Refunds for 300M phone users sought in lawsuits over location-data sales | Hacker News Reader

Refunds for 300M phone users sought in lawsuits over location-data sales

arstechnica.com

147 pointspseudolus28 comments

"Despite the carriers' promises, a Motherboard investigation found in January 2019 that "T-Mobile, Sprint, and AT&T are [still] selling access to their customers' location data and that data is ending up in the hands of bounty hunters and others not authorized to possess it, letting them track most phones in the country"

The problem is that those companies can do these crimes because they know they can afford to pay the fine and that no one will go to jail

It's absurd.

Even better, they get to pay the fine with shareholder money.

First, they defraud the shareholders by doing things they said they wouldn't with the shareholder's company.

Then when they get in trouble, they use the shareholders money to buy their 'get out of jail free card'.

I wish the government would find the officers personally liable.

Couldn't they? Didn't the Enron execs get jail time?

Sure, and now everyone knows to shred documents more thoroughly than Enron did.

Although I agree. A company should be managed such that moral transgressions that happen in lower levels should not be possible. That's exactly the reasoning they applied to Joe Paterno and it should apply to every company as well.

I think the bigger problem in the US is that there really aren't standard fines for mishandling or purposely misusing customer data similar to what is structured under the GDPR in Europe.

Wait, why wouldn't bounty hunters be authorized to possess it? Isn't pursuit of someone who has a bench warrant exactly the kind of lawful purpose this is supposed to be limited to?

Bounty hunters are no different to you or I, in most places (and outlawed in several states). Some states require licensing as a PI. They have no connection to law enforcement (and due to abuses, many states ban any implication thereof, down to the color of vehicles used).

I think you are mistaking bounty hunters for law enforcement.

It's not the same thing.

They are more like loan sharks who require human beings as collateral.

They have no real affiliation with law enforcement. They also can't kick down your door or kill your dog like the police can.

Well they can. They're just much more likely to be held accountable if they do so without a really damn good reason.

Bounty hunters aren't law enforcement anymore than Luke Cage.

Because they are a private citizens and not law enforcement.

I really want to see this happening because whole "you are the product" line does not apply here. People pay for these services, that should be the end of profit motive. If they want to fuel a location data industry, give users a choice/incentive for that.

Indeed. What people seem to miss is not just that "you are the product" but more "what stops you from being a product". Many major companies have shareholders that demand constant growth. The growth are sometimes limited by the offers a company can provide, so they may start to cannibalize their own customers in hopes it won't drive them away, just to keep that year-over-year growth. Eventually it comes down to the consumers ability to push back.

I live in a two-party-consent state and I'm wondering how tortured a reading of the wiretapping statute it would require for this to qualify. It certainly seems like my phone's location ought to qualify as "Private communication transmitted by radio."

This is an interesting point. I haven't read the applicable wiretapping laws, but from my extremely limited understanding, they apply to the conversation and not the location. As one does not expect privacy when out in the public, how about when one is in the confines of one's own home? Can they legally track me in there since I'm not out in public? Do I have the right to privacy in my own home?

If two people are having a conversation about something — let’s say the location of alice’s backpack — which is immediately obvious to anyone walking by the coat hook in the front of the office, should that conversation lose wiretapping protection?

How would someone know the backpack is Alice's unless they were tapping the conversation? If you're not in the immediate vicinity of the backpack witnessing her drop it off, then you've gained information that is otherwise not publicly known. Sure, one could request camera footage showing the event, but I would hope that the person in possession of said footage would at least ask for a warrant first.

Really wish the chief officers were all directly prosecuted for the actions of the company. They do, after all, receive a majority of the income; why not get the bad with the good? Actions like selling the live location of customers wouldn't be so appealing if it meant 10 years in jail.

>> offered a service enabling law enforcement officers to locate most American cell phones within seconds

this is additionally concerning given the fact that cell phone numbers are frequently recycled by phone companies, 'from' the previous owner who is no longer making payments, and 'to' a new person who is probably a child.

Let's please not go down the "think of the children!" route. It's been abused quite enough already (albeit to rob us of our privacy and privileges).

No, you missed a good point. Everyone in the US who needs a phone, has a phone (gross generalization, but accurate enough). Therefor, the only people getting new phones are children who newly have a need for a phone.

This is isn't "think of the children" with buckyballs, this is "think of the children" with phone numbers potentially under questionable surveillance for a previous owners activities. A perfectly reasonable thing to think about, especially in the context you presented in parens. Obviously, this shouldn't be happening for anyone, but children are more likely to feel the effects.

Um... and new employees, and immigrants, and long term tourists, and people wanting to change their number...

Short term tourists too. Not everyone has EU style or T-Mobile ONE style roaming.

This is pretty much doomed to fail because of the pre-dispute mandatory arbitration clauses coupled with class action waivers contained in the carriers' contracts. Under the current law surrounding arbitration it is a practical impossibility for consumers to sue cell phone companies.

Called party may well be excluded, though that would likely be another suite.

It seems like all big companies have to do is create a press release saying reports of your illegal activities are false, then rely on lawyers, spokespeople, donated lawmakers and spin to face little to no consequences.

What are the odds that the US actually puts something like GDPR with the current campaign finance system as it currently is?

Reply on news.ycombinator.com