This is exactly what PRISM was, not taking data from servers, but tapping into the data networks between them and siphoning off whatever the NSA wanted. And it just so happens that to mirror a fiber optic line you use a crystal prism.
I've seen intranet encryption between internal services become much more commonplace
At the very least it produced some dissonance between democratic establishment and their support base. Bill and Hilary continue to tour the country and I attended their road show in Seattle. Crowed cheered at every statement until they got to, and I quote, “Snowden is a traitor”, which produced very confused and subdued cheer. It was very fun to watch.
It actually changed a lot how some companies handle government requests for data. Apple for example, completely switched their strategy because they wanted to be seen as protective of customer data. They realized that data requests would eventually leak so they avoid storing identifiable data on the servers. They saw privacy as a competitive advantage.
https://www.apple.com/privacy/government-information-request...
Here in the UK, nothing had changed, and any debate that wasn't centred around condemning Snowden and justifying the actions of the security services, was very short lived.
And whilst what eg GCHQ actually do hasn't really changed much as far as I can tell, it's been brought onto an "open" legal footing which is progress. The next step will be for the legal safeguards which are currently rather toothless to evolve to have real teeth. I think that will happen eventually but it'll be a slow journey to get there.
The CIA spied on the Senate and nothing happened.
Naive in the extreme. So naive its hard to believe the opinion is genuine and not Astro turf.
Example: Doorbell Cams taking video of you walking by, uploading it to a corporate database, identifying you using photo recognition algorithms and your location using the home's address, and using that information to sell you things.
The horror.
The threat isn't corporations. The threat is when the government goes rogue as governments tend to do unpredictably from time to time. The threat materialises in the government using private corporation data to target arbitrary minorities (although usually the educated, wealthy, foreign and free-spirited).
People seem to think that because it "could never happen here" they can just ignore the possibility. Then it turns out that that sometimes it can.
Privacy isn't just about the world as it stands today. Privacy is an acknowledgement that the present and the future are linked and that the future may be profoundly different from today. People aggressively selling you things is more harassment.
In a thread about surveillance, why are you drawing a dichotomy between different surveillers and basically giving one a pass? They're both prongs of the same threat! On the collection side, every bit vacuumed up commercially is available for use by the government. And on the use side, there is little difference between a government proper and corporations that have achieved enough power to exert de facto governmental control - especially when colluding through a common third party.
> corporations that have achieved enough power to exert de facto governmental control
Might be a failure of the imagination, but I really can't see myself ever getting involuntarily dragged out of my apartment by McDonalds employees. The worst I've ever seen a corporation do is set the police on someone. As long as the government is functioning sensibly a rogue corp can only do so much.
"want". Do you actually desire them, or were you persuaded/tricked into it? :)
Also do not underestimate the influence of corporations:
* https://en.wikipedia.org/wiki/William_Randolph_Hearst#Spanis...
* https://www.newyorker.com/news/daily-comment/kochland-examin...
It seems to me that if an advertiser can convince me to spend money then I wish they'd done it sooner. I can easily imagine having bought my first smartphone after seeing an ad. It wouldn't be a trick.
Corporations are worth keeping an eye on, but governments are more unreliable, less governable and generally have larger professional military. And if a corporation acts it is usually in concert with a government.
Are you an American? :)
For example, EU corporations are required by GDPR to comply with deletion requests, unless they are asked to retain the data by a government.
1. Persistent psychological manipulation (advertising), including political manipulation, based on knowing your weaknesses better than you know yourself.
2. Punitive insurance rates based on unreasonable inferences, especially for mandatory insurances. Like say doubling your auto insurance rate for buying more than a few beers per week. Or your health insurance going up due to buying power tools.
3. Blacklisted and prevented from working industry wide. A good concrete example I got from HN just the other day: https://en.wikipedia.org/wiki/Consulting_Association .
4. Prevented from or price-gouged when using vital services. For example - the unbanked (ChexSystems), recent Internet censorship (Visa/MC), Internet service ("six strikes").
The issue isn't the straw man of being "dragged out of your apartment by McDonalds employees", but rather being prohibited from buying food due to being uniformly banned from McDonalds, Burger King, and Walmart - say you've previously shoplifted but have served your sentence, are simply wrongly accused, or perhaps just didn't respect a sign saying to take off your sunglasses.
