Oppose the Earn IT Act
foundation.mozilla.org
foundation.mozilla.org
Imagine we're sitting at a bar, chatting. None of us have anything to hide. Then the government passes a law that all conversations must be streamed on Youtube Live, so an agent comes in, sets up a camera at our table, and starts streaming.
We still don't "have anything to hide". We're just having a conversation. But the conversation used to be private--that's normal. Now it's not private, which is not normal.
Whether or not you feel like you have to "hide" anything during a bar conversation is not the point. It's whether you think we should make changes to our society where having a private conversation is never allowed.
This kind of analogy, in my experience, helps people understand that the "nothing to hide" argument assumes that privacy is only for evil people, when in reality it's the very normal default of daily life. The parable posted in another top-level comment is also great.
Nothing to hide is an incomplete sentence. Nothing to hide from who? Surly you want to hide your children from abusers and predators? Don't you want to hide your banking details from con artists and fraudsters? Your identity from identity thieves.. Your location from burglars, your car keys from car thieves or your blood type from some rich mobsters with kidney problems..
we don't know who are any of these things. So we should protect ourselves from all of them, in effect we have everything to hide from someone, and no idea who someone is.
My normal response to "I have nothing to hide" is: "Cool, can I take a look at your browser search/reddit history?".
— Bruce Schneier, The Eternal Value of Privacy, https://www.wired.com/2006/05/the-eternal-value-of-privacy/
I'm hiding it from:
- a future where the nazis or another totalitarian party wins the election
- future corrupt police personnel
- other countries intelligence (not everything I say might be compatible with doing work in North Korea/China/Israel/Saudi Arabia/Turkey (edit: added Turkey, I don't plan to go there in my holiday anyway)
- Leaks from police IT systems
And then I point to Turkey who went from approaching membership in EU to human rights hostile dictatorship in two years.
Or they actually don’t, because they do nothing of consequence on a computer.
It doesn't speak to Internet surveillance directly, but it's enough to show that there's more to privacy than the desire to conceal wrongdoing.
Edit Also, there's a great 2007 paper on this kind of thing, 'I've Got Nothing to Hide' and Other Misunderstandings of Privacy:
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565
Mirror: https://scholarship.law.gwu.edu/cgi/viewcontent.cgi?article=...
It's far better to ask why we should have encryption (for our safety, our security, and yes, our personal privacy) rather than whether we should have it. The government, with this bill, is debating whether we should have it, when it's obvious to the people that we definitely should. Turn that around on the senators proposing it; ask them if they want to build in back doors into our digital lives, can we as their employers and electors do the same thing to them?
E.g., maybe a govt comes into power that is strongly anti-gay, and punishes you for being pro-gay rights.
Or the opposite.
In general the idea that the government will always be reasonable and should have unlimited surveillance powers is unsound and unappealing.
Mind if I riffle through your contacts? Is it ok to DM any cute people I find?
"If I have nothing to hide, then you have no reason to look."
Your conversations were recorded, the data leaked to or purchased by a fly by night company hired by your bank, and now suddenly despite your excellent credit history you can't get a 30 year mortgage, you try to find a new job but companies are only offering 6 month contracts, etc.
It's hard to prove a database doesn't exist, better to encrypt the content beforehand and make it harder to create.
If you want to make more of them I just combined a plausible data analysis project with some of the creepiest insitutional aspects from previous surveillance scandals.
Even barring the legal requirement, banks already prices mortgages such that they can handle being stuck holding the title with no payment. Down payments or government guarantees prevent them from holding the bag unless the housing market takes a big downturn.
We probably won't.
[1] someone, not me; "Cognito is a keylogger that tracks typing metrics, analyzes them with AI to diagnose Parkinson's"
"Would you give up your right to free speech just because you have nothing important to say? No? Then why would you give up your right to privacy just because you have nothing to hide?"
