TechCrunch
root
While many of the new features are more reactive in nature, the handwashing timer for Apple Watch aims to directly impact consumer behavior for the better.
Today, many people still don’t know how long to wash their hands or how to properly scrub them to reduce the spread of germs. Apple Watch wearers will get a push in the right direction, however. The new feature arriving in watchOS 7 later this year will be able to detect when handwashing has begun, using machine learning models that detect the motion of the Watch wearer’s hands. It will also use audio to confirm the sounds of water running or bubbles squishing.
Image Credits: Apple
This will make the Apple Watch the first to offer a handwashing detection feature.
As the wearer washes their hands, a countdown timer will appear on the watch face so you’ll know how long to wash. This will also use haptics and sounds to encourage you to continue, almost gamifying the experience. The device will also offer a little coaching along the way and will even push you to finish washing if you’ve stopped.
The feature is small but could have a notable impact on consumer behavior.
Image Credits: Apple
The Apple Watch will also push users to care about other aspects of their health and wellness. While that’s always been a key area of interest for Apple’s wearable platform, being healthy takes on a new level of importance in the COVID-19 era.
For instance, a new sleep tracking function for Apple Watch does more than count your zzz’s. It also helps users meet their sleep duration goals by allowing you to set both a bedtime and the time you want to wake up. The sleep tracking feature works in conjunction with iOS 14’s new “Wind Down” functionality, which will begin to minimize distractions ahead of your bedtime.
Image Credits: Apple
A calmer, notification-free home screen displays in the evenings so you can begin to transition from your wakeful, busy hours to a calmer, more relaxed state.
Wind Down shortcuts help you start to relax with quiet music or content from a meditation app.
At bedtime, your iPhone screen dims and your Apple Watch goes into sleep mode, turning the screen off. You can wake it with a tap if you want to check the time on a simple face.
Image Credits: Apple
As you sleep, the Watch uses machine learning to track your movements, even the rise and fall of your breath, to determine how you’re sleeping. You can later view your sleep trends, based on this tracking, in the Apple Health app.
In the morning, you can choose to wake up to a haptic vibration on your wrist, instead of a more jarring audible alarm. This could help you wake up without disturbing your partner, who may still be sleeping in.
Image Credits: Apple under a license.
Though Apple didn’t reference COVID-19 by name when introducing its new Apple Watch sleep tracking features, the company briefly noted that sleep is useful in “keeping you healthy.”
Other aspects where Apple addressed the COVID-19 crisis aren’t perhaps as obvious.
Apple Watch’s addition of “dance” as a Workout type in watchOS 7 could have been dreamed up for tracking cardio exercise classes, like Zumba. But today, it feels like a nod to all those Instagram Live DJ parties happening as people sheltered in place under government lockdowns. Or even an acknowledgement of how many users are “working out” by practicing the latest TikTok dance at home.
Image Credits: Apple
Meanwhile, Apple Maps was due to get cycling directions as part of its upgrade. But the way Apple designed its new biking feature is one that seems to understand that many people will reduce their reliance on public transit for years to come in favor of other transportation options.
And they’ll want more than just directions and route time.
Image Credits: Apple
Starting in major markets — New York, Los Angeles, San Francisco, Shanghai and Beijing — Apple Maps users will not only be able to calculate a biking route, but also will be able to see other aspects of that trip, like elevation changes or if there are bike lanes available.
Image Credits: Apple
The feature will even suggest if the biker should take a flight of stairs to save themselves time. And bikers can search for and add places optimized for cyclists, like bike repair shops, then place those on their route.
Then there is Apple Maps’ new “Guides” feature, largely a way to combat Google Maps’ Explore, powered by Google’s vast business data. Here, Apple has partnered with AllTrails to add information on hiking, at a time when outdoor activities have become one of the only ways we can safely entertain ourselves without fear of catching the virus.
In another response to the COVID-19 crisis, Apple has added the option for users to customize their Memoji — their personalized emoji — with face coverings, like a mask.
Though a minor tweak, the option gives users a chance to display their character as a mask wearer, which could help to destigmatize the idea of mask wearing in a market like the U.S., where it isn’t yet part of the cultural norm.
There was also a hint of how Apple understands the changes being wrought by COVID-19 in what it didn’t announce.
For example, Apple has been focused in recent years on addressing the growing criticism around the addictiveness of its iPhone device and its apps that constantly clamor for attention. It introduced a Screen Time platform in 2018 to allow iPhone owners to schedule time away from their devices, set limits on app usage, and more for either themselves or their kids. Last year, it expanded parental controls to limit who kids could call and FaceTime, and when, as part of this Screen Time system. It offered a way to more easily silence notifications.
This go around, the concept of “too much screen time” is nowhere to be found.
This aligns with the choices consumers have made during COVID-19. According to App Annie, the global daily time spent per user on mobile increased 20% to 4 hours 20 minutes in April 2020 from 2019.
And as the pandemic rages, many parents have long since given up on reducing their kids’ screen time, as well.
Apple made no mention of upgrades in this area during its keynote. In fact, it presented device owners with a solution that’s more reflective of where we are now: With so many apps and games cluttering our iPhone, we can’t even find the ones we want anymore. The new iOS 14 user interface with its App Library and widgeting system is designed for a time when we’re using a lot of apps, not trying to distance ourselves from them. And Apple is here to accommodate that need.
]]>
TechCrunch
With the new inline replies feature, iMessage users in a group chat will be able to respond to specific messages using threads — a feature common to a number of other top messaging apps, including Slack. With inline replies, users can opt to view the replies within the full conversation, or you can opt to view them as their own thread.
To make it easier for other iMessage users to know who a message was meant for in a group chat, iMessage is adding support for Mentions. But unlike the @ mention format on some apps and social platforms, like Twitter, iMessage only requires you type someone’s name — no extra symbol required.
The app will pop up a contact suggestion, which you can then click to select. The person’s name is then highlighted in blue in your text to indicate you’ve directed your comment to them.
The best part, however, is that you’ll be able to configure the Messages app to only notify you when you’ve been directly mentioned in a conversation. That will help you better keep up with busier chats you may have set on mute, without missing anything important.
