Judge orders Google to turn over a full year of actor’s data
chicagotribune.com
chicagotribune.com
Those who say that this is justified because warrants were obtained seem to miss the point that state’s ability and desire to gather information has grown exponentially over time. And that’s why we need data protection laws, alternatives to Google, and other privacy measures.
The philosophical concept of embodied cognition is a good place to start on this issue:
Or, why does the protection from self-incrimination exist? Is it because we are concerned that the government might have access to your thoughts? Or is it because the government would torture people to get confessions, and the people wanted to remove the incentive to do so?
Depending on your belief about this, you might feel differently about what should be done about this Google situation. If you believe the latter view in the second paragraph, for example, you might have no problem with the breadth of the search. In fact, you might not even have a problem with involuntary brain scans, provided they were proven accurate. As long as the rule of law is strong and the materials were used only for a defined and limited purpose, you might think it would be better if the government could compel the true personal perspective of the accused.
So this really enters into questions about each individual's perspective on the purpose and value of privacy. I think it might not be accurate to say that people who say it is justified are missing the point. They might just think the point is different from what you think it is.
What didnt i get?
edit: While it might sound stupid its an honest question. Changing how you think about the world is quite a jump from discussing the origins of warrants. Its a jump i dont understand and I think there is interesting insight to be gained here.
Or, more generally, warrants are not a positive attribute of an individual, instead they are a negative inhibitor of governments.
>In fact, you might not even have a problem with involuntary brain scans, provided they were proven accurate. As long as the rule of law is strong and the materials were used only for a defined and limited purpose, you might think it would be better if the government could compel the true personal perspective of the accused.
Hits it right on the nail how the argument goes, but i dont see how its related to the question of the true original meaning of a warrant. Its a moral question if you think it should be allowed or not. And since we are stuck together, at least some of us, this means its a political question. Do more of us think its good or bad, and can the other side prevent or do it either way? Can we compel the government to stop this? But framing this as a question of constitutional law instead of a moral question misses the point from my perspective. The point isnt if warrants should cover digital age surveillance. Why would anyone care about this who isnt a fundamentalist proponent of the status quo? Its not the dictatorship of the eternal legal code. Which of course would also just another motivation for your morals and thus your actions.
This just sounds like a religious discussion to me. Similar to, what does the bible say about flying planes? Allowed on Sunday? I first thought people in the discussion were just being pedantic, but i dont get how this changes someones view on the world.
To me its just same old same old, this stark difference has to be interesting to figure out.
NB: I think that's why Norwegian laws come with the rules in effect and associated writeups of why the rules were made this way.
My version of the argument goes something like this: It's often said that drivers (in the US anyway) are constantly violating minor traffic laws, and that if the police want to pull someone over, all they have to do is follow them for long enough and they will find a legitimate reason to do so.
I believe that this extends far beyond the sphere of traffic. I think we all accidentally break minor laws way more often than we think we do. We all way overestimate how "good" we are.
If it was possible to automatically punish everyone for every violation of the law, we would quickly realize that many laws aren't actually that important, that they can be broken a little bit, constantly, by basically everyone, and society still functions just fine, and that privacy is more important than perfect enforcement of law.
Of course this might lead to a new equilibrium where we perfectly enforce a smaller set of laws.
All this is to say that I think people think they value law enforcement more than privacy, but if they had the full force of the law brought down on them for every minor violation, they would quickly change their mind. In that way, privacy (in the form of the government not having perfect information) is actually quite valuable.
1. People would start to build in tolerances instead. The speed limit is 35? Ok, I'll drive between 25 and 30. People would not just say, "Welp, I guess I'm gonna get $200 tickets constantly!" There would be a (very) short adjustment period, and then people would just treat limits as the actual limits.
2. The limits would be changed to actually reflect the unsafe limit.
I don't think either of these are bad outcomes. In fact, I think the world where we perfectly enforce the law and also adjust the law to reflect the actual needs of the citizens is far better than the one we live in today. It is a much better world than the one in which certain real crimes go unpunished due to privacy, all other things being equal.
Practical justifications have to come face to face with reality, and 'searching one's home for drugs' is a lot different than 'reading all of one's thoughts for the last year'.
We are where we are with warrants, so now we have to address the disproportionate issue that can arise with the online world.
Why do they even have this data-- deleted material, browsing histories, the content of voice calls? Why did they store it in the first place?
Google can't keep all of its own internal secrets private. The fact that information on you can be extracted via a targeted court order shouldn't be your greatest concern: The fact that they possess it means that it can likely be exploited or extracted in many different ways including via dragnet surveillance and espionage.
The question is not why Google has your data, it's why you chose to continue using Google despite the awareness of such a scenario happening. As someone else commented, this article should be circulated far and wide, and people need to be educated on privacy friendly alternatives like ProtonMail.
Lastly, the courts and law enforcement are a problem if they knowingly overreach their limits. Protections against unlawful search and seizure and right to privacy are guaranteed by the Constitution
https://tresorit.com/, for example, may be a useful litmus test to monitor for this use case. They've had to implement soft deletion because "The option to recover files has been among the top feature requests we’ve heard from our users and customers" (https://tresorit.com/blog/file-restore-launch/).
There are foot-gun manufacturers if people want an alternative.
US courts have pretty consistently ruled that you don't have much expectation of privacy for material you handed over to someone else. To the extent that its usually available with just an administrative subpoena.
Skipping all forms of due process is probably a step too far-- but a direct court order? After all, if Google can commercially exploit your data including handing it over to partners-- why should a court order result in less access?
Just because you hate Google doesn't mean that the warrant is invalid or the search is unreasonable here.
Jussie may have committed a crime. They have the right to investigate.
Never mind that that Amendment technically has nada to do with this, because technically speaking, 4th Amendment for the person in question stopped applying due to Third Party Doctrine.
This is purely a procedural issue between Google and the government.
Read that and take it in for a minute. You're only as secure in information about yourself as you can say that you alone are the chief facilitator of your day-to-day activity, and that where you aren't, those who are hold government to the proper standard of access.
Furthermore, I"m fairly sure that Google has far more detailed information hoovered up with regards to everyday people than they wish to go on the public record as having. If this were a fishing expedition, and they handed over replication tracks for 2 months for instance. That would become verified public knowledge that they collect that information, and store it in queryable form.
Google is acting very shrewdly to disclose as little about their true data collection capabilities as possible. Likely because of the backlash that would occur if people were aware of just what they were sitting on.
There was a Jeffrey Deaver book that somewhat touched on the dangers of sitting on reams of correlable data, even if measures were in place to ensure none could be written down or physically exfiltrated from the building. The Broken Window I believe it was.
Either way, it should disturb everyone that the government has essentially got a one-stop-shop for just about all the detail about what you're thinking about, all enabled thanks to the requisite tracking for ad targeting.
