Hacker News Reader

Comment by lumberjack | Hacker News Reader

>Foremost among these tools is enforcement action against companies that fail to honor their privacy promises

This is the crux of the issue. The problem is that when Facebook asks for "location information", the consequences of this are not being conveyed to the user. The user might think, "ah they want my location for the weather recommendations and event suggestions in my neighbourhood". They do not realise how something so "innocuous" as location information could be weaponised against them.

I used location data as an example because you could infer almost everything about a person just from that. You could know their social circle, their approximate tax bracket, which banks they use, who is their lawyer, their accountant and their wealth manager, their familiar situation, how healthy they eat, how healthy they are, whether they are chronically ill, and what type of chronic diseases they might have, what activities they engage in, what are their political leanings, I could go on, I do not think this is anywhere near an exhaustive list...

The user does not know that Facebook it going to tip off the insurance provider about the user's unhealthy eating habits or his chronic medical condition. Or maybe tip off his bank that he has substantial wealth elsewhere.

View on HN

If I had a nickel for every time someone called me paranoid or a conspiracy theorist for mentioning this before last week, I'd have a ton of nickels.

I should feel better now that people of aware of the nefariousness of this type of data collection, but I feel worse. The general public is being fed this as "Russia" and "Trump", and not getting the real, horrifying, surveillance state truth of what's going on.

I'm less worried that the Trump campaign used CA (and that the Clinton campaign used CTR), than I am by Obama saying "it's just metadata".

Google can probably determine EXACTLY how many nickels you’d have and here you are stuck just guessing.

181437

That is very precise but inaccurate.

The standard nickel is 5 grams but they typically weigh between 4.9 and 5.1 grams. However for such a large number of nickels, due to wear, I'd say it's a safer bet to lean towards the lower bound, and also add some uncertainty so a more accurate answer is probably 204±5 thousand nickels.

But... don't you remember how cool Obama was? He loved his blackberry!

Obama...that was the president who authorized the FBI to infiltrate the Occupy Wallstreet movement and paint the protesters as rapists and weirdos, right? Democrats who think highly of him are no better than Republicans who think highly of Reagan.

"I'm less worried that the Trump campaign used CA"

But, and maybe someone can clarify, every single intelligence agency has come out and said that there was some interaction between Russia and Trump and, more specifically, between Facebook and Russia. And it's been proven Facebook is directly implicated in both the Trump campaign and Russian election meddling.

We hold the ability to vote in free elections as pretty a basic fundamental right in a democracy, so why wouldn't this be the thing we should all be worried about?

How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA, and the politicians of any country in which the USA chooses to meddle in?

If we were so worried about the integrity of democracy, we wouldn't have our fingers in so many other ones. You've just described soft power.

"How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA"

Great question. We don't know, because either we don't get caught or doesn't happen to begin with.

We can make up all sorts of conspiracies, but Russia got caught so the conversation starts there.

Here's a wiki page listing the US interference in foreign elections that we know about.

https://en.m.wikipedia.org/wiki/Foreign_electoral_interventi...

> How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA, and the politicians of any country in which the USA chooses to meddle in?

Probably a level which should induce intense concerns in citizens of those countries if they already had a democracy to protect in the first place.

But thanks for the textbook display of Whataboutism.

No, what I've described is a textbook example of blatant hypocrisy.

Whataboutism is pointing at an unrelated problem, to divert attention from your problem. "But what about African Americans getting beaten!" to draw attention from bread lines and GULAGs - that sort of thing.

This is an incredibly related problem. The two cannot be discussed in isolation. This is quite literally, one of the top countries for 'interference in democratic elections' having an issue with its election being interfered with by a foreign power (In a relatively[1] minor way.)

Notice how none of the talking heads or politicians are taking a principled stance against interference with elections - they are just taking a stance against interference with their elections.

[1] Relatively, in terms of impact, effort expended, size of the United States.

> No, what I've described is a textbook example of blatant hypocrisy.