It raises the important point: of course you don't care about privacy now while you have nothing to hide. You should care about it because one day you might.
It might be a stalker, a corrupt government official or policeman, someone at work who is competitive with you, you might be a whistleblower or learn a family secret that would damage your reputation (lets say, your father is a pedophile) .... all these things happen to completely "regular" people who until that point had "nothing to hide" and they end up needing or wishing to hide them in at least some circumstances.
Without privacy, you, your family, or anyone you are in contact with becomes an easier target.
A stronger argument should have tried to explain how this violates the constitution:
https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-c...
I agree, the EFF should have elaborated more on concrete examples of how it violates the Constitution.
The potential space for bad policy is gargantuan and hard to explore without additional hints or context. Given that enumerated in rhetoric, tech company policy, recent events and the bill itself:
It may create potential for witch hunts. Think of some recent conspiracy theories here.
To censor speech which comes close to looking "suspicious" whomever is the one to define this. This is most likely the government.
It may push companies to use filters which over-censor speech and it may be impossible to get a remedy at the scale at which they operate.
Trolls could abuse mechanisms to silence opinions they disagree with. If a government decides to smear someone's reputation through a coordinated campaign, they could make the argument they are a danger to society and pressure platforms to silence them.
* Indicate that you have a right * Which you probably don't have a pressing need for at the moment * But the lack of a need in the immediate future doesn't mean you won't ever have a need for it
The only real difference between the two, as far as I can tell, is the actual right you're not-using-but-still-protecting.
What am I missing?
I think the only counter argument is to demonstrate how close many of our western democracies are to becoming fascist dictatorships.
We need privacy because if ever laws are passed that we don't agree with, we need to be able to break them until we can have the law changed.
For example, if it was against the law to be a pro-democracy protestor.
I don't think so. I think people simply mean they have a reasonable expectation of privacy in all of their personal activities. There are lots of things I say and do that law enforcement would not be interested in at all, but that I still want to keep private, simply because I want to. I shouldn't have to give a reason; privacy should be the default. People who genuinely want to share every little detail of their personal lives already have Facebook.
What bizarro alternate reality do you live in where this is the case?
Oh yeah, and laws that ban encryption.
"I have nothing to hide"
"Have you ever sped on the highway?"
"Well, yes"
"Imagine if the government reveals it's been tracking everyone's speed, and has decided to write everyone tickets for speeding."
"That's insane, the government can't do that!"
"Exactly"
Gone are the days during the Cold War where you could say, "What is this, Soviet Russia?" and have anyone squirm at the comparison.
If you drive at all you are theoretically putting other people's lives at risk. Everyone always has to exercise prudence when they drive in order to mitigate that risk. If their judgment is bad and they cause an accident, they are held legally liable for the harm they cause, and that gives people a strong incentive to not cause an accident. That, in a sane society, would be considered sufficient as a matter of public policy, and the government could just stop worrying about it and move on to more important things.
But ticketing someone because of an arbitrary number posted on a sign, which might have little or no relationship to the speed a reasonable and prudent person under the actual conditions on the actual highway would choose to drive, is not protecting people's lives. It's the government tapping an alternate source of revenue because it doesn't want to just admit it needs more money and raise taxes. Not to mention decreasing everyone's respect for the law, since everyone knows that under current conditions speed limits are unenforceable (and what enforcement does exist is arbitrary), and doing what it would take to actually enforce speed limits completely would be a draconian violation of our rights that no citizen of a free society should accept.
> I think we probably should have a satellite tracking every car and issuing a ticket as soon as a car speeds.
I think the government should stop trying to micromanage every aspect of people's lives and focus on protecting our rights.
Personally I like to just remind people if we had nothing to hide, nobody would wear clothing, own curtains, or care about peeping toms.
you must live in a nice climate.
But honestly, it’s best not to be aggressive. Some people don’t care much, and you won’t convince them.
FWIW, all my non-technical friends use Signal with me, and they know about verifying safety numbers! It can be done.