Heck, If I had more spare time, I'd start building my own search indexer. The balance between personal privacy and government access to reams of metadata about your every day life can't be reconciled with Third Party Doctrine. Period.
Also they allow people to opt out of tracking, which is probably how they kept the govt off their backs thus far. But of course few people are aware and savvy enough to opt out of systems which allow it, which is why many want to change organ donation to an opt-out system rather than opt-in for example.
It's not how it works at Google.
This is, hypothetically, possible if they encrypt all data on-disk with a per-data-item key and the key itself is never backed up; if deletion deletes the hot key, the cold backups are now just noise and it doesn't matter if Google deletes them.
Disclaimer: I work at Google, some of my work relates to privacy infrastructure, but I don't speak for the company.
That's still problematic though, because with clever orchestration of multiple warrants, you essentially figure out the "shape" of hidden information anyway, until you can get the request just right.
The idea though is that a judge should get tired of signing warrants for the same person by that point though, as it should not be an automatic process, and should only be being done on a case by case basis as evidence or procedure requires.
In theory at least.
Everything Google knows about you is available for you to retrieve, delete, and often even change. You totally can selectively edit your location history. It's not a forensic log because that's not the utility users get from it. The fact that courts want to use it as a forensic log is their own damn problem.
>— Cook County prosecutors drop all charges against Smollett, calling it an “appropriate resolution to this case.”
>“After reviewing all of the facts and circumstances of the case, including Mr. Smollett’s volunteer service in the community and agreement to forfeit his bond to the City of Chicago, we believe this outcome is a just disposition and appropriate resolution to this case,” the statement said.
WTF? Since when bribe constitutes a ground for dropping charges?
0. https://www.chicagotribune.com/news/breaking/ct-met-cb-jussi...
You mean fines? I mean, fines have been around forever, and everyone from the President down to the little guy has paid fines to have charges dropped. This is not a modern thing, nor is it rare.
It's more surprising that you are surprised by this.
The only difference I can think of is traditionally documents are destroyed after they are no longer needed. Now they can see “deleted” documents and document change history.
i.e. emails stored locally on a personal or company server can be permanently destroyed. Traditional email systems won’t have a change history of the email writing process)
(I imagine all sorts of games could be played by lawyers with access to this additional types of information.)
Prior to that, it was possible to have that information manually logged. If you corresponded with people in a Warsaw Pact country in the 1960s, that mail was recorded and sometimes opened.
It would only be equivalent if every letter was opened and recorded so that all the contents would later be available because this subpoena covers not just emails but also drafted and deleted messages; any files in their Google Drive cloud storage services; any Google Voice texts. This isn't metadata the government is coming for, it is the full content.
It's the exact same problem with phone metadata. The connections can be made to tell the story, and are even easier to manipulate into whatever narrative the prosecution wants to sell.
In my example, you probably thought "person has cancer, household receives letters from the government post-death, bill from the funeral home", which is exactly how it could be sold. But it could just as easily be "person beating cancer, household receives government forms related to healthcare subsidies, funeral home letter was a condolence letter sent one year after the death of their parent." This is why metadata is so dangerous, it's far too easy to spin.
If this was of any doubt at all - they’ve made this accessible over email. If you enable “informed delivery” you get an email of the scan before it hits your mail box.
You mean those emails I get that the USPS claims it doesn't have an image for?
Oh don't worry they always have images of the blanket spam everyone gets. But actual mail with bills or letters? It's more usual to get "A piece of mail that we do not have an image for is included in today's mail."
My dad at one point was an inspector general at a government agency. They would use records and “physical metadata” like building logs and receipts for the purposes of their work. The difference today is that your allowing many third parties to gather that data.
That’s the key thing. If you store data in the custody of a third party, it isn’t yours.
Pretty much every paper that is involved in discovery is classified by the "custodian". Also of course, all the digital information, but traditionally it's paper.
If you use and/or have a dispute with a lawyer, a doctor, a contractor, an accountant, whatever, they're going to have papers pertaining to you.
Your doctor and attorney are unique in that professional relationship is legally privileged.
Just that the measure of recorded data is perhaps several orders of magnitude larger that it was merely ~20-30 years ago.
I think back to my life in the 90s, and what information was recorded about me as I went about my day-to-day life, and it was minuscule compared to today. You could track who I called, but not what I said. You could track some of my purchases, but I used electronic forms of payment much less then.
Now, I text or message much more than I voice call, so that is all recorded. Every now and then if I want to get really freaked out I go to myactivity.google.com (I've got an Android phone and am otherwise "all in" on Google services) and, say, playback my location history, search history, or everything I've said to Google assistant.
I think we are really just coming to terms with the fact that "ephemera" no longer really exists, and the deep impact this will have on society.
If it's sitting on a backup tape in a vault somewhere, they delete all copies of the corresponding one-time personal decryption key instead.
LinkedIn has a remorse period of something like 21 days. And I had plan to test recovery process also. Then got busy with a contract and was too late to recover. It's awesome!
I think any global IT company must deal with GDPR kind of like most automakers in U.S. follow California emission standards. It's easier to create a policy for all than create "one off" policies for a geopolitical region.
As such, we should not self-censor, but instead disengage from these proxy-cops and move to more distributed spaces.
this is not true, but in the way that makes your point much, much worse.
In the US, case precedent is already set that digital data that you don't physically own is not yours. IANAL, but my understanding is that the standards for digital search-and-seizure are lower for cloud services, not equivalent or (god-forbid) higher.
https://www.reddit.com/r/ProtonMail/comments/biusm7/transpar...
Edit: obv PM’s canary is public and has disclosed they’ve released data to the Swiss courts, but it’s pretty much as advertised; ip logging is raw but the rest is encrypted.
> not just emails but also drafted and deleted messages; any files in their Google Drive cloud storage services; any Google Voice texts, calls and contacts; search and web browsing history; and location data.
The implication being that the courts are corrupt?
If that's the case I think you have way worse things to worry about than "data access", the courts have much greater powers than that.
If the court gave a similar order to retrive similar amounts of physical (eg paper) information from your house, and anyone you happened to correspnd with it would be extremely notable and expensive as well as creating dramatic television pictures. Some of that is a deterrant to its abuse.
"Google, fetch" the scale, ease and speed of that is worrying. How is its abuse to be stopped?
You don’t have to be corrupt to be ineffective. Have you been following patent rulings? Or FISA?
What happened, basically, from memory, is that someone was arguing that Google did something wrong (I forget, but it might have been the collusion to keep down employee wages or something) and so there was discovery of emails by Google, and they eat their own dogfood so it was gmail.
So Google smugly said "hah, there aren't any incriminating emails", but then it turned out that the autosaved drafts of some of their emails were incriminating, and were preserved, and ended up being produced in court.