I know you're likely to respond to these by defining them away as not being problems in your paradigm, but paradigms are only as good as their constructive results. Our current politicatastrophe is basically due to people clinging to their chosen paradigm way past its utility. FWIW our modern society is indistinguishable from a "Libertarian Paradise" where USG is a private corporation that owns everything and who've you've contracted with to be here. An axiomatic approach of morality-by-construction doesn't work - the only way is to judge qualitative situation.
Is it just supposed to be self-evident that those inferences are unreasonable?
I've always thought that this was an interesting argument. If there is some form of correlation with beer consumption and and car accidents, wouldn't it make sense to adjust your estimated risk based on that information?
I do find it self-evident that that would be a bad thing, but I also have a hard time putting my finger on why.
One of the tendencies of the neo-puritanism that has become prominent in the last decade is a real willingness to abandon any boundaries that have kept corporations from using certain kinds of information against individuals -- boundaries that were in large part legislated during the civil rights era.
It's the job of the insurance company to accurately assess risk and charge me that plus their margin. If the companies can more accurately assess risk, than that makes insurance a less volatile and therefore cheaper market.
Insurance companies don't have access to the actual root causes of accidents. They have no measure of my driving skill or risk tolerance or attention span. They just estimate based on some really primitive data they have about me. What's the harm in including more data?
Directing focus at "people who drink a lot of beer" means considering people who who drink a lot of beer at home as guilty by association, ultimately due to the subjective priorities of whomever pushed for that model.
Obviously in the expected value sense, charging on correlations is lucrative for the company (as is any justification for raising prices on a set of customers if your competitors do it too). But in the exact same way as saying certain zip codes are more likely to default on a loan, which we rightfully reject.
Why would we reject that zip codes are more likely to default on a loan? Seems like information I would like to be aware of if I was a home lender.
I certainly look at crime rates of a community before I live there. While a bad crime rate certainly doesn't make potential neighbors "guilty by association", it certainly increases the likelihood that one of my neighbors might be actually guilty.
Nope. Because it's flawed reasoning. If many people who get into accidents were driving drunk and everyone who drives drunk buys beer it might seem logical to increase rates for everyone who buys beer, but people who drive drunk are only a small percentage of the people who are beer buyers. That kind of reasoning seems more likely to be a weak justification to raise rates for a large number of people than a reasonable response to a trend.
If the insurance companies could arbitrarily raise rates due to a trend that doesn't exist, than they would have already done so. These companies know their margin and they don't bid above that if they want to be competitive.
that assumes that all companies involved aren't doing the same thing. Corporations figured out a long time ago that when one of their competitors does something that makes them more money at the expense of their customers they could start doing the same thing to their own customers and profits increase for everyone without risking prices being driven down by a truly competitive market. The insurance industry in particular is has a long history of shady practices from good old fashioned collusion and price fixing to new techniques like data mining to charge customers different rates depending on where they live, what jobs they have, or how often they're willing to change insurance companies.
In my view, the insurance industry looks competitive, which means that even though these shady practices happen they can't effectively dictate the entire market.
On the large scale, I do not want these entities to have access to weapons-grade behavioural models. On the small scale, I do not want them to have compromising information about individual behaviour. They will use whatever leverage they gain to enrich themselves far beyond their utility.
Especially in modern society government and corporate interests are increasingly interweaving. And I'm no more comforted by governments having access to dystopic levels of personal information than I am by corporations having that access. It just so happens that, in practice, there's no difference anyhow.
[1] - https://en.wikipedia.org/wiki/PRISM_(surveillance_program)
It was a f---ing web-form for sending targeted, narrowly-scoped, legal notices. Nothing more, nothing less. It was not some magical all-seeing Eye of Sauron that gave the NSA a backdoor into every word you ever said online, your blood type, and the number of nose hairs that you plucked this morning.
The really illegal backdoor, unscoped intercepts, including the cable taps, were done without the consent of most (all?) of the companies in question, and were not done through PRISM, but rather through physical access to, say, cross-datacenter cables, straight up hacking, and similar means.[1]
[1] See: SSL added and removed here :v) https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her...