They'll say the media is the enemy and whistleblowers are traitors who should be shot on site. I'm not even kidding; they'll say this.
Unfortunately, as the current coronavirus case data shows, a large number of people here think everything is about them and them alone, so we'll need to make an argument that speaks to them personally. I'm not sure there is one that's universal—as suggested above, asking for their salary might be as close as we might get. That would then leave government employees.
When people make public speeches they tend to choose words more carefully because they aware about possible dramatic consequences.
The same level of awareness for each private conversation in the bar can lead to a lot of efforts. It's another level of efforts to formulate things correctly. Sometimes people just need a safe place to formulate and try ideas without worrying about being punished for consequences.
If everything is livestreaming it's hard to achieve certain level of relaxation.Because it becomes a hard work to avoid saying something they didn't mean.
This kind of hard extra work would result in overloads and intentional faking to be on the safe side.
And 'that' is the core damage effect of any mass surveillance: Inability to have a free and open private discussions.
So even when there is 'nothing to hide', there is a lot of work just to 'avoid to show' something you didn't mean.
If we are doing imaginary situations, the proponents of this bill can also do something like this:
Imagine there is a bar, where the police are unable to go inside. Every day, people go into the bar to plan terror attacks or to spread hate and racism. They can have whoever from across the world join them in the private bar without the police being able to find out. Sometimes they also bring young children into the bar to sexually exploit them. Other times, they bring vulnerable young men and indoctrinate them with their racist hate. The owner of the bar knows that those kinds of things are happening, but they say, a lot of people just come into the bar to talk with friends, so we never allow the police to come. In addition, before serving drinks, the owner puts on a blindfold and stuffs their ears with cotton so they won't be able to see or hear what is going on. They live by the principle: See no evil, hear no evil. The owner of the bar is making a lot of money from the people using the bar.
Don't you think we should keep the terrorists, and neo-Nazis, and child molesters from having a bar that they can go to to do and plan their evil stuff that police cannot get to? Don't you think that the bar owners, instead of stuffing their ears and covering their eyes so they are unable to see the bad stuff, should make sure that bad people aren't using their bar for evil stuff. Sure, just like in the real world, you will have your privacy just like you have in your home or at the local bar. But, you would want a real life bar owner to not close their eyes to people using their bar as a planning ground for terrorism, or who are bringing young kids with fake id's to the bar to exploit them, or who are filling young men's minds with hateful, racist lies? Also, just like the police can get a search warrant for a bad person's home or a bar where a lot of bad people are congregating and planning and doing bad things, we think they should also be allowed to do that in the online world.
Now tell me, to the average non-tech voter, which will pull the most emotional strings?
Bad analogy, because a search warrant for one bad person's home or bar does not require the government to have keys to everyone's home and bar, just in case they need to search it.
In other words, the problem is not the "get a search warrant" part. It's the "break strong encryption so no one's data is secure, just in case we need to search anyone's data" part.
You will find a lot more people than you would like in a lot of communities are racist. I do not approve of it but preventing it would enter the realm of thought policing and would require a totalitarian police state.
"I have nothing to hide"
"What's your salary and your spouse's salary?"
The huge amount of secrecy around salaries in the US is proof that a lot of people have perfectly innocuous secrets that they very much like to hide.
The question is not whether you have anything to hide, it’s about whether you have anything to hide from law enforcement.
HUGE diffeeence.
Or if you can do it with a straight face “when was the last time you masturbated?” :)
But income is definitely something that people love to hide. There's a lot of things that all people would love to keep quiet, mostly because their friends or loved ones would find out and may disown them
Then the person responds, "What are you talking about?" you say:
"I can post it on Reddit tomorrow if you're serious about this."
Wait a few seconds, then change the subject.
After all, if you're have nothing wrong you have nothing to hide, so why should you close your shower curtain?
Because otherwise you get water all over your bathroom floor?