So remember that the next time you type an email or a forum or facebook post, and you revise it extensively before hitting the button to send it.
Basically, Google relied on an algorithm/search engine to screen for privileged documents instead of having lawyers review things the old-fashioned way and they got bit by that.
How would that help? They'll just get a warrant for those.
> This is some terrifying stuff.
You have a strange definition of terrifying. This is how the law is supposed to work.
You do realize they can also go in his house and search through his things? Or order his friends to talk? That's what search warrants are.
In terms of e-mail, any service that encrypts at rest and doesn't maintain the key can only hand over encrypted data. ProtonMail would be one example.
If the business is not based in the US, it will make getting a search warrant much more difficult. Your (e.g.) Protonmail account is less likely to be subpoenaed than your Gmail.
Or order him to turn over his own email.
Which they could have done in this case. So why subpoena Google?
This isn’t a phenomenon unique to Google. Google just attracts attention because of the broad scope of what they do.
(I am not a lawyer but) AFAIK there's no particular form of communication that's immune to discovery but for Google.
If your objection is that it's weird Google has kept that data, sure. I get it, I use DuckDuckGo, Firefox, and I host my own email server on a VPN. I'm struggling to understand why this particular aspect is weird though. It seems totally normal that the government would seek this information as part of a criminal probe.
Remember that the govt seizes this info about you to prosecute you, but you don't get this info about them for all their suspected crimes.
Making sweeping general statements is good for riling up the mobs but I would implore HN readers to be more pragmatic about these things.
Look at the context. This person sought to ignite racial tensions for personal gain. He was given a sweetheart deal. The State is going after him and those protected him. They (the State prosecutors) have every right to collect and gather evidence to build the case.
Another way to look at that 'duty' is to say [The] state has a responsibility to ensure justice for all. That may seem like the same thing but vagueness is at times valuable given that life rarely satisfies the black and white dichotomies many of us would prefer.
We can have a discussion about how the state should behave without using catastrophic examples to shift debates about principles and policies.
The post I was responding to sees the role of the state as a absolutist binaric executor of often fuzzy laws and rules. The context of this example doesn't have any affect on whether or not that naive belief is a path to a functional and just society.
Whatever happens with Smollett, or the next example, simply doesn't support a belief that every crime should be prosecuted. There was a (hamfisted but entertaining) TNG episode about this for gods sake...
Plow the money into courses on basic reasoning, civics, and grants to non-profit, independent media so that the people benefit when for profit media pushes a war for profit or racial divison for more ad revenue.
The problem here is that they are going about it in the wrong way. Issuing a warrant that says, "Well, show me everything this guy ever did, and I'll tell you the crime I want to prosecute him for later."
That's not how most warrants work. Most of the time it's, "We suspect X evidence generated in the commission of Y crime is at Z location". What this does is say, "We need all his data to figure out exactly what crime was committed". That's an ominous warrant.
This is a necessary "evil". We give up some freedoms so that we have a civilisation and an orderly society.
And this isn't setting up any precedent that is egregious. This is on the front page of Chicago Tribune newspaper and on the front page of HN. This is not some shady in the shadows invasion of privacy.
Those things do happen and I think we should preserve our outrage for those moments. Otherwise it just becomes background noise to be constantly and without context offended.
That creates an almost arbitrary, "this fits my worldview so I'll support rights this time" thought process. Like, "Well, this guy's a Nazi so we should trample his rights. But this woman's an abortion activist, so we should be sure to protect hers."
How do you propose we prevent ideological blindness in the protection of rights? Should we take the government's word that, "this time, it's really worth trampling rights"? Or would you create an unbiased oversight board that tells us when protecting rights is appropriate? Or should each person look at a case and decide for themselves whether or not they should take a stand against rights infringement?
This is not some shady in the shadows invasion of privacy.
Be wary of the motte-and-bailey fallacy - the issue is not that The State can look at certain records in certain prosecutions, its that the records currently being requested are too broad and too potentially intimate to trust The State with.
There's no new precedent involved, noone ever had any privacy whatsoever from a properly court-approved search. What's the most privacy-invasive thing I can think of? If a judge believes there's probable cause in searching your anus and other internal cavities and authorizes such a search, then such a search is compatible with all the precedent regarding fourth amendment in USA.
No, not really. A physical warrant might be issued for your home, your work and maybe one other place you frequent.
However, because this is very much not a specific search, but rather the whole year of data, it's more akin to issuing search warrants against every business you've walked passed in a year, whether or not you actually entered the premises, and that's just to begin with.
And if you tried to issue warrants in that matter, they wouldn't approved, because you do have certain reasonable expectations of privacy with regards to a court-approved search. Specifically, that a court will not explore things that are not pertinent to the case.
I mean this passed the proper checks and balances of the law, and the only reason this is on HN is that's about electronic instead of paper mail, and it involves a big Corp.
With data from Google they can prosecute you for all the things you've done wrong or seem to have done wrong. It just takes an ambitious prosecutor to do it. This pretty much destroys the point of the fifth amendment. The "Don't Talk to the Police" lecture [1] is still relevant today, but if the state has this much evidence of what you do, then I'm not sure that will protect people. It is a nightmare scenario if this sets a precedent on law enforcement being able to vacuum up all of your data about your life.
I agree that Smollett seemingly getting a slap on the wrist was outrageous, but I think that this is Pandora's Box that they're playing with.
[0] https://blogs.loc.gov/law/2013/03/frequent-reference-questio...
The State has always been able to look up phone records, bank records, land records, criminal records, medical records etc etc as in order to pursue justice and prosecute.
How is this any different?
How this seems different is the lack of any limitation on the kind of content that can be turned over. And in my view, that was a mistake on the judge's part for approving such a sweeping request.
For instance if I were accused of committing a crime against X, then I suppose that Google could be asked to turn over e-mails that I wrote about X, but not e-mails about my bicycle. This is how the system prevents the state from going on a hunting and fishing expedition.
What if the Jussie and his manager were using codewords to disguise intent? A search algorithm would not be able to recognise that but a human being can easily infer meaning and intent from the context. What then?
There are no easy answers.
This distinction wasn't a major concern when the former was impractical.
Because of digital records and search agents, suddenly either is practical.
The intent of privacy law has always been to raise the cost of targeted prosecution. E.g. "We want to charge this person with a crime, let's find a crime."
The state absolutely has a duty to prosecute and hold individuals accountable. And in extraordinary circumstances, may even need to target prosecution.
What is unacceptable in a free society is that the state should have the ability to target anyone for prosecution with no effective bounds in the number of simultaneous times it does so (aka everyone).
The difference between Orwell and a safe democracy is scale.
