up an on-campus job and had been careful to pay her bills on time to keep her credit score high.

Her credit score of 788 out of 850 was considered very good, high enough that she could qualify for a mortgage with good terms. But her tenant score was 685 out of 1,000 — too low for her to rent an apartment without paying an elevated deposit. The screening company, LeasingDesk, said in an email that another month’s rent was required because her credit history and rent-to-income ratio were “unsatisfactory.”

Crawford, who uses a wheelchair, pleaded with a property manager to let her move in without the extra fee, showing paystubs proving she had made additional money by working overtime during the summer. The manager relented, allowing her to pay the base-rate deposit of $300.

She finished her two-year program and graduated with a Master of Fine Arts degree in 2020, never missing a rent payment before moving out early due to the pandemic. After she’d vacated, the apartment owners claimed she owed rent money for leaving before her lease was up.

“If they had just denied housing, I don’t know what I would have done,” she said. “Maybe I would have dropped out of the program.”

LeasingDesk’s parent company, RealPage, said it could not comment on individual cases, but that each LeasingDesk score is based on a property manager’s leasing criteria. RealPage applies those criteria “in an objective, consistent and non-discriminatory manner,” the company said in an emailed statement.

“In making leasing decisions, a property manager’s interest is not to turn away qualified applicants, but to quickly fill vacancies with people who will be responsible tenants and help maintain a safe community,” the statement said.

“What Is the Science Behind This?”

Credit reporting has faced more scrutiny over the years than tenant screening.

For instance, the big three credit bureaus — Equifax, Experian and TransUnion — stopped reporting evictions in 2017 after reaching multistate settlements in response to lawsuits that accused the firms of persistent mistakes in their reports. The companies denied wrongdoing. Tenant screening companies continue to report evictions.

Large numbers of consumer complaints can also help spur federal financial regulators to examine a credit scoring model, but no federal agency has the same power over tenant screening.

The Consumer Financial Protection Bureau collects complaints about tenant screening services, but it doesn’t examine the firms’ algorithms. The agency could not provide a breakdown of how many complaints have been filed regarding tenant screening agencies.

A spokesperson for the consumer bureau declined to respond to a list of questions from ProPublica, but said, “The Bureau is committed to using its tools and authority to ensure that consumers are not harmed by improper screening and consumer reporting practices.”

The Federal Trade Commission can’t examine a screening company’s algorithm unless it is doing a formal investigation. The agency, which has obtained multimillion-dollar settlements from such firms over errors in their reports, has not to date announced any enforcement actions stemming from bias in screening algorithms.

Asked about the agency’s oversight, Assistant Director Robert Schoshinski said: “We are always looking to see if there are violations of the laws that we enforce.”

The federal Fair Credit Reporting Act, which covers credit scores and background checks, has received few updates since it passed in 1970, said Eric Dunn, director of litigation for the National Housing Law Project. The problems tenants are encountering with screening, he said, are the result of an antiquated regulatory system that is full of gaps.

Dunn said some of the scoring models he’s seen while litigating cases on behalf of tenants are crude, giving so much weight to factors like eviction, criminal history or debt that a person whose record includes even one of those things would get a negative recommendation.

“For a lot of these companies, it’s a way of putting a veneer of legitimacy or a veneer of mathematical expertise on what’s really a blanket policy against people with certain types of records,” Dunn said.

Wu, of the National Consumer Law Center, echoed his concerns. “What is the science behind this?” Wu said. “With credit scoring, we know how well it works.”

In a letter to the CFPB in March 2021, Sen. Elizabeth Warren and five other senators wrote that screening companies need to be watched more closely. “Effective oversight of these companies requires proactively investigating and auditing their effects on protected classes,” the letter said.

The Consumer Data Industry Association, in a letter to the Senate Committee on Banking, Housing and Urban Affairs the following month, said screening is based on “race-neutral data” and removes subjectivity that could be a source of discriminatory behavior.

TransUnion, a credit agency that also offers tenant screening, said the system already receives scrutiny. “The rental screening process is well-regulated and governed by the Fair Housing Act and Fair Credit Reporting Act, with additional oversight from the Consumer Financial Protection Bureau,” a statement emailed by a spokesperson said.