The design for Group chats has also changed, where now the profile icons for the most recently active people are shown the largest.
Group chats can also be customized with a personal photo or emoji as their main photo. Within the conversation, you’ll see the group members’ profile icons spread out around this main image.
Another new feature, Pinned Conversations, will allow you to keep your most important iMessage chats at the top of the screen. This way, you can more easily jump back into your most frequently accessed conversations, like your BFF or family group chat, for example. But it also gives you a way to quickly continue a conversation with an important contact, like a significant other, spouse, or child, or anyone else you message often.
As new messages arrives in these group chats, they’ll display right at the top of the screen. You can even see the typing indicator appear when someone is texting you.
This feature will be particularly useful for those who primarily and regularly use iMessage to keep track of their conversations, but often miss important messages in a long list of unreads. It also gives you an easy way to reduce screen time, by giving you a single place to quickly make sure you haven’t missed an urgent message, without having to scroll through your list of unreads and catch up.
In addition, Apple is updating its Memoji with 20 new hair and headwear styles, face coverings, and more age options, plus 3 new Memoji stickers (hug, fist bump, and blush).
On Mac, the Messages app will also gain access to the new features including Inline Replies, Pinned Conversations, and Mentions, as well as iMessage’s Message Effects, the ability to customize Memoji, a new photo picker and #images. Apple promises also a revamped Search experience which better organizes results into links, photos, and matching items.
The new features will roll out with the release of iOS 14 and macOS Big Sur later this year.
]]>
TechCrunch
Hi friends and first-time readers. Welcome back to The Station, a newsletter dedicated to all the present and future ways people and packages move from Point A to Point B. I’m your host Kirsten Korosec, senior transportation reporter at TechCrunch.
Let’s get straight to it this week.
Remember please reach out and email me at kirsten.korosec@techcrunch.com to share thoughts, criticisms, offer up opinions or tips. You can also send a direct message to me at Twitter — @kirstenkorosec.
Vamos.
Micromobbin’
Micromobbin’ is typically the scooting ground of Megan Rose Dickey. This week, you’ll have to deal with me.
A few micromobility stories got my attention this week largely because they bring up two themes that have developed in 2020: consolidation and the development and deployment of technology aimed at solving challenges with unit economics, regulations and market share.
First up is Bird, which launched a new standalone app called Bird Maps, in Paris and Tel Aviv. Bird Maps, which was created using navigation software from Israeli startup Trailze, will provide turn-by-turn navigation for riders who want to use bike or micromobility lanes for their entire trip. The app is a just a pilot for now. But it could stick around and become available in other cities if it succeeds in attracting more customers and placating cities that are sick of the chaos and sidewalk congestion caused by the misuse of scooters.
Speaking of scooter chaos, micromobility docking startup Swiftmile and remote-controlled scooter repositioning startup Tortoise have partnered to solve two pain points: sidewalk congestion and keeping devices charged.
Swiftmile and Tortoise share many of the same customers. The idea is for Tortoise’s repositioning tech to be used to direct scooters (from companies it has deals with) to a Swiftmile docking station. The system could keep scooters on roads longer and in better shape (they tend to suffer more wear and tear when companies rely on gig workers to charge the products). It could also ease tensions with cities seeking a solution to the unsightly scene of discarded scooters littering sidewalks.
One more tech-centric story worth mentioning is about Bolt Mobility, a company I’ve become more interested in because of how they’ve tweaked their business model. The startup was co-founded by Olympic gold medalist sprinter Usain Bolt and is now led by Julia Steyn, who was formerly the CEO of GM’s now defunct car-sharing service Maven.
Bolt recently expanded to Japan and New York City. This week, it relaunched in Portland with Bolt One, a scooter equipped with front-facing footrests, dual brakes, 10-inch wheels, LED lights and swappable batteries with 25 miles of range.
Two items popped out at me. First, the company has installed NanoSeptic surfaces to its handlebars and brake levers, the two main contact points on a scooter. NanoSeptic has self-cleaning technology that is activated by light to rid surfaces of germs and bacteria, the company told TechCrunch.
And in Portland, it is partnering with local entrepreneur Timothy Robinson to run its local operations. Robinson will employ a local team to rebalance, recharge and when necessary, repair scooters to ensure availability all around the city.
Bolt Mobility tells me that partnering with a local business owner is a new approach. “With their local knowledge, we believe they can best serve cities and their unique transportation needs,” the company told me in an email.
Image Credits: Bolt Mobility
Finally, we turn to Jump, which Uber offloaded to Lime as part of a complex fundraising deal. You might remember that Uber sent thousands of Jump bikes and scooters in the U.S. to the scrap yard for recycling. The word from several sources was that Lime would only accept unused Jump bikes.
Attention then turned to Europe and industry watchers and competitors waited to see if Jump bikes in those markets would suffer the same fate. This week, Lime closed the acquisition of Uber’s micromobility subsidiary Jump in Europe. And as we saw in the U.S. Jump bikes and scooters have disappeared from the streets of London, Paris, Brussels, Rome and other European cities.
Jump bikes and scooters are now sitting in warehouses, waiting for Lime to either redeploy or trash them.
Deal of the week
COVID-19 might be the thread that runs through every business trend in 2020. Half way through the year, one theme is the belief that delivery is worth betting on in the near and long term.
Take DoorDash, the popular American food delivery company and my deal of the week. The company raised about $400 million in a Series H round at a valuation slightly under the $16 billion mark. The round had been expected, although it’s worth noting that the final valuation of the deal came in $1 billion higher than earlier reports had indicated.
DoorDash has aggressively raised capital throughout its life, including a huge Series G in late 2019 that valued it near $13 billion. Lest you forget, the company privately filed to go public earlier this year. Those plans were pushed back likely due to the COVID-19 pandemic and the economic uncertainty that it continues to spread.
The question is then, where does DoorDash go from here? The company is at war with the Uber Eats service, the Postmates delivery service and the Grubhub-Just Eat Takeaway hybrid. It’s also facing a legal battle with San Francisco. The SF district attorney initiated a lawsuit against DoorDash on June 16 over allegations that it illegally misclassified employees as independent contractors. Comments from SF DA Chesa Boudin suggests the city is ready for a protracted fight.
