Hacker News Reader

Comment by turc1656 | Hacker News Reader

I'm sick and tired of hearing about fines for clearly criminal activity. This is most likely a felony issue at hand, here. The executives who green-lighted this activity should be held accountable and charged accordingly. That's the only thing people understand. That, or ruinous fines. Not a paltry $2.2M for a company with revenues of $3.1B - that's less than 0.1%!!! That's a rounding error to them. $10,000 per occurrence for the company would be much better, and jail for the executive(s) who are responsible, and then this crap might actually stop.

View on HN

With that in mind, I like what the EU seems to be doing with GDPR[0]. For failing to properly manage user data, you can end up with fines like:

- a fine up to 10,000,000 EUR or up to 2% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater

- a fine up to 20,000,000 EUR or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater

...which, considering the stuff companies have been pulling off rencently, seems quite OK. A 10M EUR minimum might, hopefully, at least scare off some of the small "innovators" in the area of surveillance economy. As for big corporations, I doubt anything but jail time for executives will work though.

[0] - https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

I like this law. Now the real question - is it actually enforced? Because it's meaningless otherwise.

In most cases we don't need new laws, we just need the existing ones to be enforced. Like all these "bullying" laws. I never understood why we needed them when we already have plenty of harassment laws on the books. Enforce those and problem solved.

> I like this law. Now the real question - is it actually enforced? Because it's meaningless otherwise.

Right, yeah, see regulators don't want a court challenge. They could find their whole charter declared unconstitutional. Not as punishment, but simply because nobody ever challenged it.

They try to strike a balance between going to court and enforcing the will of the people/legislators/regulations. If it seems akin to a traffic ticket, well thats because traffic cops are doing the same thing

Regulators and civil society groups have taken the GDPR's predecessor (the Data Protection Directive) to court plenty of times, usually very successfully. The most famous regulator-brought court case is probably the Google Spain/Costeja "right to be forgotten" ruling of the Court of Justice of the EU (CJEU).

59 more CJEU Data Protection Directive cases here: http://curia.europa.eu/juris/liste.jsf?pro=&nat=or&oqp=&date...

The European Union is a new entity and is still forming its case law. Its courts are granting themselves more power and it is probably a few years until their own Marbury v. Madison equivalent. For now its just seeing what sticks and learning the whims of the judges, but you have to recognize the relativity of their authority.

It's not in force yet, but will be from May 2018. Then, like its predecessor the Data Protection Directive, it'll be enforced by over >30 regulators EEA-wide, with a brand new "consistency" mechanism to help multiple national regulators from different countries agree what to do about complaints that involve each one's country (though the defendant will in theory only need to deal directly with the authority of the country where the company has its main establishment; that lead authority will funnel questions etc. from all the others. Note that the existing Data Protection Directive is very actively enforced. Here's the UK's track record (and bear in mind the UK isn't one of the meanest): https://ico.org.uk/action-weve-taken/enforcement/

I hear you on that point and broadly agree that the penalties can be too trivial to cause deterrence (though VW's steep fines and criminal charges signal change).

However in this case, who doesn't assume that everything we do is tracked for optimization? Every recommended product, story, TV show, news feed article, whatever comes from boatloads of testing.

And it doesn't seem like people care. Although some bemoan Facebook and Google data tracking, almost everyone still uses the products.

> who doesn't assume that everything we do is tracked for optimization

This kind of acquiescence is dangerous. What you're essentially saying is "why bother enforcing the laws, nobody follows them" which is a terrible moral position if the laws are just.

People still use them because there are often significant consequences to not using them. Not using Facebook can often mean some level of social ostracism, missing out on important moments from family and friends. Not using Google means not being able to collaborate with people using Docs, not watching videos your friends send you, and so on. They're almost like public utilities, and saying "you use Facebook so you must not actually care about privacy" is like saying "you rely on the police, so you most not actually care about cases of police brutality."

> They're almost like public utilities, and saying "you use Facebook so you must not actually care about privacy" is like saying "you rely on the police, so you most not actually care about cases of police brutality."

While I agree that they are like public utilities in many ways, I think your analogy is grossly flawed. For Facebook and Google to do what we want them to, they have no choice but to constantly invade our privacy. The very features we desire most from them are directly related to and tied to our personal information. By contrast, a police department absolutely does not require a single officer to commit violent crimes in order for them to keep the peace, arrest criminals, and protect the public.

>They're almost like public utilities, and saying "you use Facebook so you must not actually care about privacy" is like saying "you rely on the police, so you most not actually care about cases of police brutality."

False equivalence. Facebook is NOT a public utility, despite your assertion. The police are. The police are paid for by your taxes (plus traffic fines...), and are part of your local government. You can vote for your local governmental leaders, who have control over the local police. Facebook is a private corporation with voluntary membership. It is not part of government, you have no say over it whatsoever aside from "voting with your feet", and you can't even compare it to actual public utilities like your local CableCo that you probably get your internet service from, or the cellular provider you get your phone and mobile data service from. It's not a utility, so it's not subject to any real regulation the way that utilities are in theory. It's entirely an optional, voluntary service.

So a better analogy is "'you use Facebook so you must not actually care about privacy' is like saying 'you drive a giant jacked-up pickup truck with gigantic wheels and commute 100 miles/day in it, so you must not actually care about the environment', or, "...'you participate in illegal dog-fighting and cock-fighting activities, so you must not actually care about animal rights and welfare'".