Yes, the accusation you've launched is one of blatant hypocrisy; the use of such accusations against those raising an issue as distraction technique to draw attention away from the issue raised is exactly the definition of Whataboutism.

Even when the accusations are indisputably true and relevant?

> Even when the accusations are indisputably true and relevant?

You can probably construct an argument where the hypocrisy of some speaker advancing the argument would itself actually be relevant to the argument being advanced [0], but that's almost never the case in any real discussion; instead Whataboutism (and then tu quoque fallacy more generally) has the same rhetorical purpose as guilt by association or as hominem; create a negative emotional charge attached to some group associated with an argument, and use that to get people to dismiss the argument without considering it's merits.

The accusations in the motivating instances for naming Whataboutism were often both indisputably true and the same type of wrong as the act they served to distract from.(which is as close to relevance as charges of hypocrisy get.) They were still fallacious, just as this one is, irrespective of its truth or.degree of analogy.

[0] e.g., if the argument specifically included as a key point that the speaker did not engage in hypocrisy.

So, in your opinion, moral authority isn't a thing?

You can cry "whataboutism" all you want when confronted with examples like these ( https://en.wikipedia.org/wiki/United_States_involvement_in_r... ), but don't be surprised or dismayed when no one listens.

> So, in your opinion, moral authority isn't a thing?

Sure, it's a “thing”, specifically a name based on rationalization given to the cognitive filtering mechanism which a number of fallacies, notably as hominem and tu quoque, target.

But it's never relevant to the merits of the argument; targeting moral authority is always an effort to avoid consideration of the merits of the argument.

So, your point is valid, but it only applies to robots, not people. Is that pretty much the right way to view it?

If so, I sympathize. I get that a lot, myself.

US interference in other countries' elections is absolutely wrong. It is because it is wrong that I feel justified as a US citizen saying that other countries' interference in our elections is wrong, too.

If the citizens of Iran or Vietnam or Korea or Iraq have a right to be upset at a lack of political self-determination, so do I. Punishing the people of a country for the actions of the leaders they did not meaningfully choose is exactly why US interference is wrong.

And it is because I as an individual care about democracy that I oppose the actions of both my leaders and anyone else to override democracy.

> But, and maybe someone can clarify, every single intelligence agency has come out and said that there was some interaction between Russia and Trump

No, they say (in the public assessment) that Russia intervened to favor Trump, not that there was interaction between Russia and the Trump campaign.

Now, there's been at least one guilty plea from the Mueller investigation specifically referencing interaction, but that's a separate thing from the public intelligence assessment.

"not that there was interaction between Russia and the Trump campaign."

The FBI strongly disagrees with that statement. Facebook has been proven to be used as one of the tools to achieve those ends.

Could you provide a citation? OP's comment mirrors my understanding. My understanding is that Russia acted both for and against Trump, though primarily for. But that is different than those efforts being coordinated by the Trump campaign.

Cambridge Analytic was named as such because it sounds "official" and it helped when they were eventually were hired by Bannon.

> The FBI strongly disagrees with that statement.

Whatever the FBI or people in it believe, the public assessment put forth by the US Intelligence Community does not address interaction; it is inaccurate to attribute that as a public unanimous conclusion of the Intelligence Community.

Note that I'm not making the “no collusion” argument, hence the reference to the Papadopoulos plea. The Trump-Russia interaction just is outside the scope of the public Intelligence Community assessment, and shouldn't be described as the public conclusion of the US intelligence community.

https://www.dni.gov/files/documents/ICA_2017_01.pdf

It's worth noting they ALSO say Russia intervened against Trump. There's at least two anti-Trump rallies alleged to have been organized by Russia.

> It's worth noting they ALSO say Russia intervened against Trump

No, they don't.

> There's at least two anti-Trump rallies alleged to have been organized by Russia.

Be that as it may, the public assessment does not state as the ICs assessment that any part of the intervention had an anti-Trump purpose (a rally can be organized whose overt message supports a cause without the purpose being advancing that cause.)

If you had a ton of nickels you would have about $9071.85.

thank you, I was just about to start figuring that out myself. :)

And that's much more than the raw materials...