“I assure you this is just the first step among many to fight for worker safety and equal enforcement of the law,” Boudin tweeted this week.
That means capital requirements are not fading away anytime soon. Nor is the ever looming threat — or opportunity, depending on where you sit — of consolidation.
We know that Uber, still smarting from its failed deal to buy Grubhub, is itching to expand the market share of its Eats food delivery business. Uber has stated that consolidation, in its view, is a path to profitability. It also said it “that doesn’t mean we are interested in doing any deal, at any price, with any player.”
DoorDash, loaded with a fresh injection of capital, could bypass private investors and a merger play and opt for door No. 3: public markets. Companies like Nikola Motor and Vroom recently made the leap despite weak economics in their core businesses.
Other deals that got our attention …
Mapillary, the startup that has developed a street-level imagery platform that uses computer vision to automate and scale mapping, has been acquired by Facebook. Mapillary team and project will become part of Facebook’s broader open mapping efforts, TechCrunch’s Steve O’Hear reported. I’ve been following Mapillary because of how its platform could be used in the transportation sector, specifically in the development of autonomous vehicles. Jan Erik Solem, the founder of Mapillary is on a bit of a roll. Solem launched Mapillary in 2014 after selling his first computer vision company to Apple. You can read more about the company in this blog post from Solem.
SuperAnnotate is an interesting little startup that launched in February. The company, which just raised $3 million in seed funding, developed an image annotation platform for labeling teams and data scientists. Basically, it has created a toolkit for manual labeling, a simple communication system, recognition improvement, image status tracking, templates, dashboards and other essential tools. SuperAnnotate is one of those “picks and shovels” companies, a term I use to describe businesses that are poised to make big bucks providing tools for the autonomous vehicle industry. But this platform has applications beyond AVs and can also be used in robotics, retail, satellite imagery, security, and medical imaging.
Splyt, a UK-based company that developed software to simplify ride hailing, raised $19.5 million in a round led by SoftBank. Splyt has raised a total of $35 million.
Volkswagen invested another $200 million into QuantumScape, a Stanford University spinout developing solid-state batteries as the automaker bets on a next-generation technology that will unlock longer ranges and faster charging times in electric vehicles.
Israeli startup CENS, which developed nanotechnology to improve the
performance of batteries used in electric vehicles, drones and solar energy storage plants, raised $1.5 million in a round led by the UK based investor Vincent Tchenguiz at Consensus Group.
The City of Fort Worth approved a $68.9 million economic incentive package for Linear Labs, a startup developing an electric motor for cars, scooters, robots, wind turbines and even HVAC systems. The company is planning to secure a 500,000-square-foot facility for its research and production center that will manufacture electric motors. The four-year-old company was founded by Brad and Fred Hunstable, who say they have invented a lighter, more flexible electric motor. The pair came up with the motor they’ve dubbed the Hunstable Electric Turbine (HET) while working to design a device that could pump clean water and provide power for small communities in underdeveloped regions of the world.
BYD Co., the Chinese auto giant backed by Warren Buffett, secured 800 million yuan ($113 million) in a Series A+ round for its chipmaking arm, BYD Semiconductor.
GoFor Industries, a Canadian startup that developed an on-demand last-mile delivery service for the construction industry, has raised C$9.8 million in seed funding.
Dumpling, a startup based in Seattle and Berkeley, Calif., raised $6.5 million in Series A funding round led by Forerunner Ventures. The startup helps users launch and run independent grocery shopping and delivery businesses.
Bitauto Holdings Ltd., the Chinese car comparison website, agreed to be taken private by an investor group backed by gaming and social media firm Tencent Holdings for $1.1 billion in cash, per Reuters.
TriEye, an Israeli startup that’s working on a sensor technology to help vehicle driver-assistance and self-driving systems see better in poor weather conditions, announced a collaboration with DENSO to evaluate its CMOS-based Short-Wave Infrared camera called Sparrow. Porsche, which took a minority stake in TriEye last year, is also evaluating the Sparrow camera.
This is more of an infrastructure play, but interesting nonetheless. ECOncrete, an Israeli startup that has developed eco-friendly concrete technology used in the construction of breakwaters, seawalls and piers, raised $5 million in a round led by Bridges Israel. Technology investment house Goldacre also participated in the round. ECOncrete part of the company’s RElab 2020 PropTech cohort — its accelerator program.
And under the “lol” category …
Hertz, which filed for bankruptcy last month, halted its $500 million stock offering after the U.S. Securities and Exchange Commission told the rental company it would review its controversial plan to sell shares that could soon be wiped out completely. I am shocked I tell you. Shocked.
Hertz had planned to issue a $500 million stock offering following approval from the U.S. Bankruptcy Court for the District of Delaware . Last week, the court gave Hertz permission to sell up to 246.8 million unissued shares (about $1 billion) to Jefferies LLC.
Layoffs, business disruptions and people
Image Credits: TechCrunch
Before we get to the layoffs, it’s worth noting the end of what was supposed to be a long-term alliance between BMW and Mercedes Benz AG to develop next generation automated driving technology.
The agreement was announced just 11 months ago. And now, it’s kaput. The German automakers called the break up “mutual and amicable” and have each agreed to concentrate on their existing development paths. Those new paths may include working with new or current partners.
The partnership was never meant to be exclusive. But it was interesting because it reflected the increasingly common approach among legacy manufacturers to form loose development agreements in an aim to share the capitally intensive work of developing, testing and validating automated driving technology.
Layoffs
BMW also announced it will cut 6,000 jobs in an agreement reached with the German Works Council. The cuts, prompted by sluggish sales caused by the COVID-19 pandemic, will be reportedly accomplished through early retirement, non-renewal of temporary contracts, ending redundant positions and not filling vacant positions, Marketwatch reported.
Grab, Southeast Asia’s largest ride-hailing startup is laying off about 360 people, or slightly less than 5% of its employees. A Grab spokesperson told TechCrunch that the company will not be shutting down offices, and that this is the last organization-wide layoff the company will perform this year. Grab will sunset some “non-core projects,” consolidate functions and reduce team sizes. It is also reallocating more resources to its on-demand delivery verticals.