Screening firms are supposed to show tenants what’s in their files if they ask. The data industry association told the Senate committee that “tenant screeners facilitate consumer participation by providing copies of reports to consumers.” But firms have often interpreted the disclosure requirement narrowly, tenant advocates say, and left out key information — such as the recommendations made to landlords.

Tenants have less protection than job candidates, who are entitled to a copy of their background check if an employer is planning to reject them because of the report. That is supposed to give candidates time to look for errors. While landlords are supposed to provide tenants notice of an adverse screening result, like the one Kim Fuller in Baltimore received, such notices typically provide sparse information.

Dunn said tenants often get the runaround when they complain about screening decisions. The screening companies say landlords decide what criteria to use. Landlords say screening companies make the decision.

Several renters told ProPublica that they couldn’t find out why their applications were denied.

“You really have no effective way of lodging a dispute with the screening company, unless it’s the accuracy of the record,” Dunn said. “If it has anything to do with judgment, or anything like that, the screening company says, ‘It’s not our job.’”

Leaving the City

Fuller kept up her search for a new place for herself and her mother in Baltimore. She worried not only that her denial was a form of illegal redlining, but also that her full tenant screening report, which she never saw, contained errors that had pushed the algorithm toward a denial.

She filed a complaint with the CFPB against RentGrow, a subsidiary of Yardi Systems, one of the largest property management software companies in the United States. She also filed one against Habitat America.

The CFPB rejected both complaints last fall, saying it was “unable to send your complaint to the company for a response.” The agency said either the company was not in its complaint system or the agency does not handle complaints “about this product or issue.”

The CFPB accepts complaints about tenant screening companies, but property managers are beyond its purview. A CFPB spokesperson declined to comment on Fuller’s complaints.

Fuller widened her search for a new home. Her mother had lived for 35 years in the porch-front row house they shared on the edge of the Belair-Edison neighborhood. Though her mother had hoped to stay in Baltimore city, Fuller began looking in the suburbs.

A co-worker told her about an affordable complex near Catonsville, just outside the Baltimore Beltway. A Walmart was within walking distance. Fuller watched for vacancies at the aging brown brick cluster of three-story buildings and applied when she saw one.

She and her mother moved into a ground-floor unit in January.

“We had to go a little further out than we intended,” she said. “This will be an adjustment.”

Have You Had Trouble Renting an Apartment and Don’t Understand Why? It Might Be Your Tenant Screening Score.

This post was originally published on Articles and Investigations – ProPublica.

by Cezary Podkul

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

The chairman of a congressional subcommittee has asked Apple and Google to help stop fraud against U.S. taxpayers on Telegram, a fast-growing messaging service distributed via their smartphone app stores. The request from the head of the House Select Subcommittee on the Coronavirus Crisis came after ProPublica reports last July and in January revealed how cybercriminals were using Telegram to sell and trade stolen identities and methods for filing fake unemployment insurance claims.

Rep. James E. Clyburn, D-S.C., who chairs the subcommittee (which is part of the House Committee on Oversight and Reform), cited ProPublica’s reporting in March 23 letters to the CEOs of Apple and Alphabet, Google’s parent company. The letters pointed out that enabling fraud against American taxpayers is inconsistent with Apple’s and Google’s policies for their respective app stores, which forbid apps that facilitate or promote illegal activities.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

“There is substantial evidence that Telegram has not complied with these requirements by allowing its application to be used as a central platform for the facilitation of fraud against vital pandemic relief programs,” Clyburn wrote. He asked whether Apple and Alphabet “may be able to play a constructive role in combating this Telegram-facilitated fraud against the American public.”

Clyburn also requested that Apple and Google provide “all communications” between the companies and Telegram “related to fraud or other unlawful conduct on the Telegram platform, including fraud against pandemic relief programs” as well as what “policies and practices” the companies have implemented to monitor whether applications disseminated through their app stores are being used to “facilitate fraud” and “disseminate coronavirus misinformation.” He gave the companies until April 7 to provide the records.

Apple, which runs the iOS app store for its iPhones, did not reply to a request for comment. Google, which runs the Google Play app store for its Android devices, also did not respond.