A nickel is 75% copper and 25% nickel.

There are 2000lbs in a ton. That's 1500lbs of copper and 500lbs of nickel.

Scrap pricing is $2.50/lb for copper, $3750. Scrap pricing is $4.83/lb for nickel, $2415.

Total = $6165

> A nickel is 75% copper and 25% nickel.

Interesting, I thought nickle was the coin and nickel was the metal, but it seems that isn't the case and/or changed. (?)

Coinage has a marked propensity to debase.

"For in every country of the world, I believe, the avarice and injustice of princes and sovereign states, abusing the confidence of their subjects, have by degrees diminished the real quantity of metal, which had been originally contained in their coins."

-- Adam Smith, Wealth of Nations

https://en.wikipedia.org/wiki/Denarius#Debasement_and_evolut...

https://en.wikipedia.org/wiki/Denarius#/media/File%3AFinenes...

I wish the USA would stop calling people conspiracy theorists for critical thinking, especially as we see more what used to be 'conspiracy theories' actually come to fruition. It actually hinders critical thinking and is a bad path to go down.

The problem is that a lot of people that complain about actual issues, like Facebook stalking, also try telling people about a lot of things that are totally conspiracy theories.

On top of that, as someone with experience in database marketing, people act as if they are being personally spied on. If you are tracking 800k people and you have 20 employees, the issue isn't really having another person looking at your data, the issue is the unethical ways organizations are using that data to manipulate you and the rest of society.

It's the difference between "The government conducts unethical surveillance" and "The government is spying on me."

That's a good point on how you phrase what they are doing. You want to avoid implying that you or the person you are talking to is being targeted (because they're not really and it makes you look like a conspiracy theorist).

The issue is that the difference between the "The government conducts unethical surveillance." and "The government is spying on me." has essentially disappeared.

When everything is remembered forever anything you've done can be retroactively traced backed to you when you become a person of interest.

America has three types of "conspiracy theorists"

* Logically consistent in niche fields that could be verified if more information was public (Room 641A); these should really just be called "theories"

* Harmless garbage ideas perpetuated by dumb people (flat earthers); these theories deserve open ridicule

* Propaganda created by intelligent people with the intent of causing harm (Uranium One); these should simply be illegal as libel

Those are important distinctions. Some conspiracy theories are straight up garbage, they do not deserve any modicum of respect... legitimate theories are in the minority.

Can you elaborate on Uranium One being 'libel'? As far as I know from reading the Wiki, this went to a Congressional Investigation.

Libel: a written or oral defamatory statement or representation that conveys an unjustly unfavorable impression

The "Uranium One conspiracy theory" was a libelous attack on a political candidate. That attack is a prime example of legitimate conspiracies.

  * Harmless garbage ideas perpetuated by dumb people (flat earthers); these theories deserve open ridicule

Antivaxxers certainly fall into what you call "garbage ideas perpetuated by dumb people"

Those theories are anything but harmless, actually kill people and sabotage decades of medicinal breakthroughts, which saved millions of lifes.

True.... though I bucket that under my last grouping, because I think there's a conspiracy attacking the legitimacy and experience of scientists. If the public mistrusts doctors and vaccines, they're more likely to distrust climate change and anti-refined-sugar research.

Yes, they are important distinctions. But the problem is how to not mistake one for the others?

Think?

> If I had a nickel for every time someone called me paranoid or a conspiracy theorist for mentioning this before last week, I'd have a ton of nickels.

I just had an existential age-related hiccup realizing that I had a school paper on the subject back in 2002.

The consequences of using a store loyalty card are not known to the general public either. Yet all transactional information is sold off to third party data brokers and aggregated into profiles where they keep track of you in minute detail. It isn't exactly fair that Facebook is going to be punished while the rest of the industry hides behind its fine print.

I agree with you, but FB has been pretty blatant about how they misuse their user's data. If you are the biggest and most obvious, then you will probably be the first one targeted.

Yes indeed, and maybe this is an opportunity to do something about this too...