Volvo Group is cutting 4,100 white-collar jobs globally and about 15% of the cuts will be contractors, per Freight Waves.
Layoffs.fyi has launched a severance tracker. The site said that of the 500 startups with layoffs, 10 of them offered more than 8 weeks of severance pay and more than 4 months of extended healthcare coverage.
A little bird
We hear and see things, but we’re not selfish. We share!
I wandered over to the Federal Motor Carrier Safety Administration website and this popped up. It appears that autonomous vehicle technology company Aurora has filed for a USDOT number from the FMCSA. This caught my eye because for companies to operate commercial vehicles that haul freight along interstates, they must be registered with the FMCSA and must have a USDOT Number.
It doesn’t appear that Aurora has received authorization yet, according to the filing. This should be viewed as a first step and illustrates Aurora’s previously stated intentions to develop technology for self-driving trucks.
Notable reads and other tidbits
Lots to cover here …
Ride-hailing
Uber said it will manage an on-demand service for Marin County in the San Francisco Bay area with a Software as a Service product as part of the ride-hailing company’s broader strategy to push into public transit.
Transportation Authority of Marin (TAM) will pay Uber a subscription fee to use its management software to facilitate requesting, matching and tracking of its high-occupancy vehicle fleet, starting with a service that operates along the Highway 101 corridor. Marin Transit trips will show up in the Uber app and let users book and even share rides.
This is notable because the deal marks the first SaaS partnership for Uber and a likely pathway moving forward. Remember that Uber recently offloaded its micromobility unit Jump in a deal with Lime and has reshaped its strategy since the COVID-19 pandemic. Uber CEO Dara Khosrowshahi said during the company’s last earnings call that the company is focused on growing Eats, its food delivery business, as well as public transit.
Automated driving
Ford will start offering a hands-free driving feature in the second half 2021, beginning with its new Mustang Mach-E electric vehicle. The hands-free feature, called Active Drive Assist, is part of a larger package of advanced driver assistance features collectively called Ford Co-Pilot360 Active 2.0 Prep Package. The hands-free feature has been anticipated since the Mustang Mach-E, which has a driving monitoring system situated above the steering wheel, was revealed last year.
National Highway Traffic and Safety Administration introduced this week the Automated Vehicle Transparency and Engagement for Safe Testing, or AV TEST Initiative. Those testing automated vehicles can now voluntarily submit information to NHTSA. The announcement included nine companies and eight states that have signed on as the first participants.
Electric news
Lucid Motors will begin producing its luxury electric vehicle for customers at its new Arizona factory in early 2021, about three months later than expected due to a slowdown caused by COVID-19.
The company, which plans to unveil a production version of the Lucid Air in an online event scheduled for September 9, said construction resumed several weeks ago at its factory in Casa Grande, Arizona, and is on target to complete phase one this year. Lucid Motors has also restarted vehicle development work at its California facility, which was briefly delayed due to shelter-in-place orders.
Image Credits: Lyudinka / Getty Images
Lyft said that every car, truck and SUV on its platform will be all-electric or powered by another zero-emission technology by 2030, a commitment that will require the company to coax drivers to shift away from gas-powered vehicles. It’s important to note that after a bit of waffling, Lyft finally answered my question and confirmed that it won’t prohibit drivers on its platform from driving a gas-powered vehicle. The company told me they didn’t think that step was necessary.
The target, which Lyft plans to pursue with help from the Environmental Defense Fund and other partners, will stretch across multiple programs. It will include the company’s autonomous vehicles, the Express Drive rental car partner program for rideshare drivers, consumer rental cars for riders and personal cars that drivers use on the Lyft app. That personal car category will be the tricky one.
Miscellaneous bits
MIT Center for Transportation and Logistics and the Toyota Collaborative Safety Research Center released DriveSeg, a new open dataset intended to help accelerate autonomous driving research. The dataset contains pixel-level representations through the lens of a continuous driving scene — allowing researchers to identify more amorphous objects that do not always have uniform shapes. It’s free and can be used by researchers and the academic community for non-commercial purposes.
House Speaker Nancy Pelosi announced plans to bring a $1.5 trillion infrastructure bill called the Moving Forward Act. The bulk of proposed bill, which Pelosi said will be introduced before the July 4 recess, stems from Democrat-led legislation currently making its way through the House that would authorize $494 million to be spent over five years on roads, bridges and transit programs. It also includes $25 billion for drinking water, $100 billion for broadband, $70 billion for clean energy projects, $100 billion for low income schools, $30 billion to upgrade hospitals, $100 billion in funding for public housing and $25 billion for the postal service, The Hill reported.
Motor Trend has a great piece on the experience of the Black motorist and how that has and has not evolved since the Jim Crow era.
GM released a timeline to celebrate the 100-year anniversary of its GM Research and Development department. It’s a fun ride down memory lane and includes the 1964 Electrovair, which was developed to test the viability of electric power for passenger cars.
Image Credits: GM
]]>
TechCrunch
There’s no big conspiracy. Ad tech can be creepily accurate.
Tech giant Oracle is one of a few companies in Silicon Valley that has near-perfected the art of tracking people across the internet. The company has spent a decade and billions of dollars buying startups to build its very own panopticon of users’ web browsing data.
One of those startups, BlueKai, which Oracle bought for a little over $400 million in 2014, is barely known outside marketing circles, but it amassed one of the largest banks of web tracking data outside of the federal government.
BlueKai uses website cookies and other tracking tech to follow you around the web. By knowing which websites you visit and which emails you open, marketers can use this vast amount of tracking data to infer as much about you as possible — your income, education, political views, and interests to name a few — in order to target you with ads that should match your apparent tastes. If you click, the advertisers make money.
But for a time, that web tracking data was spilling out onto the open internet because a server was left unsecured and without a password, exposing billions of records for anyone to find.
Security researcher Anurag Sen found the database and reported his finding to Oracle through an intermediary — Roi Carthy, chief executive at cybersecurity firm Hudson Rock and former TechCrunch reporter.
TechCrunch reviewed the data shared by Sen and found names, home addresses, email addresses and other identifiable data in the database. The data also revealed sensitive users’ web browsing activity — from purchases to newsletter unsubscribes.
