Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

“California malls” is too forgiving a headline. It’s one company, Irvine Company, a group with locations in the Bay Area [1]. They have phone numbers on their websites [2]. Reaching out to their retailers, particularly those with locations in Mexico, couldn’t hurt either.

It might not be a bad idea to also compile a list of their retailers’ investor relations and Twitter accounts and tweet this article to them (here's their store directory [3]). I just started e-mailing the brands I know.

[1] https://www.shopirvinecompany.com/centers/

[2] https://www.shopirvinecompany.com/about/contact/

[3] https://www.shopirvinecompany.com/directory/store-directory/

View on HN

Irvine Company is not just "one company", it's HUGE... it owns half of Orange County, Newport Beach, etc. From Wikipedia:

> The Irvine Company develops suburban master-planned communities throughout central and southern Orange County, in addition to residential buildings in Santa Monica, Silicon Valley, and San Diego.[6] The company also owns and manages office buildings in Milpitas, San Jose, Sunnyvale, Downtown San Diego, Mission Valley, San Diego, La Jolla Village/University City, Sorrento Mesa, Del Mar Heights, Newport Center, UCI locations, West Los Angeles, Pasadena, Chicago, and New York City.[7]

It's the closest thing I know to the burbclave running megacorporations from Snow Crash.

Donald Bren is essentially a Duke.

I’m now surprised this isn’t a plot point in Arrested Development

Given this news, I'm going to contact some other large mall chains (e.g. Westfield), in the hopes that they'll confirm that they don't give out license plate data to third parties.

I'll be interested to see how they respond.

Better yet, ask them to confirm that they don't track this stuff in the first place.

> ask them to confirm that they don't track this stuff in the first place

I could see a reasonable case being made for collecting these data, storing them for a few weeks, and then deleting them, to protect against thieves.

The problem here is that for the government to collect these data, they would need to follow certain processes. A private actor who isn't following those processes is placing those data with the government, thereby circumventing a critical check on police power.

This seems to be the latest trick. The same thing was happening with the cell phone location data. We should start referring to this as "data laundering".

> "data laundering"

Don't mind if I do start referring to online abuses of privacy as such

Outsourcing detective work has been going on for a long time. When the Marshals or bounty hunters are looking for fugitives, one of the first things they do is pull what is essentially your credit report (with strictly financial details redacted) to get your address history and last known whereabouts from the private sector collective.

All that extraneous data in your credit reports is up for sale to qualifying purchasers-- be it law enforcement, marketing firms, or financial institutions.

The Dutch civil servants collecting census data probably thought it was reasonable to create per-person records that included the tuple {address, religion}, which the Nazis used to create this[1] map of Jews living in Amsterdam (3/4 of the black dots on that map were murdered in the camps).

The problem with storing data that requires "certain processes" to ensure safety is that it might not be your decision. Governments collecting data is one example; others include desperate behavior by companies in bad financial situations or Equifax-style theft.

Someone trying to lose weight is probably able to resist the box of cookies in their pantry most of the time. Unfortunately being human means having occasional bad days where the will isn't necessarily up to the challenge. The responsible person recognizes that weaknesses exist and doesn't keep the box of cookies in the house.

I'm sure data will be handled safely most of the time, when it's easy. The real question is what will happen in difficult, morally problematic situations when the cost of acting ethically might include losing your job (or worse. One of the responsible way to handle that kind of problem is to avoid it entirely by not collecting the data.

[1] https://www.verzetsmuseum.org/uploads/archive/museum/topstuk...

> I could see a reasonable case being made for collecting these data, storing them for a few weeks, and then deleting them, to protect against thieves.

I disagree. Everyone shouldn't have to sacrifice everything associated with their license plate info, everywhere they go, because of a few thieves. It's not a reasonable balance; my privacy is worth a lot to me.

I could see a reasonable case being made for collecting these data, storing them for a few weeks, and then deleting them, to protect against thieves.

I know some mall companies record license plate data on a daily basis to make sure the employees are parking in the way-way-way out employee designated parking areas.

How long that data is stored and who else gets to see it is anyone's guess.

Unfortunately, it you're on the mall's property, you have no legal right to not being surveilled by the mall.

Even if private actors were not involved, there wouldn’t be any way to verify that the information was destroyed by a governmental department. I suppose that is a possible area where a public blockchain that broadcasts the storage and deletion of data could be useful but now everybody has stopped reading this comment so they can talk about how blockchain tech is useless. Regardless, the indefinite/temporary storage of tracking data needs to be addressed at some point.

How exactly could a blockchain publish deletion of data in a way that can't be cheated?

Through a private key mechanism. If there was a mechanism to automatically remove the private key for a record then it would become effectively unreadable (in our life time, anyway).

But what stops you from copying the private key before it gets removed? Or running a client that just pretends to remove the private key?

Half the point of a blockchain is that once data is out there it can't be removed. You can't leverage that to force the removal of something.

>I could see a reasonable case being made for collecting these data, storing them for a few weeks, and then deleting them, to protect against thieves.

So everyone is guilty to proven innocent?

That’s how security cameras work too - if the data is deleted in a reasonable timeframe I dont have a problem with it.

What reasonable case do they have to track the data? What reasonable case is there tgat requires storing for two weeks?

Westfield valley Fair does, they have a system that will let you know where you parked if you provide it your license plate details. If it doesn't find an exact match you get to train the algorithm for them.

They're not going to reply to you and even if they do it'll be a "we do not comment on our security practices".

Yeah, at least pretend you're an interested buyer...

Westfield uses third party hardware solutions in multiple malls to track in/out, matching against voluntarily-registered parkers so that parking tickets are not needed for smoother customer experience. These solutions track -all- in/out plates because that’s what they’re for. My info is dated but there was no data sharing.

Significantly more creepily, WF uses wide-coverage anonymous device tracking to build customer profiles of visitor paths/time spent in shops across multiple visits to place targeted ads via FB and the like. Don’t walk around in a mall without your Faraday cage.

Westfield recently spin that division off. All of this tracking tech is being built by a new company named OneMarket.

I would also settle for some California legislation that would kill Vigilant’s business model.

More than this?

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

That’s actually pretty solid. Thanks for bringing it to my attention.

How solid is it?

You can easily keep license plate data much longer by simply stating, "we are using it as evidence". For what? "An on-going investigation."

Done. Now you have it for much longer than 60 days.

It’s substantially better than no governance and oversight, and additional reporting of deviations can be mandated (require documentation of what ongoing investigations data retention extension requests are tied to).

You have to start somewhere.

It might be time for a group of tech people to write some initiatives to limit these kind of business models. This kind of behavior should be pretty simple to get Californians to vote for.

The hard thing would be getting enough signatures on the ballot, that costs a million bucks usually. Of course that can be powerful, consider the recent surprising rush for privacy policy legislation.

Reach out and do what?

touch someone, presumably.

Here's an excerpt from e-mail I just sent 7 For All Mankind's support e-mail:

"You have a California location at Fashion Island [1]. It has recently become public that the operator of that mall, Irvine Company, is sharing customers' license plate data--due to no legal obligation and en masse--with ICE [2]. Irrespective of political affiliations, I believe we share a mutual respect for customers' privacy. Hoping your brand, currently running a #WeAreMankind campaign, is wiling to speak out about this inconsistency.

Best,

[JumpCrissCross]

[1] https://www.shopirvinecompany.com/directory/store-directory/

[2] https://techcrunch.com/2018/07/10/alpr-license-plate-recogni...

Reply on news.ycombinator.com