Latin America. Generative Artificial Intelligence plays an increasingly important role in the public and private lives of people, governments and companies. At the same time, large technology platforms modify and update their privacy policies, with the incorporation of new functionalities with this technology.
However, ESET, a proactive threat detection company, warns that there are cases in which it is not clear how artificial intelligence will treat the data collected, although some companies directly warn that it will be used to improve the Artificial Intelligence training model, in order to improve their products or services.
"The management of the data required by these technologies and the management of the information to nurture it, makes it necessary to have contracts that are clear and concise, that do not lend themselves to confusion or discontent. The violation of privacy and copyright is one of the main risks that the use of this technology can entail," says Camilo Gutiérrez Amaya, head of the ESET Latin America Research Lab.
ESET discusses the examples of Windows Recall and Adobe's new usage policies, on how they are managing data privacy, the risks these changes entail, and the importance of clear and transparent communication to maintain user trust and ensure legal compliance:
Windows Recall: Computers with PC Copilot+ will have a function called Recall that would allow you to find and remember everything seen and done on the PC as if it were a timeline of the content that can be accessed when needed. Recall, then, records everything that is done in applications, communications and meetings, remembers all the web pages that have been visited, all the books or articles read. It also takes screenshots to be able to more easily identify the content you want to have.
That's why many users have been concerned about how far AI can be used to invade privacy and whether that information is sent to the cloud. Although Microsoft assures that everything stays on the same PC, stored locally and that the data for this function is properly encrypted. Based on the criticism it had received before its launch - since in principle it was not going to be able to be deactivated - Microsoft launched Recall with the possibility of deactivating it, or customizing it and controlling which websites or applications can exclude, delete content or even totally disable screen capture to disable the collection of information.
Microsoft's official documentation states that the "Snapshot Storage: Content Remains Local" option.
However, ESET identified that by enabling new features to an operating system that involve user privacy and facilitate access, this brings with it new doors that can be exploited by cybercriminals.
For example, prior to the official launch of PC Copilot+, a cybersecurity enthusiast demonstrated that this feature stores screenshots in an unencrypted database, everything is in plain text and can be extracted in a very simple way with a tool called TotalRecall.
It finds the Recall database, copies the screenshots taken and the database to an extraction folder, analyzes the databases for user-specified data (e.g., passwords, search terms, credit card information, etc.), and then delivers a summary that includes that data in a matter of seconds.
"A cybercriminal could obtain an enormous amount of valuable information about their victim, including their emails, personal conversations, and any information captured by Recall. It is important to mention that Recall's main database is stored in the PC's system directory and administrator permissions are needed to access it, however, an attacker can use different techniques to elevate privileges, which makes data exfiltration theoretically possible," adds the ESET Latin America researcher.
Adobe and its new user policy: Adobe has had an evolution and great adoption by the public and private sectors. That is why it is relevant to have clear language for all types of areas, since when issuing new policies, it can be misinterpreted and generate dissatisfaction on the part of users.
Adobe introduced a new usage policy in February 2024 that stated that, in order to continue using its products, users were required to accept it, something that caused disagreement and concern for the community.
Before this situation, the director of the Substance 3D product came out to explain that no project from its users would be accessed or read, adding that it would not make sense to do so since all companies in the industry would leave them immediately if it were the case and Adobe indicated that it is subject to the General Data Protection Regulation (GDPR) of the European Parliament.
Another circumstance that generated dissatisfaction among users prior to its update on June 18 of this year, was in section "C", where Adobe Creative Cloud required access to the user's content to be able to analyze it and train its machine learning algorithms (Firefly Gen AI), in order to improve its services. Realizing these facts, Adobe had to update and incorporate summaries with more detailed information and the reason for which the data would be accessed.
The "Privacy" section in section 2.2 "Our access to your content" by Adobe makes it clearer that you own your content, but that you need to access it as necessary for the proper functioning of its applications and services.
For ESET, features will always give added value to manufacturers or developers but should come with usage terms and policies that use clear language, rather than ambiguous or overly legalistic. In this way they can ensure:
Accessibility and understanding: Clear and direct language allows a wider audience to easily understand conditions and new features, increasing transparency and accessibility of information.
User trust: Clarity in communication reduces the perception of which manufacturers or developers are trying to hide something or unnecessarily complicate terms.
Conflict Reduction: Clear terms and conditions help prevent misunderstandings. If users fully understand what they are agreeing to, legal conflicts are less likely to arise and the need for legal interventions is reduced.
"When new functions or features are explained in a simple way, users can adopt and use them more effectively. A clear understanding of how new features work can improve the user experience and increase satisfaction. Transparency and clarity in communication contribute positively to the image of manufacturers or developers. For both cases, those that strive to be clear and direct in their communication are seen as more honest and responsible in the treatment of their users' data," concludes Gutiérrez Amaya of ESET.
Leave your comment