To start with "IS, not WAS". PRISM hasn't gone anywhere and the most reasonable path here is to expect it's only substantially grown - as it already was doing at the time of its initial reveal. This [1] is a snippet of the PRISM collection overview. Data is sent straight from the partners to a DITU - data intercept technology unit which then processes the data in various ways before being sent on for further processing to appropriate nodes and ultimately becoming searchable through PRISM.
An example of a DITU is here [2]. Microsoft provides unencrypted access to the NSA to user emails. One slightly tricky thing here was Microsoft deciding to roll out a new 'alias' feature enabling users to send emails under an alias. The DITU for outlook there ensured that NSA tracking would remain consistent regardless of the identity chosen by the user. Finally this [3] is a snip of the slide revealing the scope of data available from various partners. [3]
And yes, there is supposed to be a formal request where an analyst requests our secret court system approve a search before they carry it out. That process is unsurprisingly a rubber stamp - the court approves 99.97% of all requests. But more importantly this is something with no meaningful oversight. As Snowden emphasized, "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
So, yes it would be much closer to calling PRISM the all-seeing-eye than it would be to a system for sending out warrants. These systems are the reason that the Utah data center was built with storage estimated on the order of exabytes. One exabyte being a million terabytes.
[1] - https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
[2] - https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
[3] - https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
The data that is sent into the PRISM system is data that is sent by cloud providers, in response to a targeted warrant. The data is not collected whole-sale - it is targeted to a particular individual. That's the whole bloody point of warrants.
Once it's been sent by the cloud providers to the NSA, it ends up in a searchable database. I don't understand what is remotely controversial about that. The source of the data was not whole-sale collection - it was targeted warrants. That it becomes searchable afterwards is not relevant to anything. There is nothing illegal about police retaining data, and maybe even putting it in a searchable database, as long as that data was legally obtained - at least, in the United States.
> And yes, there is supposed to be a formal request where an analyst requests our secret court system approve a search before they carry it out. That process is unsurprisingly a rubber stamp - the court approves 99.97% of all requests. But more importantly this is something with no meaningful oversight.
I'm not sure you understand what the purpose of search warrants is.
Search warrants are overwhelmingly rubber-stamped by courts, regardless of whether it's a secret FISA court, or a local judge who works two days a week in Small Town, AK. The point of having to get a search warrant is not to obstruct the work of police. The courts don't interpret that to be their job.
The point of having to get a search warrant is to prevent fishing expeditions, and to make sure that police are conducting a narrow, targeted search. Most judges will rubber-stamp a search warrant for Bob Joe, based on incredibly flimsy testimony. Most judges will tell a police department to go pound sand if they wanted a search warrant for an entire town.
As long as those FISA courts were dealing with search warrants of the first kind (And all evidence points to this), rubber-stamping them would not have been any different from how regular courts rubber-stamp targeted search warrants.
> "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
You are conflating two separate parts of PRISM, in a misleading manner.
The first part is how it requests data from cloud providers. It does so by targeted warrant. This is incredibly similar to how regular police operate. They get a targeted warrant, a judge rubber-stamps it, and they serve it. It is incredibly likely that this is not illegal.
The second part is that after it has retrieved the data, that data goes in a database, where every Tom, Dick, and Harry that works for a TLA can search for it (And go on fishing expeditions, in the already-retrieved set of data). This is also not illegal. If you think it is, please point me to legislature, or court precedent that implies that information obtained by the police in a warrant cannot be put into a searchable database.
You are conflating the two, by making it sound like every Tom, Dick, and Harry that works for a TLA can go on an untargeted, whole-sale, unwarranted fishing expedition on Hotmail.com. The simple fact is, they can't. Not via PRISM, at least. This is why the NSA was conducting criminal tapping of cross-datacenter links - because PRISM only let them serve targeted warrants, and they wanted raw, whole-sale, untargeted, backdoor access to your data. That, for some reason, most of the firms implicated in the leaked NSA files were not granting them, hmm...
[1] - https://www.washingtonpost.com/investigations/us-intelligenc...
This should not be taken for granted -- in the UK I was twice (very politely) asked to leave because I was taking a picture and apparently a gov't building was in the background (and you need a permission to photograph those!!) and the second time because a school volleyball competition was played in the background. This is stupid because if I did it with a phone instead of a DSLR no one would notice.