The two companies’ app stores are vital distribution channels for messaging services such as Telegram, which markets itself as one of the world’s 10 most downloaded apps.The company has previously acknowledged theimportance of complying with Apple’s and Google’s app store policies. “Telegram — like all mobile apps — has to follow rules set by Apple and Google in order to remain available to users on iOS and Android,” Telegram CEO Pavel Durov wrote in a September blog post. He noted that, should Apple’s and Google’s app stores stop supporting Telegram in a given locale, the move would prevent software updates to the messaging service and ultimately neuter it.

By appealing to the two smartphone makers directly, Clyburn is increasing pressure on Telegram to take his concerns seriously. His letter noted that “Telegram’s very brief terms of service only prohibit users from ‘scam[ming]’ other Telegram users, appearing to permit the use of the platform to conspire to commit fraud against others.” He faulted Telegram for letting its users disseminate playbooks for defrauding state unemployment insurance systems on its platform and said its failure to stop that activity may have enabled large-scale fraud.

Clyburn wrote to Durov in December asking whether Telegram has “undertaken any serious efforts to prevent its platform from being used to enable large-scale fraud” against pandemic relief programs. Telegram “refused to engage” with the subcommittee, a spokesperson for Clyburn told ProPublica in January. (Since then, the app was briefly banned in Brazil for failing to respond to judicial orders to freeze accounts spreading disinformation. Brazil’s Supreme Court reversed the ban after Telegram finally responded to the requests.)

Telegram said in a statement to ProPublica that it’s working to expand its terms of service and moderation efforts to “explicitly restrict and more effectively combat” misuse of its messaging platform, “such as encouraging fraud.” Telegram also said that it has always “actively moderated harmful content” and banned millions of chats and accounts for violating its terms of service, which prohibit users from scamming each other, promoting violence or posting illegal pornographic content.

But ProPublica found that the company’s moderation efforts can amount to little more than a game of whack-a-mole. After a ProPublica inquiry last July, Telegram shut some public channels on its app in which users advertised methods for filing fake unemployment insurance claims using stolen identities. But various fraud tutorials are still openly advertised on the platform. Accounts that sell stolen identities can also pop back up after they’re shut down; the users behind them simply recycle their old account names with a small variation and are back in business within days.

The limited interventions are a reflection of Telegram’s hands-off approach to policing content on its messenger app, which is central to its business model. Durov asserted in his September blog post that “Telegram gives its users more freedom of speech than any other popular mobile application.” He reiterated that commitment in March, saying that Telegram users’ “right to privacy is sacred. Now — more than ever.”

The approach has helped Telegram grow and become a crucial communication tool in authoritarian regimes. Russia banned Telegram in 2018 for refusing to hand over encryption keys that would allow authorities to access user data, only to withdraw the ban two years later at least in part because users were able to get around it. More recently, Telegram has been credited as a rare place where Russians can find uncensored news about the invasion of Ukraine.

But the company’s iron-clad commitment to privacy also attracts cybercriminals looking to make money. After the COVID-19 pandemic prompted Congress to authorize hundreds of billions of small-business loans and extra aid to workers who lost their jobs, Telegram lit up with channels offering methods to defraud the programs. The scale of the fraud is yet unknown, but it could stretch into tens if not hundreds of billions of dollars. Its sheer size prompted the Department of Justice to announce, on March 10, the appointment of a chief prosecutor to focus on the most egregious cases of pandemic fraud, including identity theft by criminal syndicates.

This post was originally published on Articles and Investigations – ProPublica.

You can view the information that various websites — like Facebook, Google, and LinkedIn, to name a few — have about you by submitting a data request. A corporate data request is a curiously asymmetrical notion: These companies don’t request your information, they just take it (sometimes even if you don’t use their services), yet you have to request your own information from them. It’s a bit like if you have a stalker who’s been shadowing you around, meticulously documenting everywhere you go, everyone you talk to, and everything you do, who’s now handing you a form to fill out if you want to see the boxes of files they’ve been keeping on you. I decided to request my data from Amazon, which courteously affords me the opportunity to join the ranks of the numerous third parties that can also get my data from Amazon.