Ioseb Jughashvili has a thing for sales, I hear.

This story [1] is fairly widely known.

[1] http://www.businessinsider.com/the-incredible-story-of-how-t...

Whataboutism - corporation edition?

Indeed. Collecting a "type of data" tells you almost nothing about what the company collecting it could do or is going to do with that data.

I think regulation around this idea may be most effective. Companies should have limits on what they can do with the data by default. If they want to use it for more, then they should not only offer a much greater degree of transparency but they should have to abide by much higher standards, too, similarly to how medical companies have to abide by much higher standards when collecting your information.

So if a company asks for location data just to use it for weather information, that could be obtained with a single click from the user. If the company intends to use that location data to allow advertisers to target you, then it should be made very clear to the user that this is what the purpose of collecting the data is. And they should need to do more than just click once on a button.

If the same company intends to give the data to electoral campaigns, then higher standards still should be imposed on that company.

The point is we need to start regulation the use of data, and not just what type of data can be collected.

I don't believe that telling the user what use will be made of their data will be in any way effective. Many companies are very honest and up front about it. The problem is that the information is just too technical for a user to understand, so they ignore. They have no choice because there's no way for them to understand it anyway.

Even if all companies were required to and did comply with a law like that and fully disclosed the information, the collected data would just be laundered through a third party in some way so that the terms of service were technically correct, but they could still get away with business as usual.

I think these companies just need to be barred from using data in this way period. It's the only way to ensure users are protected in my opinion.

In the end it just doesn't matter if the user understands or not. Most people just don't care either way until it hits them personally. When the violent ex boyfriend manages to track you down even though you have a secret identity just because a mutual friend visited and unknowingly got your location on some social app.

And who knows if the analysis that is derivable from this private data leads to a bunch of false-positives (that are conveniently not known by the person affected)?

You could be "doing nothing wrong" and still get screwed by right people thinking the wrong things about your data.

1984 or Brazil - it doesn't matter they're both dystopias that revolve around totalitarian constructs - neither of them work without this kind of comprehensive information.

[edit: clarity]

There's a really good Econtalk podcast called Weapons of Math Destruction about this: http://www.econtalk.org/archives/2016/10/cathy_oneil_on_1.ht...

Are you aware of any instance in which this has actually happened? AFAIK Facebook has not been selling location data to anyone, and this would be a direct violation of their privacy policy.

Further, if I worked for an insurance company or bank, I’d have customers install my mobile app that has lots of convenience features, and have that app request location permissions so that I could get GPS data directly from their mobile device. Then I’d use that location data, that I obtained directly and in accordance with all applicable privacy policies, in all of the scary ways you mention and then some.

Going to Facebook is not the most efficient way to violate the privacy of most individuals. Most people will happily trade their privacy for a small discount or to be able to save a few seconds interacting with a service they use. This is where any legislation in this area should focus - not on punishing a specific company because the “wrong” candidate happened to win an election.

Location data, both user and friends, are part of Extended Profile Properties:

https://stratechery.com/2018/the-facebook-brand/

https://stratechery.com/wp-content/uploads/2018/03/Screen-Sh...

https://web.archive.org/web/20130911191323/https://developer...

Right, but those are directly authorized. That's not the same as going to Facebook and buying location data, nor does it apply to friends' locations.

You can get all of this information from a phone number too.

https://www.twilio.com/marketplace/add-ons/nextcaller-advanc...

Give it a try with your phone number. It'll provide your address (current and former), income bracket, relatives, siblings, children, etc, etc.

Guess what Facebook asks you to provide when initially setting up!?

You can't get someone's bank from that. You can likely figure out someone's bank if you monitor their location over time, though.

> Guess what Facebook asks you to provide when initially setting up!?

Amusingly enough, so does Fetlife (NSFW). It's not outside the realm of possibility that even your specific kinks could be appended to that list.