In this case, the state is expecting evidence to exist in the form of incriminating email communication between Smollett and his manager, and possibly additional people. From the public evidence so far, it sure seems like a reasonable expectation! I'm a pretty hardcore civil libertarian, and I'm having a hard time faulting the judge here.
What else do you expect?
The state has probable cause to believe there is evidence of criminal behavior in your <insert anything here>. Therefore the warrant gives them access to it in order to look for that (previously specified) criminal behavior. In this case everyone expects to find a smoking gun in his email - either talking to his manager or talking to someone else. That seems like probable cause to me.
Then why is the warrant not for _that_? Instead, we have a broad-reaching data pull that will be filled with a ton of information is irrelevant.
So the difference is seeing something through a window with curtains vs. having a camera installed in the room. In principle, not so different. In practice there really is no comparison. It is basically a warrant to ruffle through someone's life.
Which, for what it's worth, is a warrant that is perfectly within the powers of a judge to grant.
At what point do we want the legal system to no longer have the power to scrutinize an individual's history?
I don't believe that a warrant to "ruffle through someone's life" without limits is within the powers of a judge. A warrant to procure relevant evidence to a case being investigated, legally, certainly.
Issuing an order for someone's entire Google history for a year is bordering "an unreasonable search and seizure", by my understanding. Do they have legitimate reason to believe that there is an email containing evidence? Or a document in Google drive? Location data for an entire year - how is this relevant to the case?
That’s different than stating that you would like to browse through someone’s history for the purpose of finding crimes where they may not exist.
He's counter-suing for malicious prosecution.
Also imagine just how much more power law firms on the plaintiff side would have if they want to find something wrong with the defendant's profile. Which, if there is power misuse, like in current society, is bad.
Not under the 4th amendment of the US Consitution they don't, they have the power to grant a warrant for a Specific thing to be searched pursuant to probable cause a specific crime has been committed
General Search warrants are and should remain unconstitutional
With 'Google Home' etc. it changes everything. Door locks, home cameras, audio recordings etc. etc..
Can the argument you had with your wife, totally irrelevant to the case, wherein you got angry and called her a big 'B' be used against you in court as demonstration of your character?
The time is now to be concerned about 'police state'. I think we can mostly have our cake and eat it too. Proportionality matters on all sides.
https://en.wikipedia.org/wiki/Mere_evidence_rule
In broad strokes: Originally, the Fourth Amendment only allowed for the seizure of stolen and counterfeit goods, the "fruits of a crime." This was slowly expanded to include the "instrumentalities" of a crime, i.e. the things used in the commission of a crime. The difference between the instrumentalities and mere evidence was always shaky, and eventually crumbled.
Edit: A few more: reading a newspaper, turning on a light, making a grocery list, setting the thermostat, going for a walk in the park.
10-ish years ago, it wasn't possible to retroactively subpoena a year of minute-by-minute location history, because unless you had an ankle monitor, that data didn't exist. You couldn't get a letter-by-letter log of every term typed into a search engine or a log of the amount of time spent looking at pages of reference material. You couldn't get a record of every keystroke ever typed into a mail client or word processor. You couldn't get every photograph ever taken by the individual, because cameras didn't automatically send a copy to the mothership. This is way above and beyond standard paper seizure or record demands.
"Write angry letters, but don't send them" used to be good advice, but now that the government can just casually dash off a search warrant to produce every keystroke and every location ping within a year of a suspected crime, we all have good reason to be scared. Why'd you search "marijuana" that day last October? You expect me to believe you were just researching a ballot measure? Pfft.
This makes Big Brother a tangible reality. It certainly feels big to me.
Now it becomes scary only if the authorities decide to go amok and make criminals of us all, but assuming it goes this way without anyone pushing back is not too realistic.
Then they came for the trade unionists, and I did not speak out— Because I was not a trade unionist.
Then they came for the Jews, and I did not speak out— Because I was not a Jew.
Then they came for me—and there was no one left to speak for me.
Just like security and usability are tradeoffs, so is this.
Only if that involves a complete overhaul of the police itself. Currently we have body cams that just fail at convenient times, policemen stalking their ex girlfriends and whistle blowers that get the short end of the stick. Giving the police more and more power is more likely to reach a turning point where it inherently starts to attract the corrupt and power hungry, increasing the abuse well above what we already see.
This becomes terrifying when you realize the implications for quashing dissent. An inconvenient activist is an easy target for the legal system.
The other anecdote in that link is the story of Joseph P. Nacchio, a CEO who was convicted for cashing out over $50 million in stock when the price was around $40, only for the price to drop all the way to $2 a year later. The NSA involvement was a failed bid by his defense to make it seem like his trading was legitimate.
This is exactly the point. The way the law is written gives prosecutors too much leeway to convict, and if you become a problem in the eyes of the powerful, they can "throw the book at you".
> The other anecdote in that link is the story of Joseph P. Nacchio, a CEO who was convicted for cashing out over $50 million in stock when the price was around $40, only for the price to drop all the way to $2 a year later. The NSA involvement was a failed bid by his defense to make it seem like his trading was legitimate.
You left out how the government canceled their contracts with Qwest after Nacchio refused to give them access to phone records, which impacted the company's health. There were certainly other problems at Qwest, of course, but given the lax prosecution of many others involved in such scandals, it certainly feels like this is an example of this process in action.
40, or even 20 years ago, the State might have been able to note a record of phone calls, postal correspondence (look up "postal covers"), some financial purchases, periodicals subscriptions, and with a great deal of effort, some of my travels and movements, mostly limited to specific port entries and exits, and air travel.
But unavailable would have been: dictionary queries, encyclopedia queries, books read, specific magazine articles read, the contents of virtually all conversations, detailed movement and location history, social associations, detailed purchase history, and more.
Today, mobile devices report location to a precision of inches at a frequency of minutes. Any random query of momentary interest can create a permanent record. As a HN submission earlier today notes, simply casually perusing a document -- clicking a link -- can result in having your home raided and all electronic devices confiscated and held for a year: https://news.ycombinator.com/item?id=21992491
The scope and scale of intrusiveness is absolutely unprecedented.
Yes, the State has some rights and powers. It also has a tremendous responsibility, which it increasingly seems to fail to excercise appropriately.
And I say this regardless of specific country or jurisdiction -- the story linked above comes from Germany, and instances readily come to mind from the UK, US, Japan, China, Russia, India, Saudi Arabia, and elsewhere.
The corruption of absolute power is not bounded by culture, constitution, or ideology.
Anyway to get to your main body I agree and note what makes the scale bad ultimately is abuse potential for it. For a fantastic example being able to look up details of everyone but only 500 years or more ago wouldn't be abusable for instance because everyone is long dead and it wouldn't be viable to try to change ownership based on it because it already diverged for several generations. Even if you could backtrace they couldn't be reconciled very effectively.