The concept of privacy and the consequences of not having it are too abstract for them. It is like saying that climate change will lead to disaster unless we all act now. They will only act after something bad happens to them personally.
There's 10 to a hundred thousand laws on the books already.
How do you know you don't have something to hide?
From my post about privacy not too long ago, https://www.davidexmachina.com/2020/02/privacy-matters.html
It's my right to hide whatever I want, regardless of whether somebody else considers it "something to hide" or not; just as it's your right to buy a 3m tall chocolate statue of yourself, regardless of whether I think it's something you need.
The question is not "is it really necessary?" but "who the #£$! gave you the right to decide whether I consider it to be necessary for myself?"
Then again, here in (east) Germany, somebody argues "I have nothnig to hide", you just tell them "Neither did people 40 years ago" and the conversation is pretty much over.
Got nothing to hide and there will be no problem, right?
I won't try and summarise it because I think I'd do a disservice to it, but it's another really good argument, ostensibly from experience, re corrupt countries and surveillance.
The Bill of Rights (first ten amendments to the constitution) is all about protecting us against abuses of government officials. It presumes people in government could be bad, and we need protecting from them. By allowing a government official to seize all our private conversations it could allow a bad government official to go fishing and find things things that they can use against their enemies. There are many, many laws. Many of them aren't enforced, but could be.
For example in some states adultery is illegal, even a felony in some states. Not just in small states, but in New York, Massachusetts, and Michigan. In Massachusetts there hasn't been an adultery conviction since 1983. But if law enforcement was allowed to decrypt an iPhone, and find private bedroom things, it could be used as an attack on a political enemy.
It isn't only "bad people" that should be worried about the government. I think pretty much everyone agrees Martin Luther King Jr. was a good person. But the government at the time didn't think so. When he was killed the first people on the scene were the police officers who were doing surveillance of him from across the street. That is the kind of government we need to be protected from.
The only real defence against government abuse is strengthening democratic institutions, respect for human rights, strong oversight, transparency etc.. End-to-end encryption is quite a shallow/weak protection since a truly tyrannical government can easily make it illegal at any time. A lot of government abuse is also possible without breaking encryption.
So I think the benefit of end-to-end encryption in protecting against abusive governments is often over-stated. But what about the costs? For example technological progress is making the world more dangerous. Should it be easy for a bunch of people to use unbreakable encryption to coordinate the development extremely dangerous genetically engineered bio-weapons from their homes? If one such person is caught should it be really impossible for 5 judges to allow the police to find all those they've been talking to?
IMO, your friends, unless they are nerds, are never going to place much value on encryption when they never actually use it themselves. When some third party tech company is doing the "end-to-end encryption" for them then your friends are really not in control of the situation, let alone having any reason to understand it. It could be a sham and they might not know it.
This bill stands to hurt tech companies but according to its critics (surprise: it's the tech companies) it does not interfere with any individual's use of encryption for communications.
No one wants third parties to have potential access their communications. However there is no law preventing a tech company that provides "encrypted messaging" from decrypting people's communications. There is not even a contract with users. If they do this, their liability is zero. There are only "promises", something like, "We promise we won't do it, unless we receive a valid subpoena" or "We have made it technically impossible to see your messages." (Nevermind metadata.)
Well, what if some other third party, like the people pushing this bill, made the same promises? Would that be "good enough"?
Of course not.
For the record, I am not taking a for/against position here. I am not a tech company nor someone trying to get access to encrypted messaging services provided by tech companies. However if something came along -- not suggesting this is it -- that created the necessary evolutionary pressure to make every person, not just "bad guys", have a basic understanding of how to encrypt a file and send it over an insecure network, without relying on a third party for the encryption, then I would think that would be a good thing.
That one's not actually a "promise"; it's either true and sufficient (although it's hard to imagine how if the software supports automatic updates), or a direct lie because they have not in fact made it impossible.