Maybe some limits on commercial photography in public spaces makes sense, but I would not go as far as putting strong limits on it altogether. My 2c.
In my opinion, we need to start treating data about users as intellectual property. Generally speaking, you don't have to worry about intellectual property when you're doing something personal. I can say "Just do it" all I want. In the same vein, I can make casual observations about random people on the street without having to worry about violating their privacy (that guy has cool shoes!). But if I start to use "just do it" in my business marketing materials, I'll be in trouble. Similarly, if I start keeping a database of somebody's shoes every time I see them so I can try to sell them something, that should be illegal.
All of our legal precedent about privacy, law enforcement surveillance, commercial data gathering, etc, really dates to the 1800's and early 1900's when things were fundamentally different. There is a qualitative difference when information can be automatically processed in aggregate.
I don't really care about individual corporate -- or LE -- surveillance actors if the data is partitioned over many and requires real subpoena power or active, limited sharing. If there's thousands of cameras owned by homes and businesses in my town, and everyone uses the pictures on their own for their own purposes, and law enforcement occasionally asks for and/or subpoenas the data when it'd be particularly useful and there's at least some suspicion-- that's great.
On the other hand, when we automatically read license plates and form a big database about where everyone goes every day, that's not so great. When individuals are all subject to mass-scale surveillance that we use with data processing and machine learning to manipulate those people-- that's not so great either.
If you don't feel comfortable with the government having that data, I wouldn't suggest giving it to private corporations. Even if they are standing up to gov, it means things can change. I think Snowden uses the phrase "turn key tyranny".
On one hand, I hear ya and agree.
But the reality is, the deck has been reshuffled such that while we're focused on that front door about rights are being sucked out the back by the likes of Big Tech, social norms, etc.
Yeah, the means differ. But in the end, the ends are the same.
That's a fallacy by both choice and externality.
There are cases in which there is no choice but to use specific corporate products, or in which choices are made without an individual's consent or involvement.
Karen Sandler, co-host (with former FSF directory Bradley Kuhn) of the "Free as in Freedom" podcast has an implanted, closed-source proprietary medical device. She can literally chose between non-free software (which includes surveillance), or death.
https://sfconservancy.org/news/2018/mar/26/sandler-fsf-free-...
Emergency medical services, government contracts, third-party contracts by various firms and organisations, third-party use of Gmail either directly or as a hosted email service (see Benjamin Mako Hill's "Google has most of my email because it has all of yours": https://mako.cc/copyrighteous/google-has-most-of-my-email-be...), and the issues of spillover externalities (Amazon Ring doorbell surveillance, third-party tracking of mobile phone SIMs, MACs, and Bluetooth signatures, facial surveillance) mean that, no, actually, you cannot decide not to participate in corporate surveillance.
And, as a final point, both government and corporate surveillance and oppression very often speak to the same underlying dynamic: that of power to defend both itself and its wealth and/or golden geese. Examples are numerous, though the Johnson County War would be a good case history: https://en.wikipedia.org/wiki/Johnson_County_War
Let's please put this canard in its well-deserved grave and bury it.
The overarching point is that it's naive to consider issues of privacy particularly distinct in the public or private sphere. Neither market nor political power are trivial to escape (and they have other things in common). Individual opt-outs will only get you so far from either a Google scale or state scale operation.
"No choice" in the sense that you lose business, lose touch with your high school classmates, or are forced to go out and pick up your own food from the restaurant down the street?
Or "no choice" in the sense that people show up at your door with guns?
What a privilege it is to be able to casually use the same language to describe such disparate outcomes.
Strategems in which individuals are denied the very fundamentals of life, food, shelter, work, engagement in civic, social, commercial, or cultural practices, access to courts, institutions, and the like, without overt threats of violence, are far more effective than guns.
to fight and conquer in all your battles is not supreme excellence; supreme excellence consists in breaking the enemy's resistance without fighting
I would expect that the greater debate on privacy will, over time, hopefully lead to some changes in how we are able to control the data generated by our bodies. Until that happens, I’m going to take the thing that saves my wife’s life with the potential for some shadiness or simple distaste at what may happen to her data, or, I might look at it as her voluntary consent which was fully given with her and my knowledge well ahead of time — helps to save others lives, and some loss of control of that data is actually quite noble.