The Roach Motel

The first thing I learned is that Amazon is in no hurry to give you your data, nor does it really encourage you to ask for it in the first place. I couldn’t even figure out how to navigate to the request page without turning to a search engine. In fact, Amazon seems keen to discourage data requests, as making one is a labyrinthine endurance test of being bounced from one webpage to the next, waiting for weeks, and then downloading, extracting, and combing through dozens of files. Requesting your data from Amazon is an exhausting procession that feels a little bit like a text adventure game designed by Franz Kafka.

Once you’ve actually made it to the preliminary “Request Your Personal Information” page, Amazon suggests that you can also access “a lot of your personal information in Your Account.” This is the first iteration of a refrain that you will run into multiple times throughout the protracted data request process, repeated every step of the way.

After you click on “Request My Data,” you’re taken to a page with a drop-down menu where you can “select the data that you want,” with the option “Request All Your Data” in the 16th position, at the very bottom of the menu. And in case you’ve forgotten that you can also see some of your data in your account settings, Amazon offers a helpful reminder: “Don’t forget you can access a lot of your data instantly, as well as update your personal information, from Your Account.”

Once you submit your request, you’re taken to the “Data Request Creation” page, which thanks you and informs you that “You’re almost done…” but now need to click a verification link in your email. Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and security are the company’s top priority, though considering that when your data is available you’ll need to check your email anyway, it’s not clear how checking your email twice adds any security. And by the way, in case you’ve forgotten already, Amazon also reminds you on this page that “You can access a lot of your data instantly, as well as update your personal information, from Your Account.”

At this point, you’ll need to pop over to your email and click the “Confirm Data Request” link. Doing so will take you to the “Data Request Confirmation” page, which informs you that Amazon has “received and [is] processing your request to access your personal data.” This feels a little strange, as you don’t recall ever making Amazon jump through this many hoops when it wanted to access your data. (This page again reminds you that you can get “a lot of your data … from Your Account.”)

The “Data Request Confirmation” page also informs you that you may be in for a bit of a wait. Though Amazon says that it will “provide your information to you as soon as we can,” “soon” is apparently meant to be interpreted on a monthly time scale, as the page further states that “usually, this should not take more than a month.” Though of course, “in exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer.” This protracted time frame forms an intriguing juxtaposition to the otherwise universal emphasis on speed that facilitates shopping on Amazon. “If you have to click multiple buttons, if you have to wait for too long, if you have to answer a lot of information — all of those things create friction, and friction exponentially kills the joy of shopping,” Nadia Shouraboura, a former member Amazon’s management board, said in the 2014 CNBC documentary “Amazon Rising.”

Given Amazon’s obsession with speed and eliminating friction to foster faster consumerism, the dawdling data solicitation process seems like it just might be intentional, designed to dissuade requests. A far simpler explanation comes through an invocation of Hanlon’s razor, the old adage to “never attribute to malice that which is adequately explained by stupidity.” Amazon whistleblowers cited by Politico have said that the company “has a poor grasp of what data it has, where it is stored and who has access to it.” If that’s the case, then it stands to reason that it can take a month or more for Amazon to process a data request. As former Amazon chief information security officer Gary Gagnon succinctly put it in an interview with Reveal, “we have no fucking idea where our data is.”

Asked whether the company takes a long time to fulfill data requests because it doesn’t have a good grasp on where customer data is kept, Amazon spokesperson Jen Bemisderfer said the company “strongly reject[s] the assertion that we don’t keep track of customer data. Producing [customer data] reports requires that we know where data is stored. Amazon maintains multiple and complementary tools and processes to systematically identify where personal data is stored and how it flows.”

Bemisderfer did not directly address a question about whether Amazon intentionally makes the data request process difficult, instead writing, “We are committed to providing customers with access to their information and are always looking for ways to improve the customer experience.”

It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. There was no option for expedited Amazon Prime data delivery and no button equivalent to an instantaneous Buy Now (née 1-Click) option when selecting my data. When the data was finally ready, Amazon sent me an email expressing outright jubilation at the fact that it had managed to find my information, stating: “We are happy to confirm that we have completed your data request.” And since it’d been a few weeks, Amazon also understandably thought that I could use another reminder that I could “find all the available information” related to my Amazon profile (“including reviews”) on my profile page.

Clicking the link to download the data in the arrival email in turn took me to the “Download your Amazon Data” page, which once again (for the sixth and, mercifully, final time) helpfully reminded me that “You can access a lot of your data instantly, as well as update your personal information, from Your Account.”