The notion of innate human rights is a collective claim on rights. It is not the only mechanism for claims to rights.
States' levels of effective control, and hence, access to rights, vary greatly, from near-absolute to wholly impotent.
This approach is based on rights as a pragmatic reality, not a moral ideal.
It's very bad. Text and email should be private, unless it is in the context of the action being pursued. This is just too much data to just turn over willy nilly. Very slippery slope.
>How is this any different?
The cost of doing those lookups. Both in money and time. Looking up an entire life's history would have taken months if not more, and would involve a lot of legwork, from picking up the phone and making calls, to traveling around neighborhoods or farther. That cost limited the charging/prosecution only to people suspected of, or implicated in crimes. Today you can do that on a whim because you don't like a person or because they are your political/business opponents.
That doesn't mean there should be enormous databases of everything people do for the state to access at will.
For a judge to issue a warrant, a prosecutor or cop has to swear that they have probable cause to believe that you've committed a specific crime. Judges can't just write warrants arbitrarily. (Of course, this process can be abused, but it's still pretty far from a judge being able to authorize pulling the data of random people.)
The Fourth Amendment says: "... no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
You worked here and had access to x
you fit a profile or someone you know
you are an enemy of the state
It's bad that one signature from a judge can unlock all of that.
beside, it's not a case of the state tracking persons unwittingly, it's persons willingly giving up their data to private companies.
Perhaps you'd prefer the prosecutor look at some other case but then the exact same question could be asked - why that guy?
So why not this guy?
He was ready to send innocent people to a potential life sentence or the death penalty (which is how hate crimes are treated), and in fact is still maintaining his lie.
All over a contract dispute. Evil stuff.
This story isn't about politics, it's about corruption at the high offices.
How about "because he couldn't let sleeping dogs lie"? The guy got a lucky break when someone dropped the prosecution. He had the opportunity to shut up and let the story fade away. He didn't take it.
No matter how lucky you are, if you keep doubling down, eventually the house takes your money.
With a warrant they convinced a court to issue. This is totally different from e.g. dragnet surveillance.
I'd be weary of them using this data to try to go after him for some obscure crime completely unrelated to the false report (e.g. pics of him walking his dog in a state park that forbids pets).
It's not like this was brought up as part of a single court case if not related which would make it a relevant precedent here.
In a democracy the job of the police must be difficult.
Another thing to keep in mind: “igniting racial tensions” as an investigatory justification was how MLK got labeled the gravest domestic security threat to the United States. You’re advocating a categorical justification with a fraught and bloody history.
Better civilian oversight is overdue.
Mens rea is the guilty mind required for something to be a crime. Intent matters as much as outcome or chance of outcome in the judgement of whether a crime has occurred, and explains the use of "sought" in the comment you replied to.
The story was just uncomfortable for me, so I felt relief when contradictory testimony was found. I live near Chicago in an area both white and black, and mainly left-wing. I didn’t dare bring the story up with my black neighbors, and never heard about it from them either, despite its high profile. It was a very self-conscious couple of weeks. In contrast, when Obama was running for office people couldn’t help talking about that, and the sense of pride was real.
There was really no benefit to expressing doubt either; actual tragedies and abuses (Laquan McDonald murdered by the CPD, for instance) are still fresh in everyone’s mind. If current events weren’t as horrific people might be more comfortable expressing doubt and maybe even laughter over a guy with basically a homemade lanyard around his neck.
There is nothing pragmatic about being totally ignorant of Fourth Amendment protections that have been eeked out, injustice after injustice, over two centuries.
They should have the right to do it. Actually doing it should be as difficult as humanly possible. It should not be as easy as sending a letter to Google and getting a suspect's entire life records in return.
Because if it's too easy they will be tempted to do it as a matter of routine.
> How is this different from a warrant to search a home?
They have to actually go to the home in question in order to execute the warrant. They can't automatically search all homes.
They can't automatically search all accounts - they need to demonstrate the probable cause to a judge first.
The context is extremely partisan twisting of the justice system on all sides. Normally DA's have complete discretion to drop charges as they see fit. Because of the partisan outrage a Republican special prosecutor has been appointed to overrule the prosecutor and now he's on a witch hunt going through a year of Google records trying to find everything incriminating, this is a farce and high level corruption
No one should keep such records as society is changing and not always to best. This is one of the reasons, privacy is one of fundamental human rights. And is blatantly violated for the profit.
But this was a real crazy time. Hypothetical scenario (in the sense that I have not verified it, but I do think it's a very likely scenario to have happened): There were medical records of people with physical conditions before 1933 (so they could be treated) that were used under the Nazi regime to persecute them. Does that mean it that hospitals and doctors maintaining a list of medical records to treat their patients efficiently was a bad idea ?
I don't have the answer to this, I just wanted to point out that this is a delicate issue that society needs to figure out fairly quickly if they want to have an influence its outcome.
I wonder what godwin would have thought about all this :)
Anyway it is not such a hypotetical scenario, nazis were really killing the disabled persons based on their medical record (yes, qwant or duckduckgo for it).
Yes, it is a bad idea that doctors keep those data. If insurance companies get those information (and my dentist said he was already aproached by some company to sell dental records, I wouldnt be surprised if this is a common practice in states) you will have issues. Same with employees etc., even if nothing wrong with your health but there is x% chance that you get terminal disease.
Those records should be handed over to the patient, tamper proofed (no, not blockchain, just RSA will do fine) or stored, but encrypted with patient key. Actually when writting this I remembered that we (as in my country) are having a medical smart card that needs to be given to the doctor to access our medical records. Maybe we already have such a system.
Anyway it is a bit sick comparing google with doctors. The need and trust is on completely different scale not to mention that trust between doctor and patient is handled by laws and hippocratic oath since 257 AD.
As a legacy of this, the US government doesn't count Jews in the census. (And, to preserve nondiscrimination values, doesn't count other religious denominations either.)
Interestingly, the census does enthusiastically collect race data on everyone. This is logically incoherent; racial groups (such as the Jews, actually) are at least as much a natural target of extermination efforts as religious groups.
(It was also stigmatized because it was a lethal disease that spread by unclear means, but that seems less relevant to the topic at hand.)
Even if you have been naive enough to voluntarily share data with Google.
If Google were to apply the same logic to their tracking, we'd be in a better place. For example, they may want real-time location data for the traffic alerts when using Maps. And they may desire some aggregated form of that data long-term. But I cannot see any business benefit to Google maintaining my personal location data at specific times and dates in the past. There is zero business benefit to keep that level of detail in their logging.
Or, to answer your question more directly, that is the line I do not want to cross - where we are logging personal data "Just in case" we ever might need it. I'd like to see every piece of tracked data tied to a specific business need, and then have it deleted when that need no longer is relevant.
