Hacker News Reader

Comment by jsmthrowaway | Hacker News Reader

It's completely different, so far different as to be antonyms, opposites, completely diametrically opposed ends, because you just described a passive, orthogonal, ethical activity while Uber actively fooled with Lyft's systems to get the intel they wanted (emphasis mine):

> Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider.

You literally just typed the equivalent of "what's wrong with using an ad unit to deliver a zero day exploit? It's not much different from advertising."

View on HN

It's not an exploit. There was no privilege escalation, denial of service, theft of private data, or anything like that. You can take the technology involved and replace it with a human process: multiple people around the city open the app and report back to the HQ the locations they see. Now, would you say this process is illegal?

Simplifying it even more: If you had people on the street, looking for cars with a Lyft sticker and reporting back every one you see - would you say that is illegal?

> Simplifying it even more: If you had people on the street, looking for cars with a Lyft sticker and reporting back every one you see - would you say that is illegal?

Yes, because trying to "hack" the legal system by finding things that you can argue are "technically legal" is not something that impresses me.

I get that beating someone up and throwing a paying customer off a plane, or using a firehose on civil rights marchers, is "legal" if some judge can be persuaded ($$$) to agree, but I'm not going to play that game: I don't want to live someplace where we do what is legal and don't do what is illegal; I want my neighbors to know right from wrong.

A Reasonable Person would think that Uber was doing this to wrong Lyft and indeed it turns out, was doing this to wrong Lyft.

Don't get me wrong. I think they're total assholes and shouldn't be doing this even if it is legal. But at the same time I'm interested in what would happen in case of an actual lawsuit. These don't care what impresses us :-(

Also, discussing what changes on Lyft's side would make it definitely illegal is interesting if you ever have some personal data in your own service.

The thing is, it would likely be a civil tort case, not necessarily a criminal case. An action can be legal from a criminal statute point of view, and yet still open the company up to a lawsuit in civil court where the other party can try to prove they were harmed.

Not sure about this in the US, but I'm pretty sure that in the UK, gathering a database of intelligence on competitors' staff earnings would be a violation of the Data Protection Act.

It would be interesting if this came to a trial. DPA protects only information that identifies people. If Uber collected information on cars instead which is anonymous and then correlated it with data it already has access to, so it only deanonymises its drivers, that's... I don't know.

IANAL, but I read the DPA a few times and I think it's an edge case. If someone has better idea, I'd love to hear it.

The Data Prrotection Act specifically covers this:

"* “personal data” means data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller"

Sorry, but they already thought of that one.

I believe it would need to be personally identifiable data. The fact that Uber can personally identify someone with location is unique to them and falls into this gray area.

I have decided that location data is PII. It is notoriously hard to anonymize. I have conducted some experiments with customers and even with a a relatively few samples it was possibl to merge address databases and "anonymous" location with ease. Right now there is a data classification fiction in most corporations that location days is not PII because it lets them do all sorts of analytics. I predict this fiction is going to get so excited organization in trouble and not just an Uber being so blatant about it.

All of which /u/stass would have know had there been an ethics class for them to take. ;)

There isn't the one and only standard for ethics. Perhaps a class would teach a certain version of ethics, but not a universally applicable one. As a somewhat relevant example, a lot of ethical norms in USSR (prosecution of successful individuals, outlawing free speech, destroying dissent, banning "unethical" literature and works of art) would be considered completely unethical in the Western society and vise versa, although the admiration of former became fashionable in tech circles lately.

Creating fake accounts is pretty common for spiders... standard search engine tactics.

Reply on news.ycombinator.com