600+ Million records:

"Name, Address, Email, Carrier, Line Type, Secondary Phone, Age, Gender, Household Income, Marital Status, Presence of Children, Home Owner Status, Home Market Value, Length of Residence, High Net Worth, Occupation, Education Level, Twitter Handle & Followers, Facebook Profile & Followers, LinkedIn Profile"

Don't forget number of steps per day, resting heartbeat rate...

No, that's not included. Read the link.

I do not speak for Fitbit, but I work for Fitbit, and I do not appreciate my employer being baselessly lumped in with violators of privacy.

baselessly lumped in with violators of privacy

It's not a baseless assumption that fitness trackers abuse access to people's private data. Maybe your particular fitness tracker doesn't today. That doesn't mean others don't.

And I am - for argument's sake - agreeing with the notion that privacy violation happens when the online service does something "wrong" with the data, not when the online service demands to keep their own copy, for their own uses, as a precondition to using the software.

History has shown that software that sends as much data home as possible can simply not be trusted with that data. Fitbit is one "innovation" or management team change away from further abusing the access to their user's data. I don't mean to coldly disregard the fact you trust your employer. But if I want an accurate assessment I can't care. Facebook employees trust Facebook.

My employer was being lumped in with a currently existing privacy violation. I won't argue much against hypothetical future possible privacy violations. I'll just point out that web-based email, your credit card company, and whoever installs software on your smart phone overshadow privacy implications associated with fitness trackers.

The difference is that all of that is public information. The kind of tracking that Facebook and Google are doing is not explicitly public information. They infer secrets about your private life from little bits of "innocuous" data that you sweat away during your everyday activities.

Just tried this for several people I know. It only kinda-sorta gets things right. It generally gets the name right and sometimes the address.... but not much else.

Does anybody know what the legal situation (in US or under the GDPR) is for data derived from inferences? E.g.: if he visits this nightclub he's gay, or if she goes to this clinic she's having an abortion. As the subject never told you, but rather you speculated it, it could be argued you don't know, and you don't have to record it in explicit terms. It also raises significant concerns about the accuracy, and whether the subject can even correct, let alone expunge such data, which could be sold on to credit rating agencies or whomever else.

It's not illegal to record whether you think someone is gay. It's probably immoral if you hand that data over to a country that will prosecute someone for being gay (Russia).

I'm not aware of any US protections unless they came along with recently passed legislation, but the GDPR had some recourse for European citizens. They are now guaranteed a right to explanation and a right to correct the data. So if a person is given a higher health insurance premium, they are allowed to ask for an explanation. If the answer is "Google thinks you're gay, so we're raising your premium," the person is allowed to correct the information, basically saying, "I'm not gay, so please lower my premiums to what they were."

(and then in the UK you sue for discrimination based on sexuality).

Right, but that is only if they discriminate based on what they had recorded about you. A company recording whether they think you are gay based on your location information isn't doing anything illegal until they discriminate against you with that information. There are things that a company can do (like advertising) that doesn't meet the bar of discrimination that they can still legally do with their inference about your sexual preference (or whatever else they infer about you from your data).

Advertising "gay" products to you based on the fact that your cell phone spends a lot of time in close proximity to a gay bar probably doesn't meet the bar for a discrimination lawsuit.

>prosecute someone for being gay (Russia).

where do you get this outlandish nonsense from?

https://en.wikipedia.org/wiki/LGBT_rights_in_Russia#National...

"Under the statute it is effectively illegal to perform any of the following in the presence of minors: hold gay pride events, speak in favor of gay rights, or say that gay relationships are equal to heterosexual relationships"

"The law subjects Russian citizens found guilty to fines of up to 5,000 rubles and public officials to fines of up to 50,000 rubles."

You didn't answer his question. Those are laws against promoting homosexuality - not being homosexual.

Of course just being gay isn’t a crime in glorious motherland, but promoting homosexuality is. That’s so broad that it includes being openly gay, or standing up for your rights if you’re gay. It’s sort of like saying that it’s not illegal to be alive, it’s just illegal to breath.

Typically thuggish laws from a state run by its own intelligence services-cum-mafia.