I think the due process argument is more compelling. Part of preventing abuses and corruption by law enforcement is ensuring they can only surveil people with reasonable suspicion. Yes there are people who should be under surveillance. But it's crucial that this gets approval from the courts to prevent agencies from snooping on people not for law enforcement but to gain leverage and power. Your privacy helps us prevent the next J Edgar Hoover even if you have nothing to hide.
When I read this as you put it . It comes to me something we tend to forget that surveillance is a form of attack on a person's freedom obviously. The fact of it presence is already an insult actually.
The best sentiment I've ever heard about privacy is from Shoshana Zuboff, and it's now influenced my thoughts. It's at the end of her amazing 2018 book 'Surveillance Capitalism', the best book on tech I have ever read. She shares a conclusion along this line: To be private and free from surveillance is to be human. If we have no privacy, we lose our humanity.
She explains that there is a direct connection between being watched, and being controlled. We need freedom of diversity - to will - to decide for ourselves. Otherwise, and now I conclude, bad actors with power lust will only bend the world to their vision.
The guilt-tripping words of "nothing to hide" come from a place of privilege - or worse, hypocrisy. It is an insult to anyone who is different from the norm, and who wants to be themselves. What you have every right to hide does not even have to be illegal, but often it is, like LGBTQ people last century. Illegal ≠ immoral.
Privacy is a core freedom to protect human diversity. It must not be shamed. It must be loved. Cherished. Treasured.
Privacy begets diversity. Surveillance begets conformity. Which one is more important for the development of life in the universe?
As a child, I instinctively knew that privacy was something natural and important in life. Now as an adult, with education and intellect I can articulate why - and resist psychological manipulation and intellectual dishonesty from others trying to tell us that privacy should die.
I'm able to see the insanity of my own age. And I will guard privacy with my life on the street, if I have to.
I would agree. Those are very important points. When people being watched they are not as free as they could be in their actions and exploration of ideas, because they measure what to say and what is forbidden to say. This can have a huge damaging effect in creativity domain.
If this is true, then Apple's privacy brand has some long-term legs and some pretty powerful ads in their future - showing creators not being tracked while they freely, privately explore their art on an Apple device.
I think what we may not realise yet is that we are possibly under new attack of 'modern communism'. They changed clothes and they do not call themselves communists, but their actions and principles they protect are revealing who they are and we know how many people died in 20 century because of this ideology.
>It is an insult to anyone who is different from the norm
And now they attack the basic principles of a free society.
>Privacy is a core freedom to protect human diversity. It must not be shamed. It must be loved. Cherished. Treasured.
I would also add it's a core freedom to protect a free society respecting human rights.
You're better of appealing to things that they normally might want to hide, like an embarrassing act or things that are said that are questionable out of context, etc.
A person who truly has nothing to hide, by definition, would not care about privacy. The entire point of privacy is that there are things that we do not want to share, for whatever reason.
I've had the best success with the argument I posted. It helps people understand that privacy isn't "hiding", it's normal. What's not normal is guaranteeing your government can see everything you do all the time, and we should think about whether that's what we want.
They invade you and then they they kind of ask you what is the problem? you have something to hide? And some people say : Oh, we have nothing to hide. But the problem is the fact of invasion, not wether they have to hide something or not.
It's like someone invades your territory or takes your stuff and you say, oh, i don't really need those. It's not the problem wether you need those or not. The problem is that you can't decide about it anymore, you right to decide was taken away. In case of property you loose right to private property. In case of free speech you loose your right for free speech. In case of privacy you loose your right choose not to be watched. You loose ability to decide to be private if you wish. That is the problem.
I also do not take such person seriously but if I wish to convince such person I need a good argument that works.
If it's easy debunk-able for you I would be interested to see a few from you.
What's actually happening is that Facebook, Google, et.al. can read your messages and the Government can do so with a warrant. Nobody is planning on broadcasting everything to everyone. We don't have to ask people if they would do that or not. The vast majority of them do that today.
