June 26, 2019 By Email: media.help@apple.com & First Class Mail Katherine Adams Senior Vice President and General Counsel Philip W. Schiller Senior Vice President, Worldwide Marketing Matt Fischer Vice President, App Store Apple Inc. One Apple Park Way Cupertino, California 95014 Re: Removal of Political Social Media LLC’s Apps from the App Store Dear Ms. Adams, Mr. Schiller, Mr. Fischer: Campaign for Accountability (“CfA”), a nonprofit watchdog organization, respectfully requests that Apple remove all apps developed by Political Social Media LLC from the App Store. Political Social Media operates the brands, uCampaign, LLC and Jarbik, LLC, among others, which operate approximately 13 apps that appear to be violating the App Store Review Guidelines. Background Political Social Media LLC was incorporated in Delaware on January 31, 2014. 1 The company employs several brand names including uCampaign and Jarbik. 2 Through these brands, the company operates several apps available for download in the App Store.3 These apps appear to be violating the App Store Review Guidelines by misusing users’ personal information, building 1 Political Social Media LLC, Entity Details, Delaware Department of State, Division of Corporations, accessed at https://icis.corp.delaware.gov/Ecorp/EntitySearch/NameSearch.aspx. 2 Laura Silver, The Apps For Ireland's Anti-Abortion Campaigns Allow User Data To Be Shared With The NRA, BuzzFeed, May 22,2018, available at https://www.buzzfeed.com/laurasilver/ireland-anti-abortion-campaigns-appsprivacy-nra. 3 https://itunes.apple.com/us/app/ucampaign/id920668377?mt=8#see-all/more-by-this-developer; https://itunes.apple.com/us/developer/jarbik-llc/id1232401366. 611 Pennsylvania Ave., S.E. #337  Washington, D.C. 20003  (202) 780-5750 campaignforaccountability.org Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 2 identical apps based on a template, and requiring users to sign in and share their contacts with the company.4 The apps operated by Political Social Media are targeted at political conservatives. 5 For instance, through the uCampaign brand, the company runs the official app for the pro-gun organization, the National Rifle Association (“NRA”), and anti-abortion groups, Susan B. Anthony List (“SBA List”) and Family Research Council (“FRC”).6 The company also operates the official app for President Trump’s campaign committee and the app for the Great America PAC, a super PAC that supports President Trump.7 Additionally, uCampaign runs an app for the Conservative Party of Canada and the Australian Christian Lobby. 8 Jarbik runs an app for the Generation Atomic, an advocacy organization that supports nuclear energy, and has managed apps for several international political movements, including a nationalist party in Malta and an anti-abortion group in Ireland. 9 Political Social Media’s apps for each of these organizations are virtually identical. 10 The company sets up a boilerplate social media platform that is branded for each of its client organizations.11 The apps draw in supporters of those organizations who use them to chat with each other and post comments on in-app newsfeeds. The apps also offer games and challenges for users to play and receive rewards. 12 The app descriptions suggest users can use the apps to stay up to date on the latest news about each client organization or candidate. 13 The apps generate value for sponsoring organizations by leveraging the contacts of their users.14 Political Social Media prods users to turn over their address books and other identifying information to the app developers upon signing up.15 The company then encourages users to send messages to everyone in their address books, which benefits the sponsors. 16 Even if users do not 4 https://developer.apple.com/app-store/review/guidelines/. https://itunes.apple.com/us/app/ucampaign/id920668377?mt=8#see-all/more-by-this-developer. 6 https://itunes.apple.com/us/app/nra-ila/id1110581701?mt=8; https://itunes.apple.com/us/app/lifeimpact/id1275319079?mt=8; https://itunes.apple.com/us/app/stand-firm/id1377187936. 7 https://itunes.apple.com/us/app/america-first/id1135325440?mt=8; https://itunes.apple.com/us/app/greatamerica/id1191599692?mt=8. 8 https://itunes.apple.com/us/app/cpc-app/id1302432862?mt=8; https://apps.apple.com/us/app/australian-christianlobby/id1155648847. 9 https://apps.apple.com/us/app/atomic-action/id1206164857; Silver, BuzzFeed, May 22, 2018; https://web.archive.org/web/20180528161251/https://itunes.apple.com/us/app/pn-malta/id1232401367?mt=8; https://web.archive.org/web/20180528161308/https://itunes.apple.com/us/developer/jarbik-llc/id1232401366. 10 Emma Hinchliffe, A Four-person Company is Behind the Apps of Donald Trump, the NRA and Other Conservative Groups, Mashable, October 7, 2016, available at https://mashable.com/2016/10/07/ucampaign-conservative-apps/. 