On the data download page, under the veneer of endless consumer choice, I was presented with a total of 74 separate zip files that had to be downloaded individually (though enterprising users have built scripts to help automate the process). This turn toward extreme granularity is doubtlessly not unappreciated by the ever-discerning consumer who, despite explicitly requesting all of their data from the drop-down menu earlier in the request process, may nonetheless now only wish to download the cryptic Advertising.1.zip and Advertising.3.zip but may studiously want to avoid Advertising.2.zip, and is therefore thankful to be spared the burden of being saddled with two additional kilobytes of extraneous data.

Amazon is here employing a kind of reverse dark pattern: Instead of irksome layout gimmicks designed to trick users into inadvertently doing things (like subscribing to mailing lists), Amazon is using an irksome layout pattern to discourage you from downloading all of your data. Specifically, this is kind of a “roach motel” model reminiscent of when Yahoo presented users with more than 300 buttons to individually press to opt out of third-party data collection from its partners. Except in Amazon’s case, you have to go through this process to merely view your data, not opt out of it.

“You Can Access a Lot of Your Data”

Once you’ve gone through and painstakingly downloaded all of the zip files, you need to extract the contents of each one either using a program included with your operating system or (if you can’t find one already on your computer) a free tool like 7-Zip. The extracted data is predominantly in the form of CSV files, which can be opened in a spreadsheet editor like Calc, included with the free office productivity suite LibreOffice. (Microsoft Excel will work too.)

While Amazon’s reminders that you can access “a lot” of your data by looking around your account and profile settings is doubtlessly true (given that “a lot” is a nebulous quantifier), what becomes apparent when looking over your requested Amazon data is that the company collects a lot of information that you cannot view in those settings.

In skimming over this trove, one thing became very clear right away: Amazon sure seems to love to retain information. Though the company states that it is legally required to keep certain data like order history, other information like search keywords seems to be retained at Amazon’s discretion. The company intricately logs chat and email interactions you’ve had with buyers, sellers, and Amazon; your cart history; your orders, returns, and reviews; and your searches (for the past three-and-a-half years), or at least those made while logged into your account. The spreadsheet that lists your search history (Retail.Search-Data.Retail.Customer.Engagement.csv in Retail.Search-Data.zip) contains 65 fields with information like search terms, your IP address, how many search results you clicked on, how many search results you added to your basket, and how many search results you ended up buying. The file also includes fields with unclear titles. For instance, one column marked “Shopping Refinement” sporadically lists cryptic strings of numbers like “26,444,740,832,600,000” for various search queries.

Aside from keeping a meticulous ledger of all your site activity, Amazon also takes the liberty of holding on to data you may have had the mistaken impression you deleted. If you click “Remove” on any address you have stored in the “Your Addresses” portion of your Amazon account, this in fact only removes the address from that page, not from Amazon’s records. Addresses that you have removed from your account are merely labeled as “Is Address Active: No” in Retail.Addresses.pdf (within Retail.Addresses.zip). On its “Add and Manage Addresses” customer service page, Amazon makes no mention of the fact that deleted addresses are only deleted from being visible to you on your account page and are not actually deleted from Amazon’s servers. Given that account recovery security questions for various services can be along the lines of “What’s the name of the first street you lived on?” or the fact that people sometimes use their old house or apartment numbers as their PINs, gaining access to a user’s comprehensive list of old addresses can be particularly advantageous for someone who has access to your Amazon account and wants to expand their reach.

Amazon’s advertising data on you is inexplicably divided across three zip files. Advertising.3PAudiences.csv (in Advertising.1.zip) lists “Audiences in which you are included via 3rd Parties.” It’s not explained how Amazon acquires this third-party audience data, but according to this dataset I apparently am a homeowner, in possession of a luxury sedan and SUV, and in the 45 to 54 age range. This was all news to me, as I am none of those things. It genuinely feels good to know that Amazon is wasting resources on harvesting inaccurate audience demographic information from third parties.

