Hacker News Reader

Comment by nkrisc | Hacker News Reader

Help me out here: where is this notion that anyone will be able to buy personally identifiable browsing data coming from? Isn't it likely to be (more) aggregated or partially anonymized data about browsing behavior and habits? I'm upset by this bill, but I've yet to find any information to suggest you could ring up AT&T and request to buy a specific person's data.

View on HN

The plan seems to be to use geolocation data and ip addresses to reasonably identify individuals from within the data.

"Once the law is signed by President Trump, geolocation data along with browsing history data will again be on the market for ISPs. That means a company with dedication and resources could likely, with a reasonable degree of certainty, pinpoint Blackburn, Pai, Ryan, or anyone they seek to take down based on their browsing data and IP address alone."

http://www.thedailybeast.com/articles/2017/03/29/this-politi...

> "Once the law is signed by President Trump, geolocation data along with browsing history data will again be on the market for ISPs."

The law repeals protections that are not in place yet. Those protections were already removed last year.

Because there is no such thing as anonymity on the internet, especially if you're able to buy browsing history.

AOL released a slew of anonymous search results in the early 2000s as a dataset. It took a few weeks (months maybe?) to start to determine who these people were based on patterns found in the data.[1]

Even with aggregate or partially anonymized data you're going to be able to identify individuals based on habits and patterns.

1: https://en.wikipedia.org/wiki/AOL_search_data_leak

I recall a similar situation with New York taxi trip data.

Have you noticed how large companies often do a poor job on security and tons of personally identifying information gets stolen? Or how data that is supposed to be anonymised isn't, very?

That's true, but hasn't that always been a risk? No doubt they've been keeping all this data already. It's a risk, but not a new one because of this change.

When data is the subject of frequent transactions then the opportunities for malfeasance rise.

If the data is being collected, organized, and distributed to be sold, yes there iwill be a higher chance it will be hacked. After being sold, there is a chance it will be hacked from the buyer. And even if it isn't hacked, there will absolutely be people (buyers) that will do what they can to de-anonymize it

Great point, I hadn't considered that. Of course it was only recently we learned of the Netprospex leak which was likely this very scenario.

I would question the idea that AT&T or whomever will simply sell you the copyright or an unrestricted global license. I would assume that all these sorts of databases require you to sign a license mandating you to keep the data (anonymized or otherwise) secret/private, precisely to prevent this sort of shenanigans. To OP: good luck, but I suggest reserving the bulk of donations for legal fees...

>where is this notion that anyone will be able to buy personally identifiable browsing data coming from? Isn't it likely to be (more) aggregated or partially anonymized data about browsing behavior and habits?

I guess that depends on whether you think these companies care or do not care about the actual users.

I know which way I lean...

I certainly do not think they care. I would also love to see those who voted for this affected by it, if it's possible. But that's what I'm asking, what would be the means for this to happen?

Reply on news.ycombinator.com