11 Silver, BuzzFeed, May 22, 2018. 12 https://itunes.apple.com/us/app/ucampaign/id920668377?mt=8#see-all/more-by-this-developer. 13 Id. 14 James Vincent, Ted Cruz's app turns handing over your friends' contact info into a game, The Verge, November 11, 2015, available at https://www.theverge.com/2015/11/11/9711364/ted-cruz-campaign-app-gamification. 15 The NRA app, for instance, asks users to share their location when they register. 16 Natasha Singer and Nicholas Confessore, Republicans Find a Facebook Workaround: Their Own Apps, The New York Times, October 20, 2018, available at https://www.nytimes.com/2018/10/20/technology/politics-appsconservative-republican.html. 5 Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 3 turn over their address books when they register, the apps regularly incentivize users to share their contacts. The NRA app, for instance, requires users to obtain 250 action points in order to post a comment on the platform. Users can obtain points by sharing the app with their friends or allowing the app to track their location, among other methods. BuzzFeed reported in May 2018 that some of the Political Social Media’s apps required users to turn over their contact information in order access the apps’ main features.17 Political Social Media founder Thomas Peters explained the app’s method in a blog post discussing how his company helped Sen. Ted Cruz (R-TX) win the 2016 Iowa caucuses: As a phone app it has authorized access to a supporter’s phone address book contacts. That allows it to match those contacts to Cruz’s voter universes and prompt existing supporters to reach out personally to identified potential supporters. To date the feature has matched over a third of a million potential supporters who are contacts of one or more of the app’s current supporters. The second source of data are self, individual friend and neighborhood surveys. App supporters have completed over 20,000 political ID surveys about themselves, their friends and their neighbors, generating valuable cross-section data on the supporters’ political views, activism affinities and personal network, essential information for a modern, data-driven campaign. 18 (emphasis in original) Political Social Media uses this information to send political messages to the friends and family of an app’s users.19 uCampaign boasted about the success of this model in a description of its apps on the NationBuilder website: We follow the 80/20 rule - take your top 20% of supporters who will perform 80% of the actions and give them a smartphone app that allows them to do 10X more than what they would do on a website, while creating valuable data which is automatically synced to your Nation. Our platform allows you to manage your app once we have collaborated to build and launch it. We offer advanced features such as matching your supporters’ phone address book contacts to voter files and big data as well as crowdsourcing grassroots activities like text messaging and fundraising to your supporters. Match your supporters to their state and federal elected officials using geolocation to make lobbying seamless. Our clients include local, state, federal, presidential, international, advocacy and referendums.20 (emphasis added) 17 See Silver, BuzzFeed, May 22, 2018. Thomas Peters, We Are the Stealth Startup that Helped Ted Cruz Win Iowa, Medium, February 4, 2016, available at https://medium.com/@uCampaignCEO/meet-the-stealth-startup-that-helped-ted-cruz-win-iowa-fea6745b8a6d. 19 Singer and Confessore, The New York Times, Oct. 20, 2018. 20 https://nationbuilder.com/ucampaignupdate. 18 Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 4 The Nationbuilder description also reveals the scale of the privacy problem: for every person that downloads the app, the app can identify 34 possible supporters of an organization. 21 Misusing Personal Information While Political Social Media has received glowing media profiles for ingeniously leveraging users’ contact data, the company’s political activities have been scrutinized by government investigators.22 For instance, in 2016 uCampaign developed an app for the Vote Leave campaign, which advocated for Great Britain to leave the European Union. 