As you might guess, I started at the abstract, but ended up at the concrete, and my wife really does have such a device, similar to your example. And I also work in big data analytics industry, and get involved in these sorts of discussions pretty often.
Let us agree that I can indeed avoid having a Gmail account. Can I realistically avoid sending email to a Gmail user?
Nope.
There are just too many users. Maybe I can avoid sending mail to <anything>@gmail.com (though not responding to one will invariably be perceived as incredibly rude), but I cannot avoid having Gmail users send email to me. I cannot realistically notice ahead of time that john.doe@example.com is actually using a Gmail server under the hood, and not send the email. I cannot prevent Gmail users from talking about me.
I can reduce my exposure, but there are limits to what I can reasonably do. Your usage of Gmail is hurting my privacy. Okay, not yours, but definitely half of my friend's. I can't realistically ask them to either stop using Gmail, or stop interacting with me, now can I?
Let us agree that individual choices and individual actions don't work.
While I agree with your larger point, I don't agree with this subjective value judgement and am not sure why it's necessary to lump it in with the rest of your (valid) points. Why do I want to see ads for things I'm not interested in? How is that in any way "better?"
What I definitely don't want is unauthorized humans reading my email. (Even so, I have to assume that is exactly what will happen whenever I type or dictate anything into a computer. I've operated on that basis since before GMail, Google, or even the civilian Internet existed.)
And now they have a mighty powerful pattern matching machine, they can easily ask more than where I could possibly spend money. They could ask for my political affiliations, or my sexual orientation, my social network (who knows, I may be related to the second or third degree to some nefarious terrorist?).
That last one is very worrying. Especially since recently, my country (France) is being eerily harsh with political opponents. I've just read a story about a journalist (whose income happens to come from YouTube & donations), who is being judged for… gang theft (the pun also works in French), risking up to 75.000€ in fines and 5 years of imprisonment, just because he covered the unhooking of a 8€ portrait of our current president in a Town Office (which usually have president's portraits, but this is not mandatory). Unhooking, they reportedly did not even take the portrait.
So yeah, I'm more and more worried about giving our governments the means to apply their increasing insanity. Sure, having an individual reading my private email is unacceptable, but that risk is getting smaller and smaller, in comparison, to the mass surveillance that automation enables.
You'll have to detail this particular implication.
I for one would think the opposite.
* also FWIW, IIRC, they don't read email for ads any more.
Karen's and my 2019 FOSDEM keynote (and accompanying podcasts) discuss her struggles with the medical device industry and how those struggles relate to the larger set of choices related to technology that we make. This isn't an issue that lends itself well to short-form discussion. The issues are quite complex:
https://archive.fosdem.org/2019/schedule/event/full_software...
https://archive.fosdem.org/2019/interviews/bradley-m-kuhn-ka...
http://faif.us/cast/2019/jan/13/0x60/
http://faif.us/cast/2019/feb/19/0x61/
But it was far too specific (and frankly too obscure) to serve as a general basis for argument. Pacemakers used to run on plutonium. Should that influence the larger debate over nuclear power versus fossil fuels?
If someone has to use a pacemaker or insulin pump that runs proprietary software, that's unfortunate as far as it goes, but the patient himself/herself is fundamentally fortunate to have that option. It would perhaps be better to focus on developing open-source alternatives than to rail against a particular manufacturer's policy... except the (captive) regulators will have something to say about that, won't they? Specifically, what they will have to say about the idea of an open-source pacemaker is "No."
What you are complaining about in this specific instance isn't corporate policy, but government policy. I'm actually very sympathetic to your argument, personally. I've made the point many times that any sufficiently-dominant corporation is indistinguishable from a government. But you need to be careful to identify the party who is actually forcing or denying choice.
Not specific enough. What they would most likely object to is code you can modify. Code you can inspect on the other hand is a whole 'nother business. And one could easily guarante their pacemaker runs the code the manufacturer says it runs, by having reproducible builds, signing the source & binary, and have the device itself communicate (at least) a version number.