“There’s really no telling how revealing some of this data can be,” said Bennett Cyphers, a staff technologist at the Electronic Frontier Foundation, told TechCrunch.
“Oracle is aware of the report made by Roi Carthy of Hudson Rock related to certain BlueKai records potentially exposed on the Internet,” said Oracle spokesperson Deborah Hellinger. “While the initial information provided by the researcher did not contain enough information to identify an affected system, Oracle’s investigation has subsequently determined that two companies did not properly configure their services. Oracle has taken additional measures to avoid a reoccurrence of this issue.”
Oracle did not name the companies or say what those additional measures were, and declined to answer our questions or comment further.
But the sheer size of the exposed database makes this one of the largest security lapses this year.
The more it knows
BlueKai relies on vacuuming up a never-ending supply of data from a variety of sources to understand trends to deliver the most precise ads to a person’s interests.
Marketers can either tap into Oracle’s enormous bank of data, which it pulls in from credit agencies, analytics firms, and other sources of consumer data including billions of daily location data points, in order to target their ads. Or marketers can upload their own data obtained directly from consumers, such as the information you hand over when you register an account on a website or when you sign up for a company’s newsletter.
But BlueKai also uses more covert tactics like allowing websites to embed invisible pixel-sized images to collect information about you as soon as you open the page — hardware, operating system, browser and any information about the network connection.
This data — known as a web browser’s “user agent” — may not seem sensitive, but when fused together it can create a unique “fingerprint” of a person’s device, which can be used to track that person as they browse the internet.
BlueKai can also tie your mobile web browsing habits to your desktop activity, allowing it to follow you across the internet no matter which device you use.
Say a marketer wants to run a campaign trying to sell a new car model. In BlueKai’s case, it already has a category of “car enthusiasts” — and many other, more specific categories — that the marketer can use to target with ads. Anyone who’s visited a car maker’s website or a blog that includes a BlueKai tracking pixel might be categorized as a “car enthusiast.” Over time that person will be siloed into different categories under a profile that learns as much about you to target you with those ads.
The technology is far from perfect. Harvard Business Review found earlier this year that the information collected by data brokers, such as Oracle, can vary wildly in quality.
But some of these platforms have proven alarmingly accurate.
In 2012, Target mailed maternity coupons to a high school student after an in-house analytics system figured out she was pregnant — before she had even told her parents — because of the data it collected from her web browsing.
Some might argue that’s precisely what these systems are designed to do.
Jonathan Mayer, a science professor at Princeton University, told TechCrunch that BlueKai is one of the leading systems for linking data.
“If you have the browser send an email address and a tracking cookie at the same time, that’s what you need to build that link,” he said.
The end goal: the more BlueKai collects, the more it can infer about you, making it easier to target you with ads that might entice you to that magic money-making click.
But marketers can’t just log in to BlueKai and download reams of personal information from its servers, one marketing professional told TechCrunch. The data is sanitized and masked so that marketers never see names, addresses or any other personal data.
As Mayer explained: BlueKai collects personal data; it doesn’t share it with marketers.
‘No telling how revealing’
Behind the scenes, BlueKai continuously ingests and matches as much raw personal data as it can against each person’s profile, constantly enriching that profile data to make sure it’s up to date and relevant.
But it was that raw data spilling out of the exposed database.
TechCrunch found records containing details of private purchases. One record detailed how a German man, whose name we’re withholding, used a prepaid debit card to place a €10 bet on an esports betting site on April 19. The record also contained the man’s address, phone number and email address.
Another record revealed how one of the largest investment holding companies in Turkey used BlueKai to track users on its website. The record detailed how one person, who lives in Istanbul, ordered $899 worth of furniture online from a homeware store. We know because the record contained all of these details, including the buyer’s name, email address and the direct web address for the buyer’s order, no login needed.
We also reviewed a record detailing how one person unsubscribed from an email newsletter run by an electronics consumer, sent to his iCloud address. The record showed that the person may have been interested in a specific model of car dash-cam. We can even tell based on his user agent that his iPhone was out of date and needed a software update.
The more BlueKai collects, the more it can infer about you, making it easier to target you with ads that might entice you to that magic money-making click.
The data went back for months, according to Sen, who discovered the database. Some logs dated back to August 2019, he said.
“Fine-grained records of people’s web-browsing habits can reveal hobbies, political affiliation, income bracket, health conditions, sexual preferences, and — as evident here — gambling habits,” said the EFF’s Cyphers. “As we live more of our lives online, this kind of data accounts for a larger and larger portion of how we spend our time.”
Oracle declined to say if it informed those whose data was exposed about the security lapse. The company also declined to say if it had warned U.S. or international regulators of the incident.
Under California state law, companies like Oracle are required to publicly disclose data security incidents, but Oracle has not to date declared the lapse. When reached, a spokesperson for California’s attorney general’s office declined to say if Oracle had informed the office of the incident.
Under Europe’s General Data Protection Regulation, companies can face fines of up to 4% of their global annual turnover for flouting data protection and disclosure rules.
Trackers, trackers everywhere
BlueKai is everywhere — even when you can’t see it.
One estimate says BlueKai tracks over 1% of all web traffic — an unfathomable amount of daily data collection — and tracks some of the world’s biggest websites: Amazon, ESPN, Forbes, Glassdoor, Healthline, Levi’s, MSN.com, Rotten Tomatoes, and The New York Times. Even this very article has a BlueKai tracker because our parent company, Verizon Media, is a BlueKai partner.
But BlueKai is not alone. Nearly every website you visit contains some form of invisible tracking code that watches you as you traverse the internet.
As invasive as it is that invisible trackers are feeding your web browsing data to a gigantic database in the cloud, it’s that very same data that has kept the internet largely free for so long.
To stay free, websites use advertising to generate revenue. The more targeted the advertising, the better the revenue is supposed to be.
While the majority of web users are not naive enough to think that internet tracking does not exist, few outside marketing circles understand how much data is collected and what is done with it.
Take the Equifax data breach in 2017, which brought scathing criticism from lawmakers after it collected millions of consumers’ data without their explicit consent. Equifax, like BlueKai, relies on consumers skipping over the lengthy privacy policies that govern how websites track them.