Anyway, it might at well be Pleasantville 1950s for a lot of people. They are both hiding everything and being suspicious AF of anybody with something to hide.
Basically it isn't about having anything to hide but the instability of democracy and what power bad actors have.
Do I have anything to hide from Google? Not really. But do I want that same data that Google has to be in the hands of someone like Putin? No. I don't even want it in the hands of the NSA. The issue is that if we say that ads can manipulate people to buy things, why can't they manipulate people to do things like vote or divide. Russia's strategy since the Cold War has been to divide and prod The West, to sow disruption. That disruption has caused consolidation of power but also makes it difficult for coalitions to get things done.
It is clear that anger generates more clicks, so why is it unrealistic to think bad actors can use that data to better divide us and sow discontent?
The next factor is that democracy relies on a distribution of power. Data collection is a means to consolidate power. There's the term "turnkey tyranny" that's thrown around. The reason isn't because we think a tyrant is going to come to power and destroy our way of life, but rather that we recognize that such a thing is possible and want to ensure that such actions would be infeasible if a malicious actor gained power. In democracy power is distributed. This has pros and cons. But the point of distribution is so that consolidation is difficult and we can never have a monarch or tyrant.
So it has never been about having something to hide (which btw, do people know they are referencing Goebbels?), but about stability in democracy. Distribution of power that was inherent to the system in the past is no longer built in. Technology has changed and enabled things we never previously imagined.
I think part of the unrest we have is that we're NOT better off than our parents. But another key component is that covid made it so that we have to worry about food on our table and we have an abundant amount of time to worry.
At the same time this is a great opportunity to talk about democratic stability. Discussing things like why privacy matters and not just to bad guys or with the silly "you wear clothes" analogies. It is also a great time to talk about structural reforms like switching to better voting methods, such as STAR (see my comments for rants on why you should not use IRV/"RCV"). At this time people have the time to think and research, but there is also the drawback that it is hard to think when you are worried about food and future. But this time to also talk about solving problems while they are small. If the Great Depression taught us anything it is that those people learned a lot about frugality but their children forgot. Luckily it appears that each time we do this we get slightly better (think like a damped harmonic oscillator). So don't give up hope, help the dampening coefficient.
> There was once a far away land called Ruritania, and in Ruritania there was a strange phenonmenon -- all the trees that grew in Ruritainia were transparent. Now, in the days when people had lived in mud huts, this had not been a problem, but now high-tech wood technology had been developed, and in the new age of wood, everyone in Ruritania found that their homes were all 100% see through...
> One day, a smart man invented paint -- and if you painted your house, suddenly the police couldn't watch all your actions at will...
> Indignant, the state decided to try to require that all homes have video cameras installed in every nook and cranny. "After all", they said, "with this new development crime could run rampant. Installing video cameras doesn't mean that the police get any new capability -- they are just keeping the old one." [...]
https://cypherpunks.venona.com/date/1993/04/msg00559.html
(I recommend reading the full parable.)
—————
clock.org homepage (c. 1998)
> Some agencies of the United States Government (notably the Federal Bureau of Investigation (FBI)), want to prevent the deployment of encryption technology. They want either encryption so weak that just about anyone can break it, or they want a copy of every key used with strong encryption.
https://web.archive.org/web/19980113124617/http://www.clock....
Sound familiar?
—————
Mujahedeen Secrets (first release: 2007), Al-Queda’s own encrypted messaging software. Those developers aren’t going to respond to a US court order.
It's like shooting oneself in the foot before hiking.