The two Advertising.AdvertiserAudiences.csv files (in Advertising.1.zip and Advetising.2.zip), meanwhile, list “Advertisers who brought audiences in which you are included.” It’s not clear what this field actually means — for instance, if “brought” is a typo for “bought” — but at any rate, my data is apparently somehow linked to a total of 167 advertisers, including Carrington College, Clever Cutter, Fitbit, HCA Healthcare, the Leukemia & Lymphoma Society, and something called Animal Friends. Three Canadian banks — Bank of Montreal, Royal Bank of Canada, and Scotiabank — are disproportionately represented in this list of advertisers that have hoovered up my data; I don’t know why, though I did several times order gifts to Canada.

There are also zip files dedicated to other Amazon services like Alexa, Amazon Games, Amazon Music, Kindle, and Prime Video. I don’t make use of those, so mine were empty, though it does at this point come as no surprise that Amazon keeps track of, for example, how long you watch individual Prime Video offerings and which country you are in when viewing them, or which books you read on your Kindle, down to which pages you look at.

Overall, from my Amazon data request I learned that I never did find a good “DIY plasma ball kit” or a decent “summer watermelon recipes” book, but I am decidedly happy that Amazon thinks I’m a 45 to 54-year-old luxury sedan-driving homeowner and that multiple Canadian banks have a competing interest in me.

Minimizing Data Exposure

There are numerous steps one could take to minimize the amount of information Amazon is able to collect. You could be sure that you’re using ad-blocking software like uBlock Origin to reduce the chance of advertisers tracking your browsing habits and buying or selling that information. You can also peruse Amazon through the private mode in your browser, or at least while being logged out of your Amazon account. And if you don’t want Amazon to have your IP address, home address, phone number, and credit card information, you could always use a virtual private network for browsing, a Post Office box for shipping, a temporary burner phone number for account verification, and a temporary or virtual credit card number. It may also not be an entirely bad idea to periodically start fresh, via Amazon’s ever-helpful “Request the Closure of Your Account and the Deletion of Your Personal Information” page.

The post I Want You Back: Getting My Personal Data From Amazon Was Weeks of Confusion and Tedium appeared first on The Intercept.

This post was originally published on The Intercept.

by Craig Silverman and Jeff Kao

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

On March 3, Daniil Bezsonov, an official with the pro-Russian separatist region of Ukraine that styles itself as the Donetsk People’s Republic, tweeted a video that he said revealed “How Ukrainian fakes are made.”

The clip showed two juxtaposed videos of a huge explosion in an urban area. Russian-language captions claimed that one video had been circulated by Ukrainian propagandists who said it showed a Russian missile strike in Kharkiv, the country’s second-largest city.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

But, as captions in the second video explained, the footage actually showed a deadly arms depot explosion in the same area back in 2017. The message was clear: Don’t trust footage of supposed Russian missile strikes. Ukrainians are spreading lies about what’s really going on, and pro-Russian groups are debunking them. (Bezsonov did not respond to questions from ProPublica.)

Stills from a Russian-language video that falsely claims to fact-check Ukrainian disinformation. There’s no evidence the video was created by Ukrainian media or circulated anywhere, but the label at the top says the video is a “New Fake from Ukrainian media.” The central caption inaccurately labels the footage as “Kharkiv is again under attack by the occupants!” falsely attributing the claim to Ukrainian media. The lower caption correctly identifies the event as “Fire at the ammunition depot, the city of Balakliya, 2017.” (Screenshot taken by ProPublica)

It seemed like yet another example of useful wartime fact-checking, except for one problem: There’s little to no evidence that the video claiming the explosion was a missile strike ever circulated. Instead, the debunking video itself appears to be part of a novel and disturbing campaign that spreads disinformation by disguising it as fact-checking.

Researchers at Clemson University’s Media Forensics Hub and ProPublica identified more than a dozen videos that purport to debunk apparently nonexistent Ukrainian fakes. The videos have racked up more than 1 million views across pro-Russian channels on the messaging app Telegram, and have garnered thousands of likes and retweets on Twitter. A screenshot from one of the fake debunking videos was broadcast on Russian state TV, while another was spread by an official Russian government Twitter account.

The goal of the videos is to inject a sense of doubt among Russian-language audiences as they encounter real images of wrecked Russian military vehicles and the destruction caused by missile and artillery strikes in Ukraine, according to Patrick Warren, an associate professor at Clemson who co-leads the Media Forensics Hub.