Whether it's Google, Microsoft, your ISP, a databroker, a webscraper, an unscrupulous app developer, or even your TV, I think it's safe to assume that one day or the next, every piece of content you produce, or topic you discuss will leak its way onto a major adcorp's servers.
I can hardly think of anyone I know that can't attest to the experience of discussing something as a non-sequitur, only to receive ads about it shortly thereafter. Even visiting an old friend with vastly different interests, never enabling location services, or connecting to their WiFi, I've noticed vast changes in my ad regime.
Decentralising your web activity can only make you less easily monetizable, but you'll never escape the panopticon, and Google can release data it got from third-parties just as easily as the data it collected itself.
If you want to say something you don't want Facebook, Amazon, MS, Google, or the state to hear about, do it in the woods or a private room away from anything digital.
No way in hell that's true. Things are bad enough, you don't need to make stuff up.
I'll admit that it's quite likely that advertising algorithms are sophisticated enough to anticipate our needs based on previous behaviours with uncanny precision and timing.
But I don't trust to that, given the proliferation of cheaply made gimmick apps which contain embedded third party ad libraries.
Since I have no way to verify either way, and my experiences are echoed by my social circle, I personally think it best to assume the worst of my device.
I will mention that a recent study* concluded that most apps with microphone permissions will not unduly access do so. This has been taken by articles I've read to dispel the urban legend of the listening phone.
But, given that the tests lasted 5000 random user events (at ~16mins), on a more or less clean device, and as the study says
"…we did not use pre-configured text inputs, which vary across apps and require substantial manual effort; instead, we relied on random interactions. Accordingly, we miss some events that only human in teractions trigger, e.g., in apps that require login."
I don't think it can be taken as an authoritative final answer. Especially given that the devices had no pre-existing identities apps to latch onto and inform about.
The study also looked principally at network traffic, with a focus on detecting conventional media formats. This is fine for detecting the transfer of visual content, and audio. But it doesn't account for the device itself listening for keywords, and reporting them, or partially resident models, which would perform their first few operations on-device, before transfering their outputs for final processing server-side (mentioned in their study's limitations section).
*https://news.northeastern.edu/2018/07/06/is-your-smartphone-...
EDITED for formatting, flow, to acknowledge parent's experience, and to remove a few points made redundant later in the post.
In the mean time: I think it would be trivially easy to verify: just take a rooted phone and log accesses to the microphone. Somebody would've found that it's being activated when it shouldn't by now.
>I'll admit that it's quite likely that advertising algorithms are sophisticated enough to anticipate our needs based on previous behaviours with uncanny precision and timing.
Or it could be that among the hundreds of random ads we see online everyday one of two happen to be related to one of the dozens of conversations we had in the past days.
That's actually a pretty good idea. When I'm in a position to get a rootable handset, and have the time to audit my apps, I'll have to try it.
With respect to your second point, it's quite possible. But I don't actually see much diversity of ads to begin with (typically tracking closely with my purchase and search history) so anomalies stick out like a sore thumb. But I'll be the first to admit that I spend a lot of time trying to figure out why I see what ads when, and I may at times overfit my explanations.
I'll never be able to prove the assumptions I make.
It is a phenomenon I've seen reported in the media, and it tracks with how I percieve my own experiences, as well as the experiences of my friends.
If it made no financial sense, I'd dismiss it. Likewise if I saw a study that convinced me beyond a shadow of a doubt, I would dismiss it. If there were legislation with teeth in my market to prevent it, I'd dismiss it.
But with the ubiquity of voice recognition, and the financial incentives at play, I just don't see a reason companies wouldn't leverage the tech for the purposes of superior ad targeting, and profiling, when they already go so far as to record our screens.
>That's actually a pretty good idea. When I'm in a position to get a rootable handset,
I meant easy for any security researcher, to the point where one would've found something by now. But if you have assistant or siri on your phone then the microphone is always on, so it wouldn't really be trivially easy to test.
https://www.consumerreports.org/smartphones/is-your-smartpho...
It can be just targetted marketing, perhaps your colleague googled the book or saw the book on Amazon after getting a random ad. Ad companies understand that if someone close to you liked a product, there is a chance you will like it to so they prioritize advertising similar things to those on your WiFi/location or background.
In any case, I find it very unlikely that our devices are listening to us talk and report it to ad servers. I doubt conspiracy of level to pull it off would be still a secret. It would need to have both Apple and Google engage in it, engineers working on it would have to keep silent, it should be virtually untraceable and so on. It's just much easier to explain as coincidence along with some targetting due to ads your social circles engaged with.
See: lottery fallacy [1]
Separate to that this comment has absolutely nothing whatever to do with the parent comment, whether you agree with the parent or not. Rights should exist for everyone, not just everyone you happen to like. Whether this warrant has gone too far as the parent suggests and it is necessary to take countermeasures or not is the argument, not your feelings about someone accused of something which frankly have no baring on anything in such a discussion.
The source material, ie article published by the Tribune, was completely unwilling to come to that same conclusion in the story. So to me it seems more likely that it is in dispute on that basis rather than that is is indsiputable due to wholly unsupported comments here.
But again it doesn't matter at ALL. It has zero relevance to this discussion. None. No really.
Rights are especially important when they relate to people you dislike doing things you also dislike. That situation is exactly when you lose your rights. Like maybe think about if that's is what is happening here.
The Tribune refusing to come to the conclusion that such is a fact is a conspiracy? Something stranger? Could be, I guess. A less likely than an alternate interpretation of the evidence I've seen here. But i don't care at all about it. Zero.
It still has absolutely no baring at all on the discussion of rights erosion.
Alexander Hamilton and James Madison also had "extreme" views
FTFY. I don't believe they have the same legal authorities to compel companies incorporated outside of their country jurisdiction to do the same, correct me if I'm wrong. This isn't the same as a sharing agreement done as a diplomatic quid-pro-quo however, which I'm sure also happens.
As much as I disapprove of Smolette, we cannot let the state overstep it's boundaries and jurisdiction. They'll have to prove it while being compliant with the Constitution
As for Google, while I agree with you, the reality is that their business model relies on personal data, and we're none the wiser continuing to use them despite this knowledge. How many, even within the HN community, will bother transitioning away from Google, after reading this?
In January of 2016, he performed "Strange Fruit." In 2017, he released a music video featuring a fake Trump, "alternative facts," and a noose. I haven't dug into it myself to verify, but I had heard in 2018 he and Kamala Harris were around one another on some kind of anti-hate-crime bill rally. I am less sure on that one.
Now, I am not sure how much actual planning (detailed plotting) went into it, because as hoaxes go, it does not seem especially well-executed. Downtown Chicago as "MAGA Country" is especially far-fetched.