23 A parliamentary committee tasked with investigating the campaign specifically cited the “data privacy concerns raised” by uCampaign’s app.24 Additionally, Political Social Media drew widespread criticism for misusing its users’ data during the 2016 presidential election. For instance, NBC News reported: Immediately after installation, the app requests access to users’ address books; app creator Thomas Peters, CEO of uCampaign, said this is to help users share the app with their friends. But the app’s privacy policy says the campaign can use that data — the names, emails, home addresses and more stored in a user’s address book — however they’d like. “Trump’s [app] is at a whole other level,” explained the American Civil Liberties’ Nicole Ozer. “It’s not just to pay with your privacy, but to sell out your friends and colleagues who are in your contact list.”25 Indeed, Business Insider reported in November 2016: If users download the app and agree to share their address books, including phone numbers and emails, the app then shoots the data [sic] a third-party vendor, which looks for matches to existing voter file information that could give clues as to what may motivate that specific voter. Thomas Peters, whose company uCampaign created Trump's app, said the app is "going absolutely granular," and will — with 21 Id. Hinchliffe, Mashable, Oct. 7, 2016. . 23 Mark Scott, Politicians Follow in Facebook’s Footsteps on Mass Data Collection, Politico, April 8, 2018, available at https://www.politico.eu/article/facebook-cambridge-analytica-data-protection-privacy-brexit-trump-vote-leaveucampaign/. 24 Disinformation and ‘Fake News’: Interim Report, Digital, Culture, Media, and Sport Committee, United Kingdom House of Commons, July 29, 2018, Chapter 3, available at https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/363/36306.htm. 25 Jane C. Timm, Trump’s New App Wants You – And Your Data, NBC News, August 31, 2016, available at https://www.nbcnews.com/politics/2016-election/trump-s-new-app-wants-you-your-data-n640236. 22 Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 5 permission — send different, A/B tested messages to users' contacts based on existing information.26 Alarmingly, though, a 2018 version of the company’s privacy policy stated that the company “may share your personal information with other organizations, groups, causes, campaigns, political organizations, and our clients that we believe have similar viewpoints, principles or objectives as us.”27 As BuzzFeed reported: This means data can be shared…with previous clients such as the NRA, the Trump presidential campaign, the Republican National Committee, and the Susan B. Anthony List, a major US anti-abortion group. In the UK, the network includes the Conservative Party and main pro-Brexit campaign, Vote Leave. 28 Political Social Media’s Privacy Policies Political Social Media’s apps can access users' precise location, camera, calendars, and contacts if users give them permission.29 Of the 13 apps currently available for download from Political Social Media, 11 of them, including the apps for the NRA, the SBA List, and FRC, have identical privacy policies. Notably, the privacy policies are not found on the websites of the sponsoring organizations themselves. Instead, using the App Store, all of these apps link to privacy policies on websites operated by Jarbik, uCampaign, or RumbleUp, another brand that belongs to Political Social Media.30 The policy – common to all Political Social Media brands -- provides: As noted above, we share your Personal Information with the uCampaign client that administers the Client Application that you use. Except as otherwise set forth in this Privacy Policy, we do not share your information with other third parties, nor do we share information between uCampaign clients. 31 This policy gives the company wide latitude to share personal information of its users: We may, with your permission, collect third party contact information (including, without limitation, names, telephone numbers, emails and social media handles, if available) from your mobile address book. We may receive Personal Information about you from other users of the Platform. This may happen if they connect their address books to our services, or if they invite 26 Maxwell Tani, Donald Trump’s Campaign is Using the Same Ap[p the ‘Leave’ Campaign Used During Brexit to Spur Voter Turnout, Business Insider, November 7, 2016, available at https://www.businessinsider.com/donaldtrumps-phone-app-brexit-2016-11. 27 Silver, BuzzFeed, May 22, 2018. 28 Id. 29 https://reports.exodus-privacy.eu.org/en/reports/29364/. 30 The following apps provide their own privacy policies: Atomic Action, Australian Conservatives, Diabetes Patient Advocacy Coalition, and the Great America PAC. 31 http://letsw.in/privacy.html. Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 6 you to use our services via the Platform. Additionally, we may also receive Personal Information about you from the uCampaign client administering the Client Application. If you have received a text message through our services, your information was uploaded to the Platform through the uCampaign client that contacted you. We will treat all such Personal Information in accordance with this privacy policy. We may share your Personal Information with other entities affiliated with us for internal reasons, primarily for business and operational purposes. uCampaign, or any of its assets, including the Platform, may be sold, or other transactions may occur in which your Personal Information is one of the business assets of the transaction. In such case, your Personal Information may be transferred. 32 (emphasis added) The privacy policy for Political Social Media’s apps allow the developer to collect the personal information of individuals who received text messages from an app’s users, even if the recipient did not download one of the company’s apps. Political Social Media does not provide message recipients with an opportunity to consent to this data collection. While the company has removed the alarming language that BuzzFeed highlighted, the current policy still allows the company to share users’ information with anyone “affiliated with us.” Presumably, the company can rely on this policy to share users’ data with any of the clients that use its apps. The policy further states: Information about your use of the Platform as an end-user will also be available to the uCampaign client that is administering the Client Application. For more information about this uCampaign client’s privacy practices, please refer to the client’s privacy policy.33 This instruction, however, is nearly impossible. For instance, 11 of Political Social Media’s apps, including SBA List’s app and FRC’s app, do not provide any link to the client’s privacy policy. Furthermore, the SBA List’s own website does not include a link to its privacy policy.34 The only way to find the SBA List’s privacy policy is to use an outside search engine. And even then, the privacy policy only covers the organization’s website. 35 It does not mention anything about the app operated by Political Social Media. 32 Id. https://ucampaignapp.com/privacy.html. 34 https://www.sba-list.org/about-susan-b-anthony-list. 35 https://www.sba-list.org/privacy-policy. 33 Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 7 App Store Review Guidelines Privacy The App Store Review Guidelines state that apps must: Confirm that any third party with whom an app shares user data (in compliance with these Guidelines) — such as analytics tools, advertising networks and third party SDKs, as well as any parent, subsidiary or other related entities that will have access to user data — will provide the same or equal protection of user data as stated in the app’s privacy policy and required by these Guidelines. 36 For users of Political Social Media’s apps, it is impossible to know if the company is adhering to this requirement. Most of the apps managed by Political Social Media do not include links to privacy policies for the organizations that have hired the company. As noted above, there is no way to find the privacy policy for the SBA list or FRC from their “official” apps. Additionally, Political Social Media’s privacy policies state: You have the right to access your Personal Information held by us and, if necessary, have it amended or deleted. You can also request not to receive email communications and/or other marketing information from us. 37 For most of the apps, though, the only contact information listed is for uCampaign or Jarbik. The privacy policies generally do not provide contact information for the client organizations that are the beneficiaries of the apps and presumably store the users’ information. Based on these template apps and generic privacy policies, users cannot have confidence that their data will be deleted by all of the parties that obtain their personal information. 38 Additionally, the App Store Review Guidelines state: Do not use information from Contacts, Photos, or other APIs that access user data to build a contact database for your own use or for sale/distribution to third parties, and don’t collect information about which other apps are installed on a user’s device for the purposes of analytics or advertising/marketing. Do not contact people using information collected via a user’s Contacts or Photos, except at the explicit initiative of that user on an individualized basis; do not include a Select All option or default the selection of all contacts. You must provide the user with a clear description of how the message will appear to the recipient before sending it (e.g. What will the message say? Who will appear to be the sender?). 39 36 https://developer.apple.com/app-store/review/guidelines/. https://ucampaignapp.com/privacy.html. 38 Id.; https://jarbik.com/privacy.html. 39 https://developer.apple.com/app-store/review/guidelines/ 37 Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 8 Yet it is exactly such prohibited activities that drive Political Social Media’s entire operation. 