In any case, consumers have little choice but to accept the terms. Be tracked or leave the site. That’s the trade-off with a free internet.
But there are dangers with collecting web-tracking data on millions of people.
“Whenever databases like this exist, there’s always a risk the data will end up in the wrong hands and in a position to hurt someone,” said Cyphers.
Cyphers said the data, if in the hands of someone malicious, could contribute to identity theft, phishing or stalking.
“It also makes a valuable target for law enforcement and government agencies who want to piggyback on the data gathering that Oracle already does,” he said.
Even when the data stays where it’s intended, Cyphers said these vast databases enable “manipulative advertising for things like political issues or exploitative services, and it allows marketers to tailor their messages to specific vulnerable populations,” he said.
“Everyone has different things they want to keep private, and different people they want to keep them private from,” said Cyphers. “When companies collect raw web browsing or purchase data, thousands of little details about real people’s lives get scooped up along the way.”
“Each one of those little details has the potential to put somebody at risk,” he said.
Send tips securely over Signal and WhatsApp to +1 646-755-8849.
]]>
TechCrunch
There’s no big conspiracy. Ad tech can be creepily accurate.
Tech giant Oracle is one of a few companies in Silicon Valley that has near-perfected the art of tracking people across the internet. The company has spent a decade and billions of dollars buying startups to build its very own panopticon of users’ web browsing data.
One of those startups, BlueKai, which Oracle bought for a little over $400 million in 2014, is barely known outside marketing circles, but it amassed one of the largest banks of web tracking data outside of the federal government.
BlueKai uses website cookies and other tracking tech to follow you around the web. By knowing which websites you visit and which emails you open, marketers can use this vast amount of tracking data to infer as much about you as possible — your income, education, political views, and interests to name a few — in order to target you with ads that should match your apparent tastes. If you click, the advertisers make money.
But for a time, that web tracking data was spilling out onto the open internet because a server was left unsecured and without a password, exposing billions of records for anyone to find.
Security researcher Anurag Sen found the database and reported his finding to Oracle through an intermediary — Roi Carthy, chief executive at cybersecurity firm Hudson Rock and former TechCrunch reporter.
TechCrunch reviewed the data shared by Sen and found names, home addresses, email addresses and other identifiable data in the database. The data also revealed sensitive users’ web browsing activity — from purchases to newsletter unsubscribes.
“There’s really no telling how revealing some of this data can be,” said Bennett Cyphers, a staff technologist at the Electronic Frontier Foundation, told TechCrunch.
“Oracle is aware of the report made by Roi Carthy of Hudson Rock related to certain BlueKai records potentially exposed on the Internet,” said Oracle spokesperson Deborah Hellinger. “While the initial information provided by the researcher did not contain enough information to identify an affected system, Oracle’s investigation has subsequently determined that two companies did not properly configure their services. Oracle has taken additional measures to avoid a reoccurrence of this issue.”
Oracle did not name the companies or say what those additional measures were, and declined to answer our questions or comment further.
But the sheer size of the exposed database makes this one of the largest security lapses this year.
The more it knows
BlueKai relies on vacuuming up a never-ending supply of data from a variety of sources to understand trends to deliver the most precise ads to a person’s interests.
Marketers can either tap into Oracle’s enormous bank of data, which it pulls in from credit agencies, analytics firms, and other sources of consumer data including billions of daily location data points, in order to target their ads. Or marketers can upload their own data obtained directly from consumers, such as the information you hand over when you register an account on a website or when you sign up for a company’s newsletter.
But BlueKai also uses more covert tactics like allowing websites to embed invisible pixel-sized images to collect information about you as soon as you open the page — hardware, operating system, browser and any information about the network connection.
This data — known as a web browser’s “user agent” — may not seem sensitive, but when fused together it can create a unique “fingerprint” of a person’s device, which can be used to track that person as they browse the internet.
BlueKai can also tie your mobile web browsing habits to your desktop activity, allowing it to follow you across the internet no matter which device you use.
Say a marketer wants to run a campaign trying to sell a new car model. In BlueKai’s case, it already has a category of “car enthusiasts” — and many other, more specific categories — that the marketer can use to target with ads. Anyone who’s visited a car maker’s website or a blog that includes a BlueKai tracking pixel might be categorized as a “car enthusiast.” Over time that person will be siloed into different categories under a profile that learns as much about you to target you with those ads.
The technology is far from perfect. Harvard Business Review found earlier this year that the information collected by data brokers, such as Oracle, can vary wildly in quality.
But some of these platforms have proven alarmingly accurate.
In 2012, Target mailed maternity coupons to a high school student after an in-house analytics system figured out she was pregnant — before she had even told her parents — because of the data it collected from her web browsing.
Some might argue that’s precisely what these systems are designed to do.
Jonathan Mayer, a science professor at Princeton University, told TechCrunch that BlueKai is one of the leading systems for linking data.
“If you have the browser send an email address and a tracking cookie at the same time, that’s what you need to build that link,” he said.
The end goal: the more BlueKai collects, the more it can infer about you, making it easier to target you with ads that might entice you to that magic money-making click.
But marketers can’t just log in to BlueKai and download reams of personal information from its servers, one marketing professional told TechCrunch. The data is sanitized and masked so that marketers never see names, addresses or any other personal data.
As Mayer explained: BlueKai collects personal data; it doesn’t share it with marketers.
‘No telling how revealing’
Behind the scenes, BlueKai continuously ingests and matches as much raw personal data as it can against each person’s profile, constantly enriching that profile data to make sure it’s up to date and relevant.
But it was that raw data spilling out of the exposed database.
TechCrunch found records containing details of private purchases. One record detailed how a German man, whose name we’re withholding, used a prepaid debit card to place a €10 bet on an esports betting site on April 19. The record also contained the man’s address, phone number and email address.
Another record revealed how one of the largest investment holding companies in Turkey used BlueKai to track users on its website. The record detailed how one person, who lives in Istanbul, ordered $899 worth of furniture online from a homeware store. We know because the record contained all of these details, including the buyer’s name, email address and the direct web address for the buyer’s order, no login needed.