“The reason that it’s so effective is because you don’t actually have to convince someone that it’s true. It’s sufficient to make people uncertain as to what they should trust,” said Warren, who has conducted extensive research into Russian internet trolling and disinformation campaigns. “In a sense they are convincing the viewer that it would be possible for a Ukrainian propaganda bureau to do this sort of thing.”

Russia’s Feb. 24 invasion of Ukraine unleashed a torrent of false and misleading information from both sides of the conflict. Viral social media posts claiming to show video of a Ukrainian fighter pilot who shot down six Russian planes — the so-called “Ghost of Kyiv” — were actually drawn from a video game. Ukrainian government officials said 13 border patrol officers guarding an island in the Black Sea were killed by Russian forces after unleashing a defiant obscenity, only to acknowledge a few days later that the soldiers were alive and had been captured by Russian forces.

For its part, the Russian government is loath to admit such mistakes, and it launched a propaganda campaign before the conflict even began. It refuses to use the word “invasion” to describe its use of more than 100,000 troops to enter and occupy territory in a neighboring country, and it is helping spread a baseless conspiracy theory about bioweapons in Ukraine. Russian officials executed a media crackdown culminating in a new law that forbids outlets in the country from publishing anything that deviates from the official stance on the war, while blocking Russians’ access to Facebook and the BBC, among other outlets and platforms.

Media outlets around the world have responded to the onslaught of lies and misinformation by fact-checking and debunking content and claims. The fake fact-check videos capitalize on these efforts to give Russian-speaking viewers the idea that Ukrainians are widely and deliberately circulating false claims about Russian airstrikes and military losses. Transforming debunking into disinformation is a relatively new tactic, one that has not been previously documented during the current conflict.

“It’s the first time I’ve ever seen what I might call a disinformation false-flag operation,” Warren said. “It’s like Russians actually pretending to be Ukrainians spreading disinformation.”

Stills from a Russian-language video that falsely claims to fact-check Ukrainian disinformation. There’s no evidence the video was created by Ukrainian media or circulated anywhere, but the label at the top says the video is “Fake Ukrainian media.” The captions on the left inaccurately label the footage as “A shopping center in Kyiv caught on fire after being hit by a Russian rocket,” falsely attributing the claim to Ukrainian media. The caption on the right correctly identifies the event as “Fire in Pervomais’k from 2021.” (Screenshot taken by ProPublica)

The videos combine with propaganda on Russian state TV to convince Russians that the “special operation” in Ukraine is proceeding well, and that claims of setbacks or air strikes on civilian areas are a Ukrainian disinformation campaign to undermine Russian confidence.

It’s unclear who is creating the videos, or if they come from a single source or many. They have circulated for roughly two weeks, first appearing a few days after Russia invaded. The first video Warren spotted claimed that a Ukrainian flag was removed from old footage of a military vehicle and replaced with a Z, a now-iconic insignia painted on Russian vehicles participating in the invasion. But when he went looking for examples of people sharing the misleading footage with the Z logo, he came up empty.

“I’ve been following [images and videos of the war] pretty carefully in the Telegram feeds, and I had never seen the video they were claiming was a propaganda video, anywhere,” he said. “And so I started digging a little more.”

Warren unearthed other fake fact-checking videos. One purported to debunk false footage of explosions in Kyiv, while others claimed to reveal that Ukrainians were circulating old videos of unrelated explosions and mislabeling them as recent. Some of the videos claim to debunk efforts by Ukrainians to falsely label military vehicles as belonging to the Russian military.

“It’s very clear that this is targeted at Russian-speaking audiences. They’re trying to make people think that when you see destroyed Russian military hardware, you should be suspicious of that,” Warren said.

There’s no question that older footage of military vehicles and explosions have circulated with false or misleading claims that connect them to Ukraine. But in the videos identified by Warren, the allegedly Ukrainian-created disinformation does not appear to have circulated prior to Russian-language debunkings.

Searches for examples of the misleading videos came up empty across social media and elsewhere. Tellingly, none of the supposed debunking videos cite a single example of the Ukrainian fakes being shared on social media or elsewhere. Examination of the metadata of two videos found on Telegram appears to provide an explanation for that absence: Whoever created these videos simply duplicated the original footage to create the alleged Ukrainian fake.