In the US personal data generally has 0 protections with a handful of exceptions like medical information. As the FTC's statement reads, the only possible issue here is Facebook violating their own privacy policy (stated as a privacy 'promise') and the consequence there will be at worst a very gentle slap on the wrist.

If not for the media coverage of this, Facebook would be unable to care any less. The media coverage though is driving the stock prices down and effect the company many orders of magnitude more negatively than any legal enforcement will.

The issue with inferences is that you could use relatively unprotected data, such as location data, to derive, for example, medical data. The example of going into an abortion clinic and having had an abortion is an obvious one. In that case, does the law consider you to be handling medical data? Can you sell it to a third party simply classed as location data analysis?

Interesting that you choose location information. I believe location privacy issues on Facebook pale in comparison to Apple and Google who share your exact location information with 3rd party app developers.

Well, there is a permissions model for 3rd party apps. What about the system software...

That's a good example, +1. But I have bigger issue with their cookie abuse.

Initially cookie was designed to help website track you around THEIR website; it wasn't design to track you around the WHOLE internet. While it may be in Facebook spirit of "hacking things" and "breaking things", I'm surprised EU and US have not come up with strict rules and regulations on how cookies can be utilized.

I remember in EU Facebook tried to argue that they track you around web for your safety and security but I'm unsure how much water it hold.

Isn't this primarily on Android ? Am quite certain no app can monitor your location in the background on iOS.

Regardless What pisses me off is FB not providing evidence to the contrary, that they don't harvest data in the bqckground. Not providing this evidence makes it quite clear that they do harvest this data. The issue isn't about permissions. 'Sir, may I come inside your house, is fine, but ransacking the house once you get is is douchebaggery.

If Facebook does a background news feed update on your iPhone and notices that your iPhone wifi is on the same IP address as another phone (Android or otherwise) with location enabled, then it can record a correlation.

There's probably even better ways of doing it.

Straight up GeoIP is good enough, particularly on WiFi.

On mobile networks I believe the carries will gladly sell the tower-IMEI mapping. They already have to collect that for law enforcement purposes anyway.

In my experience GeoIP is unreliable.

Right now GeoIP identifies my desktop computer as being in northern Nevada. I'm 400 miles away.

Right GeoIP identifies my laptop as being in Atlanta. I'm 2,300 miles from Atlanta.

Right now GeoIP identifies my wireless hotspot as being in Los Angeles. I'm more than 400 miles from Los Angeles.

Three devices, inches away from each other in reality. But GeoIP thinks they're on opposite ends of the country.

GeoIP has certainly improved in the last few years, but I would never rely on it for anything important.

> Am quite certain no app can monitor your location in the background on iOS.

Any application can do this on iOS, with a few caveats:

- iOS prompts you to grant permission when the application requests it for the first time. If you refuse, the application cannot keep prompting you.

- After a few days, it reminds you that the application has been accessing your location in the background and asks you if you want to keep allowing it or revoke access.

- There is an indicator in the status bar to let you know when an application is tracking your location.

- You can see which applications have access and which applications have used that access recently by going to Settings > Privacy > Location Services.

- You can revoke access at any time in the same place or by going to Settings > App Name.

- You can also only grant applications access to your location while you are using the application, as long as the application supports that.

- If an application doesn't intrinsically need location services to function and the developer tries to force users to grant permission by disabling functionality, the application is unlikely to be allowed in the App Store.

As others have mentioned, there are also other ways in which applications may be able to infer your location indirectly.

You also know where they live, where they work, when they are on holiday, when they are out taking a stroll in the woods... Even if you trust 'Facebook' with that data, do you trust a facebook employee?

How about a diffrent form of punnishment for privacy violating companys?

Just insert NN generated Noise into there databases. Instant devaluation of there most treasured asset. That has to hurt.

The biggest names in AI technology are the very same advertisement companies. General public can't win in this arms race

you could build a simple app that illustrates your points.

http://webcache.googleusercontent.com/search?q=cache:https:/...

http://web.archive.org/web/20180124044328/https://www.ftc.go...

Reply on news.ycombinator.com