How many people have been silently tagged as innocent because of their data stored?
That said, ersonally I find the loss of privacy abhorrent, especially because I have fuck all rights in the US (not a citizen, so the US government and US corporations can abuse my personal information with very little recourse from me or my own government).
Except you don't control them and could be faked and used to frame you. The power imbalance here is absolutely astonishing.
Google the title. Others news sites have it.
https://edition.cnn.com/2020/01/08/us/jussie-smollett-chicag...
Does the “Ad” company have more data on an individual versus the “privacy” company? Or does it actually depend on the user opting in to give this data to said company?
The iPhone unlocking for the mass shooter was slightly different -- FBI wanted them to create a new tool (that did not exist) to unlock an existing phone.
"And if we believe a request is overly broad, we seek to narrow it -- like when we persuaded a court to drastically limit a U.S. government request for two months' of user search queries."[1]
If they refused to hand over 2 months of search queries, I guarantee they didn't just hand over a full year of all user data.
[1] - https://support.google.com/transparencyreport/answer/7380434...
Does anyone have an alternative source for this story please?
>
Smollett reported that two men attacked him near his high-rise apartment in the Streeterville neighborhood on a frigid night last Jan. 29, slipping a noose around his neck and shouting racist and homophobic slurs. Jussie Smollett files counterclaim against Chicago saying prosecution was malicious »
Smollett’s manager — whose Google account information has also been ordered turned over — called 911 to report the attack and met responding officers in the lobby of Smollett’s building. He can be seen on body camera footage reaching toward Smollett to grab the noose around his neck with disdain. “The reason I’m calling (police) is because of this s--- ,” he said.
But Smollett eventually turned from victim to suspect after an intense investigation by Chicago police detectives who used two brothers’ cellphone records, internet search history and text messages to corroborate their story that the actor paid them $3,500 to stage the attack.
Prosecutors alleged that Smollett staged the attack because he was unhappy with the “Empire” studio’s response to a threatening letter he received at work a week earlier. Chicago police took it a step further, accusing Smollett of faking the letter as well.
I've always assumed my email, Drive, Voice info, calls, contact lists, etc would be obtainable by a warrant.
But I wonder if Google would turn over things like browsing and search history, even if you never browsed while logged in to Google or searched, and also had explicitly turned off storing of this data in your Google privacy settings.
There is no doubt in my mind that Google, through the use of 3rd party trackers from "partners", analytics, and correlation can easily match my non-logged in web history and searches with the same computer and IP used when I log into Gmail or Maps.
Supposedly they don't tie this global "advertising profile" to your real identifying Google account, at least for the data provided to advertisers, but I would think it'd be trivial for Google to collect it all - every web page visited and for how long, every search you've made - and turn over the vast majority of it to the government, upon request.
In other words, Google probably does know nearly everything you do online, logged in or not, at this point.
If we include dhs, then who, knowingly or unknowingly (go ahead and prove that) did not spend a few moments in proximity with persons of interest?
“Give me six sentences written by the most honest of men and I’ll find a reason to hang them” is more relevant than ever and I’m just imagining how much more can be found in the full surveillance trail of google services.
It wouldn't make my email completely inaccessible to the government (they could subpoena the sender), but would make it a lot less convenient to go on a fishing expedition.
You don't want the government to control your money with taxes and your health with social insurance, so why do you want it to control every aspect of your private life?
https://www.huffingtonpost.co.uk/entry/judge-orders-google-h...
Okay? This is news, how? Should I know the person that allegedly staged it, or is it new that a judge approves a search warrant that allows time-limited access to a suspect's data? Does it matter that they're an actor? (An overloaded term that makes the title quite unclear)
And a little meta: should we change the link to something everyone can actually read or do we want to keep this discussion limited to people from certain continents?
- Lavrentiy Beria
(Most influential of Stalin’s secret police chiefs)
I think terrorism has a perfectly good definition - political lobbying/influence "by other means" than conventional politics, i.e. attacking and terrorizing civilians. Doesn't matter who does it or how exactly.
Maybe the US government doesn't exactly use that definition, but that doesn't mean there is no such thing as terrorism.
So, that's who this general was, an Iranian visiting some Iranian country? Was he there to see the fjords?
Anyway, telling me what I would think or say is unacceptable in a civil conversation. If I write something, you can assume I mean it, or you can disengage if you think I'm trolling.
If you're going to take my comments as justifying US actions, perhaps they can be taken that way, but they may apply to retaliation as well, no? Is there much of a gray area with military personnel in Iraq right now, who aren't Iraqis?
Now? You might be missing some context on the whole Middle East conflict.
I mean... you obviously don't like this, and many people agree, on very reasonable grounds. But it just is not terrorism.
It's sort of how boiled mushrooms are not "death", even though I have equal affinity to both concepts.
So "spectacularly ignorant" might be a better alternative to "lunatic", but that isn't polite either.
It's kind of like how Matt Levine was making fun of Carlos Ghosn today for saying "I was brutally taken from my world as I knew it".
``Yes, right, that perfectly and exactly describes the experience of every single person who is arrested and sent to jail. Very few of them like it! And he’s not wrong, it is a bad thing to take people away from their friends and families and everyday lives. It’s just, you know, that’s kind of the deal, with jail. In general society does not seem especially responsive to arguments of the form “I do not want to stand trial for these crimes, because I’d rather hang out with my friends.” ''
are you saying that courts have become so opaque and inaccessible to voters that they exert their power as an impenetrable cabal ? Or that people need a PhD to assess whether the law or its enforcement is good or bad?
Surely both programming and law are more accessible than at any prior time in the history of the universe.
Become terrorism? To answer that we'll first need to define "terrorism".
There are over 109 different definitions of terrorism. It is not only individual agencies within the same governmental apparatus that cannot agree on a single definition of terrorism. Experts and other long-established scholars in the field are equally incapable of reaching a consensus.
Though I also don't think they should just drop the investigation if they have evidence there was a real crime committed (the false police report). I sure don't know anyone who committed a felony, got busted, but then was allowed to just walk away because it was a hassle to prosecute them. As for the effort, I'm sure they have some digital forensics tool that will search anything for them these days. Probably just one case among many that one person is working on at this point.
In particularly sensitive cases, the judge may appoint an official to be a go-between between the evidence and the prosecution. For example: https://miami.cbslocal.com/2018/04/26/special-master-evidenc...
When it comes to Gmail they could take an approach like password managers where the user's password is instrumental to decrypt the data and Google lacks any manner to circumvent the encryption - they just choose not to.
However, my point was that the comment I replied to was factually wrong -- there is legal action Google could choose to take instead of immediately complying.
It's 2020 and american websites still go the "We'd rather block you alltogether than tell you what we do with your data" route.