We also reviewed a record detailing how one person unsubscribed from an email newsletter run by an electronics consumer, sent to his iCloud address. The record showed that the person may have been interested in a specific model of car dash-cam. We can even tell based on his user agent that his iPhone was out of date and needed a software update.
The more BlueKai collects, the more it can infer about you, making it easier to target you with ads that might entice you to that magic money-making click.
The data went back for months, according to Sen, who discovered the database. Some logs dated back to August 2019, he said.
“Fine-grained records of people’s web-browsing habits can reveal hobbies, political affiliation, income bracket, health conditions, sexual preferences, and — as evident here — gambling habits,” said the EFF’s Cyphers. “As we live more of our lives online, this kind of data accounts for a larger and larger portion of how we spend our time.”
Oracle declined to say if it informed those whose data was exposed about the security lapse. The company also declined to say if it had warned U.S. or international regulators of the incident.
Under California state law, companies like Oracle are required to publicly disclose data security incidents, but Oracle has not to date declared the lapse. When reached, a spokesperson for California’s attorney general’s office declined to say if Oracle had informed the office of the incident.
Under Europe’s General Data Protection Regulation, companies can face fines of up to 4% of their global annual turnover for flouting data protection and disclosure rules.
Trackers, trackers everywhere
BlueKai is everywhere — even when you can’t see it.
One estimate says BlueKai tracks over 1% of all web traffic — an unfathomable amount of daily data collection — and tracks some of the world’s biggest websites: Amazon, ESPN, Forbes, Glassdoor, Healthline, Levi’s, MSN.com, Rotten Tomatoes, and The New York Times. Even this very article has a BlueKai tracker because our parent company, Verizon Media, is a BlueKai partner.
But BlueKai is not alone. Nearly every website you visit contains some form of invisible tracking code that watches you as you traverse the internet.
As invasive as it is that invisible trackers are feeding your web browsing data to a gigantic database in the cloud, it’s that very same data that has kept the internet largely free for so long.
To stay free, websites use advertising to generate revenue. The more targeted the advertising, the better the revenue is supposed to be.
While the majority of web users are not naive enough to think that internet tracking does not exist, few outside marketing circles understand how much data is collected and what is done with it.
Take the Equifax data breach in 2017, which brought scathing criticism from lawmakers after it collected millions of consumers’ data without their explicit consent. Equifax, like BlueKai, relies on consumers skipping over the lengthy privacy policies that govern how websites track them.
In any case, consumers have little choice but to accept the terms. Be tracked or leave the site. That’s the trade-off with a free internet.
But there are dangers with collecting web-tracking data on millions of people.
“Whenever databases like this exist, there’s always a risk the data will end up in the wrong hands and in a position to hurt someone,” said Cyphers.
Cyphers said the data, if in the hands of someone malicious, could contribute to identity theft, phishing or stalking.
“It also makes a valuable target for law enforcement and government agencies who want to piggyback on the data gathering that Oracle already does,” he said.
Even when the data stays where it’s intended, Cyphers said these vast databases enable “manipulative advertising for things like political issues or exploitative services, and it allows marketers to tailor their messages to specific vulnerable populations,” he said.
“Everyone has different things they want to keep private, and different people they want to keep them private from,” said Cyphers. “When companies collect raw web browsing or purchase data, thousands of little details about real people’s lives get scooped up along the way.”
“Each one of those little details has the potential to put somebody at risk,” he said.
Send tips securely over Signal and WhatsApp to +1 646-755-8849.
]]>
TechCrunch
“Sitting here today, there’s not any changes to the rules that we are considering,” Schiller said. “There are many things that they could do to make the app work within the rules that we have. We would love for them to do that.”
The call came after several days of public scrutiny of Apple’s handling of the Hey app. After an initial approval, the developers at Basecamp, including two of its founders, David Heinemeier Hansson and Jason Fried, took to Twitter to note that an update had been repeatedly rejected, with the core of the argument being that they were not offering an in-app purchase for the full service in addition to offering it on the Hey website.
The current experience of the Hey app as a user downloading it from the App Store is that it does nothing. It is an app that requires you to subscribe to the Hey service on the web before it becomes useful.
“You download the app and it doesn’t work, that’s not what we want on the store,” says Schiller. This, he says, is why Apple requires in-app purchases to offer the same purchasing functionality as they would have elsewhere.
To be clear, this is against the App Store rules for most apps. The exceptions here are apps that are viewed as “readers” that only display external content of certain types, like music, books and movies — and apps that only offer bulk pricing options that are paid for by institutions or corporations rather than the end user.
Schiller is clear on our call that Hey does not fit these rules.
“We didn’t extend these exceptions to all software,” he notes about the “reader” type apps — examples of which include Netflix. “Email is not and has never been an exception included in this rule.”
In fact, Hey’s Mac App was rejected for the exact behavior for which the iOS app is being targeted. Schiller says that the iOS app’s original version was approved in error, and should never have shipped to the store.
The questions, then, really center around whether this should be the case, rather than is there some sort of arcane vision of the current App Store rules that would allow the Hey app to continue to be on the store.
I asked Schiller if this meant Apple felt entitled to a portion of the revenue of every business that had an app, regardless of whether that business was an iOS-first.
“I get why there’s a question here,” he says. “But that’s not what we’re doing.”
Schiller says that there are a number of decisions about how to charge customers that Basecamp could have made to make the app acceptable under current rules. He lists several, including charging different prices in the app and on the web, and offering a free version with additional functions.
But, he says, if you’re going to charge for it and it is a digital service, then Apple wants developers to use the in-app purchase mechanic and Apple payment system to ensure that users have a good experience in the app and that the payment system is secured.
One way that Hey could have gone, Schiller says, is to offer a free or paid version of the app with basic email reading features on the App Store, then separately offered an upgraded email service that worked with the Hey app on iOS on its own website. Schiller gives one more example: an RSS app that reads any feed, but also reads an upgraded feed that could be charged for on a separate site. In both cases, the apps would have functionality when downloaded on the store.
Other options are more familiar to many users, which includes a completely free app with an upsell that is also an in-app purchase.
Unfortunately, of course, the current rules would prevent Hey from advertising or even mentioning any upgraded service, and that would have to be marketed through off-app channels.