Being able to modify the source would be potentially even better, but if we could at least inspect it, then we would know of bugs & vulnerabilities (some of which have affected Karen Sandler in the past), and the manufacturer would have no choice but be shamed and correct the error.
If you require home internet access to do your 30k salary job, you move into an apartment, and they tell you you have one option for internet access, you have literally been restricted to a single corporate product and subject to surveillance.
I wonder how much that was any given person, or just that the availability of such surveillance has increased dramatically.
The UK introduced (public) mass surveillance long before Snowden was on the scene.
Since then, combined with the ability to use AI patterns against video streams and even deep fake capability. My trust in most things is pretty much broken at this point.
Are you me?
https://www.theguardian.com/politics/2019/sep/07/smash-and-g...
https://www.theguardian.com/world/2019/sep/10/no-10-request-...
Edit: I wonder if this includes the petition site?? Can't say that I'd be too keen on the Dark Lord Cummings getting the details of my personal petition history!
Edit2: Yes, I know that's not his official job title, at least not yet.
It's the only part of that site I can see BJ actually giving enough of a shit about to go out of his way and double down on at this point. The rest of the gov.uk stuff is already very well managed and instrumented (and a great public service).
The Executive Summary provides a good overview.
In contrast to the Amazon book page that claims he helped "build" the system, it appears he was primarily a system administrator responsible for tasks such as patching and file transfers.
Also, Congressional report prepared by whom? Can't take a report by the fox guarding the hen house seriously.
It's up to all of us to take this report, and news reports and autobiographies, as seriously as you think they deserve. This provides background information not commonly known and is a valuable counter balance to Mr. Snowden's account. How seriously should we take an autobiography written by the person who perpetrated such (in)famous actions?
There is "selective reporting" on all sides, it's up to us to take it all in and form our own opinions. For example: read the report, note Mr. Snowden's length of service at each job, his age and experience, and consider how likely it was that he was a "senior advisor" or a more junior system administrator.
I understand this may be a lost cause, but I'm simply advocating for balance on this issue.
Both groups would have been necessary to build the a long term system.
Beyond that, I don't see how his status while working for the intelligence sector is very important, and I've never gotten the impression Snowden was trying to boast about how achievements there.
Even during the initial revelations, people who wanted to downplay the topic regularly pointed out that Snowden was "just a system administrator, not an intelligence agent" and attempted to debate whether he worked directly for the government or only for a contractor. It baffled me, because that doesn't even seem relevant to his claims.
The "government employee" issue would only matter if the authenticity of the leaks was disputed; the various PRISM and XKEYSCORE slideshows were never even challenged, so who cares? And "only a system administrator" sounds backwards to anyone who actually knows what sysadmins do. Dismissing him as a maintainer instead of an architect is a weird sideshow, since his role was mostly important as an answer to the question "how did he get undetected access to so many different files?"
It coming up again of again when Snowden is discussed is part of either controlled or natural occurring propaganda, a talking point of the regime. The one bringing it into this thread is a new throwaway account, go figure. One way or another, directly or indirectly, you are seeing the "controlling public discussions" part of what intelligence agencies do in action here :)
My main takeaway form the report is that Mr. Snowden was misleading/dishonest about elements of his past and motivations. Read the report for other examples of his misrepresentations, mainly that he never reported his suspected abuse of government programs via established internal process and he took and shared material on much more than the programs he was concerned about.
The discussion of the programs themselves is certainly much bigger. I view these programs as the nuclear weapons of our age. It was inevitable that they would be created (with similar capabilities in the hands of other governments and corporations), and there is always the risk of misuse. While the US Government is not the ideal owner of these tools, I generally trust the USG more than other countries and corporations.
The problem with intelligence agencies is that you rarely hear of their successes, and almost always hear of their failures.
His claim was that testimony was the "breaking point" on the decision to leak, not download files, and soon after he agreed to publicly be named the source.
>mainly that he never reported his suspected abuse of government programs via established internal process and he took and shared material on much more than the programs he was concerned about.
It's his word vs theirs on whether he raised the issue before deciding to leak. And he knew there was a ton of unrelated data in what he leaked, that was why he privately gave it to reporters and didn't publicly post it.