Edit: Agreed... placating people with lies doesn't help.
If their are workaround for a paywalled site then its allowed on HN. So if their are workaround for the geoblocking (outline, google cache, archive.today, etc)then I think they should be allowed.
As for how you will know if a sit is blocked, the same way people find out about soft paywalls, the comments will tell you. Its not like a crime to post paywalled sites to HN.
If you are using tracking technology based on cookies or anything that collects information specific to a user, you will need to show the cookie banner and give an opt-in. Otherwise tracking/analytics is not allowed.
So... Every site you see this banner on has some dead bodies in their cellar and wants you to move on and not take a closer look. Just click "Accept all" and everything will be fine...
My 70 years old grandma or 12 years old cousin do though. Of course as tech people we know how to bypass most of the tracking happening on the web, that's not the case for the average user.
Really a great accomplishment by the EU... in addition to clicking a shitty "I accept cookies" banner on every damn website I visit, I now frequently also have to click another popup for GDPR and multiple checkboxes for GDPR when I signup somewhere. As if anyone ever bothered reading those.
As far as I'm concerned, it's all just a huge waste and the internet was better off before politicians got involved.
I bother reading those, and it's my fucking right to do so, as well as to stop using a service if I don't think it's worth the data they're taking as payment.
Arguing that I shouldn't have that right, because it bothers some people is like arguing against price tags because "they're annoying" and "Who looks at those before buying something anyway?".
And no, you don't click "I accept cookies", you click something along the lines of "I accept necessary cookies plus everything I've explicitly enabled", otherwise site is not GDPR compliant and you can just report them.
And if a foreign website wants to expand into the european market, then yes, no matter its country of origin, it will have to follow EU rules.
So, in conclusion, geoblocking the EU is just plain stupid.
Yes, there's nothing wrong with that. If you take money from EU citizens, then you can be expected to treat at least them in accordance with european standards. If you don't like it, then we don't want your busyness, as simple as that (even though that might not be the position of every citizen, it's essentially what GDPR states)
It's covered by PECR. There's a good overview of the rules here: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
The main change GDPR brought to it (as I understand it) is that it introduced stricter rules about how consent works. But even though GDPR doesn't specifically require cookie warning, it does require that you get informed consent from people before you store personally identifiable information about them; in many cases this effectively means getting their permission before using tracking cookies.
So tl/dr, it's primarily PECR that covers cookie handling, but GDPR also plays a role.
Also, if people are trained to just click them away, that's not really that bad, since tracking has to be opt-in, so if you click the banner away, you don't get tracked by default (that is, in theory; the reality is, many websites disregard this completely and have tracking cookies enabled by default)
So they are mandatory, since all websites NEED advertising revenue and analytics to function.
You can also run ad’s asking as you are not using targeted ad (which you are allowed to use if you ask for permission)
There are invasive ways of asking for such permission. Sites that do full take overs of the site or persistent bars that follow you around are just trying to annoy the user into clicking agree.
Why does the European Commission's website want to track me? They have a banner, too. In fact, I have yet to visit an EU government website that doesn't have a banner.
GDPR has the great idea that you shouldn't be tracked unless you consent. The popups are a way of forcing consent because users just click through them. However, the default should be that you're NOT tracked and opting in should be explicit, which possibly means all those popups that begin tracking you after one click are not compliant. Then I've also seen sites where opting out is difficult - there's a hard to find link that takes you to some settings page where you need a dozen clicks to disable tracking cookies. That's definitely not GDPR-compliant.
Despite the practical annoyances, I direct my frustration at the cancerous advertising industry that has turned the Web into a giant ad platform, and so the industry is very intentionally undermining GDPR protections.
Blocking the few European users is probably the right decision from an economic perspective.
Let's see just how much they like that.
(That was the sound of the joke going over your head)
Want to store logs? Now you need to make sure you're scrubbing any type of personal information from the logs. Want to use a third-party service? Now you need to make sure that you are using their GDPR-compliant plan, and that you are using their Amsterdam endpoints. Maybe you need to renegotiate your contract with them.
You can put the IP in your security logs because that is necessary to secure the service. Just have a routine to scrub the logs once they are too old to be useful anymore.
You can't put the IP in your shadow profile database and sell it to shady marketing companies, unless the user has explicitly agreed to that.
The question isn't only whether something is personal information or not, it is also a question of what you intend to do with the data.
Not exactly; it's up to the judges to decide whether IP addresses count as personal information as defined by the GDPR (in my opinion they're not, but I can see why one would think differently), so the flaw isn't as much inherent to the GDPR as to the fact that people just don't understand the internet.
While the wording of the Recital leaves some ambiguity as to whether an IP is automatically Personal Data under the GDPR, its specific call-out would make arguing that it is not difficult. This would particularly be the interpretation of American lawyers, who tend to assume that no connection is too tenuous to be held against their client by a shrewd prosecutor or regulator and will thus advise their client to treat all IPs in all situations as Personal Data.
So can Amazon/whoever if they saved the IP alongside other customer information.
But a naked ip->person lookup would require a warrant.
Have a look at the list of companies and other websites this service uses/shares data with.
No wonder some websites rather block users all together instead of showing that they are selling data left and right.
What?! I'm not allowed to store my users name, address and credit card number in my unencrypted syslogs anymore? HOW DARE THEY, THOSE DAMN BEUROCRATS!
Seriously though, while there are problems (like IP address being considered personal information, which they really aren't), the general idea is very positive. You shouldn't be able to store just any information of a person that only gave you this data for a specific purpose. Servers do get hacked, employees do abuse their access to systems and old hardware doesn't always get disposed of properly.
When I'm done using a service, I want my data gone from their servers ASAP, no buts.
Even then a non-EU company may not explicitly target a EU audience but EU moral or physical person may still find interest for whatever personal reason and still be protected by GDPR.
As for jurisdiction, I suppose such conflicts are resolved using international law, but if a company is reachable from the EU by individuals protected by EU laws I’m pretty sure there is applicable jurisdiction (not saying it’s an easy thing)
> 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
This makes perfect sense from the perspective of some old politician: It's like shooting someone over the country border. It fails to address the fact that unlike in physical space, on the internet it's not that obvious to see where someone is connecting from (in fact, it's impossible to really say with complete accuracy)
But in my opinion, it's not the wrong choice to assume that, if you're operating on a scale where you can spy on your users and sell their data, you'd be capable of figuring out whether they're in the EU. And, honestly, it's not hard. There's third party software that you can just embed in your website and it automatically generates the cookie warning and even blocks cookies until you've accepted it.
I'd certainly never consider visiting normal US news sites unless - like in this case - they were linked to by HN or some other aggregator I do frequent.
Thus, it really makes no sense for them to comply with the GDPR.