A digital video file contains embedded data, called metadata, that indicates when it was created, what editing software was used and the names of clips used to create a final video, among other information. Two Russian-language debunking videos contain metadata that shows they were created using the same video file twice — once to show the original footage, and once to falsely claim it circulated as Ukrainian disinformation. Whoever created the video added different captions or visual elements to fabricate the Ukrainian version.

“If these videos were what they purport to be, they would be a combination of two separate video files, a ‘Ukrainian fake’ and the original footage,” said Darren Linvill, an associate professor at Clemson who co-leads the Media Forensics Hub with Warren. “The metadata we located for some videos clearly shows that they were created by duplicating a single video file and then editing it. Whoever crafted the debunking video created the fake and debunked it at the same time.”

The Media Forensics Hub and ProPublica ran tests to confirm that a video created using two copies of the same footage will cause the file name to appear twice in the video’s metadata.

Joan Donovan, the research director of Harvard’s Shorenstein Center on Media, Politics and Public Policy, called the videos “low-grade information warfare.” She said they don’t need to spread widely on social media to be effective, since their existence can be cited by major Russian media sources as evidence of Ukraine’s online disinformation campaign.

“It works in conjunction with state TV in the sense that you can put something like this online and then rerun it on TV as if it’s an example of what’s happening online,” she said.

That’s exactly what happened on March 1, when state-controlled Channel One aired a screenshot taken from one of the videos identified by Warren. The image was shown during a morning news program as a warning to “inexperienced viewers” who might be fooled by false images of Ukrainian forces destroying Russian military vehicles, according to a BBC News report.

“Footage continues to be circulated on the internet which cannot be described as anything but fake,” the BBC quoted a Channel One presenter telling the audience.

At least one Russian government account has promoted an apparent fake debunking video. On March 4, the Russian Embassy in Geneva tweeted a video with a voiceover that said “Western and Ukrainian media are creating thousands of fake news on Russia every day.” The first example showed a video where the letter “Z” was supposedly superimposed onto a destroyed military vehicle.

Stills from a Russian-language video that falsely claims to fact-check Ukrainian disinformation. There’s no evidence the video was created by Ukrainian media or circulated anywhere, but the label at the top says the video is a “Ukrainian edit.” The top caption inaccurately labels the footage as “Ukrainians captured Russian equipment.” The lower caption correctly identifies the event as “Video of Ukrainian equipment 2019.” (Screenshot taken by ProPublica)

Another video that circulated on Russian nationalist Telegram channels such as @rlz_the_kraken, which has more than 200,000 subscribers, claimed to show that fake explosions were added to footage of buildings in Kyiv. The explosions and smoke were clearly fabricated, and the video claims they were added by Ukraininans.

Stills from a Russian-language video that falsely claims to fact-check Ukrainian disinformation. There’s no evidence the video was created by Ukrainian media or circulated anywhere, but the label in the middle of the images says “New Fake from Ukraine.” The caption at the top says “Urgent!” and inaccurately labels the footage as “Kyiv was attacked by the Russian army!” while falsely attributing the claim to Ukrainian media. The lower caption correctly identifies the image as “Kyiv 2017.” (Screenshot taken by ProPublica)

But as with the other fake debunking videos, reverse image searches didn’t turn up any examples of the supposedly manipulated video being shared online. The metadata associated with the video file indicates that it may have been manipulated to add sound and other effects using ​​Microsoft Game DVR, a piece of software that records clips from video games.

The fake debunking videos have predominantly spread on Russian-language Telegram channels with names like @FAKEcemetary. In recent days they made the leap to other languages and platforms. One video is the subject of a Reddit thread where people debated the veracity of the footage. On Twitter, they are being spread by people who support Russia, and who present the videos as examples of Ukrainian disinformation.

Francesca Totolo, an Italian writer and supporter of the neo-fascist CasaPound party, recently tweeted the video claiming that a Ukrainian flag had been removed from a military vehicle and replaced with a Russian Z.

“Now wars are also fought in the media and on social networks,” she said.

Do You Have a Tip for ProPublica? Help Us Do Journalism.

This post was originally published on Articles and Investigations – ProPublica.