40 Political Social Media has stated publicly that the purpose of its apps is to collect contact information from its users in order to deliver messages from its clients to their contacts at scale. 41 Political Social Media’s activities, therefore, are a prima facie violation of the App Store Review Guidelines. Template Apps The App Store Review Guidelines also prohibit Political Social Media’s template model. The guidelines state: Apps created from a commercialized template or app generation service will be rejected unless they are submitted directly by the provider of the app’s content. These services should not submit apps on behalf of their clients and should offer tools that let their clients create customized, innovative apps that provide unique customer experiences. Another acceptable option for template providers is to create a single binary to host all client content in an aggregated or “picker” model, for example as a restaurant finder app with separate customized entries or pages for each client restaurant, or as an event app with separate entries for each client event.42 Nevertheless, Political Social Media provides nearly identical template apps for each of its clients. Political Social Media’s contravention of Apple policy has been noted previously. TechCrunch reported that the company’s apps likely would be ensnared by the guidelines and removed from the App Store.43 Unfortunately, Apple has yet to remove Political Social Media’s apps despite their clear violation of this policy. The fact that the official apps for two controversial advocacy organizations, FRC and SBA List, are nearly identical and operated by Political Social Media highlights the problem with failing to implement this rule. App Sign In Additionally, the apps operated by Political Social Media appear to violate the account sign-in provisions of the App Store Review Guidelines. Specifically, the guidelines state: Account Sign-In: If your app doesn’t include significant account-based features, let people use it without a log-in. Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law. If your core app functionality is not related to a specific social network (e.g. Facebook, WeChat, Weibo, Twitter, etc.), you must provide 40 Hinchliffe, Mashable, Oct. 7, 2016. https://nationbuilder.com/ucampaignupdate. 42 https://developer.apple.com/app-store/review/guidelines/. 43 Sarah Perez, Apple’s Widened Ban on Templated Apps is Wiping Small Business from the App Store, TechCrunch, December 8, 2017, available at https://techcrunch.com/2017/12/08/apples-widened-ban-on-templated-apps-iswiping-small-businesses-from-the-app-store/. 41 Ms. Adams, Mr. Schiller, and Mr. Fischer June 26, 2019 Page 9 access without a login or via another mechanism. Pulling basic profile information, sharing to the social network, or inviting friends to use the app are not considered core app functionality. The app must also include a mechanism to revoke social network credentials and disable data access between the app and social network from within the app. An app may not store credentials or tokens to social networks off of the device and may only use such credentials or tokens to directly connect to the social network from the app itself while the app is in use. 44 Not only do Political Social Media’s apps require users to sign in to have any access to the apps’ features, the apps’ business purpose is to generate content for its users to distribute to their contacts outside the app.45 Essentially the guidelines state that Political Social Media’s strategy for disseminating political messages is “not considered core app functionality” and, therefore, is prohibited. Conclusion Previously, Apple has revoked access to apps that violate the company’s rules. Yet here, Apple has failed to act despite clear evidence that Political Social Media has been violating several provisions of the App Store Review Guidelines. Further, beyond simply violating the rules, Political Social Media’s apps have been investigated by United Kingdom government regulators and criticized by privacy advocates. Moreover, these apps are contributing to the rancorous political discourse in America and around the world. At a time when democracies are struggling to cope with and confront the ever-increasing onslaught of misleading information filtered through social media, Apple should remove these apps from the App Store to ensure users have access to rule-abiding apps that share legitimate information. Sincerely, Daniel E. Stevens Executive Director Alice C.C. Huling Counsel 44 45 https://developer.apple.com/app-store/review/guidelines/. Singer and Confessore, The New York Times, Oct. 20, 2018.