The ongoing debate around the issue is summed up well by Sarah Perez on TechCrunch yesterday and I encourage you to read that if you’re not up to date. And just today a story in the Times landed about Facebook’s gaming app having been rejected for rules five times. All of this brewing a perfect storm in advance of Apple’s WWDC conference aimed at developers and nearly day and date with the launch of an EU antitrust investigation.
I’ve been thinking hard about it myself, as someone who covers Apple extensively and has often been witness to the behind-the-scenes anxiety that developers have about whether Apple will reject an app from one moment to the next because of a personal interpretation of the App Store rules.
I think that, for me, it boils down to some simple observations. The fact is that Hey violates app store rules. Which means that the question is not “how can we contort those rules or squint enough to justify it” but instead “should those be the rules”?
As far as to why Apple would look at a situation like this and not see an obvious minefield, I believe that it internally thinks that it is doing the right and just thing. It built the platform, it deserves to profit from that platform which does contribute enormous economic impact to both digital and physical sectors. And there are indisputable security and privacy benefits to Apple controlling the payments platform.
And for those that would say “but surely it sees the optics!” I think that those people often underestimate the power of scale. Apple approves some 100,000 apps every week and the vast majority of rejections are for minor issues quickly fixed. That kind of scale can often bend perception on behalf of an organization and its guiding forces, because they see a vast calm sea with a few breakers — where the media is focused on the breakers alone.
Here’s how I feel about that, though, and where the blind spots may lie here.
- There may be (and my back channel, and other people’s back channels, indicate that there is) a large ground swell of resentment and irritation with the App Store that goes un-expressed because people are afraid and need it to survive.
- Sometimes the source of the criticism matters — Hansson may be annoying and vociferous and take a worst-motivations stance in his public comms, but change and self examination do not always originate with people who we consider to be our friends or allies. And it is twice as hard to apply the change that comes from people who are angry and seemingly unkind — but maybe right.
Call me naive, but I do feel that there is a superset of genuine, core values that Apple does apply to its business in a way that is genuinely unique among big corporations. I’m sure some people will disagree (read: many) but I’ve seen it first-hand in covering the company and in discussions (official and personal) with many, many, many of its executives and rank and file employees over the years. Much like John Gruber I find it hard to square the circle with finding a way forward here that sets aside “we are doing what is right” for “what is the right thing to do”?
Shortly before publishing this interview, Apple provided a letter to TechCrunch that was also sent to Fried and Hey.
The letter reiterates the reasons Apple says that Hey does not comply with current App Store policy. It reads, in part:
“Thank you for being an iOS app developer. We understand that Basecamp has developed a number of apps and many subsequent versions for the App Store for many years, and that the App Store has distributed millions of these apps to iOS users. These apps do not offer in-app purchase — and, consequently, have not contributed any revenue to the App Store over the last eight years. We are happy to continue to support you in your app business and offer you the solutions to provide your services for free — so long as you follow and respect the same App Store Review Guidelines and terms that all developers must follow.”
So for now, no thawing.
Full letter follows:
Hello Jason,
We are writing to let you know the appeal results for your app, HEY Email.
The App Review Board evaluated your app and determined that the rejection was valid. Your app does not comply with the App Store Review Guidelines detailed below. As you are aware, this is the reason your Hey Email app was rejected when it was submitted to the Mac App Store on June 11, 2020.
The HEY Email app is marketed as an email app on the App Store, but when users download your app, it does not work. Users cannot use the app to access email or perform any useful function until after they go to the Basecamp website for Hey Email and purchase a license to use the HEY Email app. This violates the following App Store Review Guidelines:
Guideline 3.1.1 – Business – Payments – In-App Purchase
If you want to unlock features or functionality within your app, you must use in-app purchase. Your app requires customers to purchase content, subscriptions, or features outside of the app, but those items are not available as in-app purchases within the app as required by the App Store Review Guidelines.
Guideline 3.1.3(a) – Business – Payments – “Reader” Apps
Reader apps may allow users to access previously purchased content and content subscriptions. Your mail app is not one of the content types allowed under this guideline for “Reader” apps (specifically: magazines, newspapers, books, audio, music, video, access to professional databases, VOIP, cloud storage, or approved services such as classroom management apps). Therefore, customers must be given the option to purchase access to features or functionality in your app using in-app purchase.
Guideline 3.1.3(b) – Business – Payments – Multiplatform Services
Apps that operate services across multiple platforms may allow users to access content, subscriptions, or features they have acquired in your app on other platforms or on your website, provided those items are also available as in-app purchases within the app. Your HEY Email app does not offer access to content, subscriptions, or features as in-app purchases within the app. In fact, the app does not function as an email app or for any purpose until the user goes to the Basecamp Hey Email website to start a free trial or purchase a separate license to use the app for its intended purpose.
Next Steps
To resolve this issue, please revise your app such that it does not violate any of the App Store Review Guidelines and terms.
There are a number of ways that you could revise your app or service to adhere to the App Store Review Guidelines. Customers who have previously purchased access to content, subscriptions, or features elsewhere may continue to access these items in your app, as long as new iOS customers are given the option to purchase access using in-app purchase as required by the App Store Review Guidelines.
If you would prefer not to offer users the option of in-app purchases, you could consider having the app function as marketed — an email client that works with standard IMAP and POP email accounts, where customers can optionally configure the Hey Email service as their preferred email service provider. This would allow the app to function as an email client without requiring an additional payment to use its features and functionality. Under this approach, what you sell on your website is clearly an email service separate from the function of your app as distributed on the App Store.
We are here as a resource as you explore these or other ideas to bring the Hey Email app within compliance of the App Store Review Guidelines and terms.
Thank you for being an iOS app developer. We understand that Basecamp has developed a number of apps and many subsequent versions for the App Store for many years, and that the App Store has distributed millions of these apps to iOS users. These apps do not offer in-app purchase — and, consequently, have not contributed any revenue to the App Store over the last eight years. We are happy to continue to support you in your app business and offer you the solutions to provide your services for free — so long as you follow and respect the same App Store Review Guidelines and terms that all developers must follow.
We hope to assist you in offering the Hey Email app on the App Store.
Sincerely,
App Review Board
]]>