Facebook is not a utility, it's not a necessary service at all. You have the choice to use it, or not, just like you have the choice to subscribe to cable TV, Netflix, Hulu, etc. or to use other web services like YouTube, Gmail, Yahoo! Mail, AOL, or MySpace. (There's actually people who still use those last 3!) If your social circle has a problem with you not using AOL and MySpace and Yahoo! Mail, then maybe you need some better friends. Same goes for Facebook.

This is the same line of thinking that is allowing the NSA to get away with mass surveillance programs and not having every single employee (or at least the high ranking ones) locked up for decades for what are obvious rights violations on a mass scale.

Case in point - you choose to do business with your cell phone provider. The general assumption is that they inherently know your location to provide you service (through triangulation and general connectivity to their cell towers). The government took that and then asserted a random claim saying they had a right to that information. That's literally what the federal judge said - that the government had a right to that private data agreement between you and your cell provider, without a warrant. So our privacy was stolen from us and when it finally came out what they were really doing and the scope of it all, people were shocked but half accepted it as the cost of doing business in the digital age. That's a lazy argument because the constitution expressly forbids such activity - "search and seizure", with seizure being the operative word here. Then they expanded this claim to include email and all private, non-public communications on social media as well.

NSA and the likes rely on the judicial precedent effect, and the generational effect.

I am 36. When I talk to people between 20 and 25 I am shocked to find out they find the whole spying thing pretty normal. They are kind of born into a world where this is already the norm. And we know that most people never challenge the rules of the environment they were born into, not until they turn at least 30 (more often 35-40 IMO) anyway.

Between their claim of "well, things have always been that way" (since they're too young to remember other times) and "I have nothing to hide so I don't care", I'd say NSA and Co. are winning crushingly.

What a powerful point. Thanks for making it -- you've shifted my perspective.

If you're sarcastic -- damn you're good!

If you're not sarcastic -- you're welcome.

haha it was legit.

Yes, you are absolutely right about this. And it's a sad situation.

Which is why it is up to us (the 30+ old timers, lol) to take a stand and demand our rights and the law be respected. Throughout the history of this country, people have fought and died to protect our freedoms. For this, we don't even need a physical fight. We just need to collectively take a stand to demand that the rule of law means something, or that they need to take the proper course of action and amend the constitution so that what they are doing is legal. I refuse to accept this middle ground where they violate the law and aren't shut down and prosecuted even when it's discovered.

That's a powerful motivation and I fully stand behind it -- in theory anyway.

But what about in practice? How do we fight exactly? NSA has shown time and again they don't care about ethics or even the law. Hell, they are well-connected enough to make the secret courts legal! You can receive a very particular phone call and/or email right now, and you can spend the rest of your life in a jail if you uttered a word about it.

Large organizations that suck data en masse will change something ONLY if they cannot suck data en masse anymore, it's as simple as that. For that, we need mass education which actually works -- and people who actually care. History is not on our side for now. Most people prefer the short-term dopamine brain injection provided by the current infrastructure and they won't lift a finger to change anything.

I am playing the Devil's Advocate here but it also reflects my beliefs. If I was born f.ex. in 1960 I'd probably be able to join the fight as it was starting. Nowadays the fight seem to be over and we seem to have lost.

As a person born in 1980 and being way too busy to fight for survival and decent human existence well until only 4-5 years ago, I feel I am arriving at the scene way too late.

Only in America is locking people up the solution to all life's problems.

No, but it is definitely a solid solution to criminal problems, which is exactly what this is. These are most certainly criminal acts. Why should I not expect criminal activity to be charged as such?

Most criminal activity is done for profit, and that's certainly the case here. For-profit crimes have two solutions. You either make them unprofitable by fining the offender(s) more than they are making from the illegal activity or you give them a free, extended stay at the Gray Bar Motel, courtesy of the US taxpayer. I am more than happy to help foot that bill if necessary.

I'm unclear on something - you've said that these are "clearly" criminal acts. What would the charge be?

How about fraud? Why is tricking someone to give you a password and using it enough to go to jail, but recording everything someone watches without their permission and selling to 3rd parties not?

There are a number of laws relating to "unauthorized access" of private, digital information. This would seem to fall squarely inside of those, at least in my opinion. Those seem like the low-hanging fruit.

Going out a bit further, you could make a case for fraud or even hacking. Fraud because they are clearly misrepresenting the product and what it does. Hacking because they slipped in an OS update for older TV's that allowed them to have this feature on models that they never intended to have it on.

Also, they admitted to selling this information to advertisers. That's redistributing information they were not legally allowed to have. There are laws regarding profiting from crimes. But even if you leave those out, there is the issue of them selling information they didn't legally own. That could also come with a copyright violation if a lawyer for a class action suit was able to successfully argue that the owners of the televisions owned that information that they stole without permission. That seems like a tough win, though.

So I think unauthorized access, fraud, and the sale of illegally obtained information would be fair charges to apply.

Some additional information, direct from the FTC:

"The complaint alleges that Vizio engaged in unfair trade practices that violated the FTC Act and were unconscionable under New Jersey law." https://www.ftc.gov/news-events/blogs/business-blog/2017/02/...

The FTC act is long-standing federal law and NJ apparently has its own strong laws for this kind of activity. The FTC itself states that there are clear violations of at least these laws, at bare minimum.

Ah, but Corporate officers are immune to prosecution, and simply pay a (small) fine (consider it an indulgence). The Corporate veil uber-alles!

Reply on news.ycombinator.com