Even with that, you are now forcing the terrorists to roll their own encryption. The likelihood of finding an exploit in Mujahadeen Secrets is likely much higher than finding an exploit in Apple Messenger or WhatsApp or something by djb or Moxie, etc. In addition, Mujahadeen is likely having to be side loaded - you won't find it in the App Store. This gives a chance to try to hack a single storage location to have a trojan horse version spread through their network. Finally, it affects recruiting. Basically only someone already comitted will go to the trouble of having Mujahadeen Secrets on their device, whereas a lot more people could be expected to have a common end-to-end messenger on their device. So overall, thinking from a purely law enforcement, anti-terrorist perspective, it would still be better for them to not have e2e in widely used apps, even if the terrorists tried to develop their own app.
To be accurate though that's not exactly true. The sheriff doesn't even need a key to enter your house, he can get a warrant and bust your door down.
This is a town where your house is indestructible and un-enterable without a key.
This isn't about their ability to seize things you have after they get a warrant. It's that they want the ability to seize things you have before they get a warrant, just in case they get one later.
It's like requiring everyone to have video cameras in their house with recordings sent to law enforcement no matter whether they're under suspicion or not, and then claiming that it's fine because they pinky swear not to look at them without a warrant. (Never mind that then you can't prove that they're not cheating, and that it would be the world's largest target for organized crime and foreign powers.)
I agree that their analogy isn’t particularly strong, so I removed that part from my comment.
That requires following due process, the presumption of innocence, and observing the right to privacy. You have to convince a judge, in the context of the existing laws, that a certain individual or group are suspicious enough to call for (specific) further investigation.
Mass surveillance and forcing weak encryption bypass or overturn all that. It's a radically different view when you assume everybody is guilty of something by default and that they have no right to privacy.
I guess I’m biased since this is essentially my whole livelihood, but this is crazy, right?
It is also a very electable sound bite. Everyone is against the "bad people". Re-election at any cost is the goal. We have government of the people and by the people but we stopped being for the people long long ago.
"This bill, COICA, was introduced on September 20, 2010, a Monday. And in the press release heralding the introduction of this bill, way at the bottom, it said it was scheduled for a vote on September 23 — just three days later.
And while of course there had to be a vote — you can't pass a bill without a vote — the results of that vote were a foregone conclusion. Because if you looked at the introduction of the law, it wasn't just introduced by one, rogue, eccentric member of Congress. It was introduced by the chair of the committee — and co-sponsored by nearly all the other members — Republicans and Democrats. So there would be a vote, but it wouldn't be much of a surprise, because nearly everyone who was voting had signed their name to the bill — before it was even introduced.
I can't stress enough how unusual this is. This is emphatically not how Congress works. I'm not talking about how Congress should work, the way you see on Schoolhouse Rock. I mean the way it really works. I think we all know that Congress is a dead zone of deadlock and dysfunction. There are months of debates and horse-trading and hearings and stall tactics.
...
Whoever was behind this was good."
https://www.buzzfeednews.com/article/jwherrman/how-aaron-swa... (excerpt from talk at https://www.youtube.com/watch?v=OqriFtr2k-k -- FWIW the lobbyist behind sopa/pipa was Chris Dodd, https://en.wikipedia.org/wiki/Chris_Dodd#Motion_Picture_Asso...)
As much as I hate it, I can at least understand the back door argument from a [ignorant] lawmaker perspective. If I pretend and say their intentions are noble, I understand.
What concerns me though, beyond the obvious backdoor problems, is the who is next? Because I doubt big corporations will satisfy their greed for power and information. Especially since anyone who has anything to hide or cares about security will move into open source.
As a developer with a passion for developing distributed, encrypted software - when are they going to threaten me? Worse yet, the software I write I purposefully do not have control over. So am I going to be held liable for the fact that I literally cannot help them?
No matter what they threaten me with, the best I could do is break the application for future users. So what are they going to do to control these distributed systems? Especially ones who truly aim to be distributed, P2P & self hosted by every user?
As terrifying as the current anti-encryption behavior is, I'm oddly more concerned about the move after this.
There's clearly a valid argument from the other side. For example:
>Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material, according to people familiar with the reports.
https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...
It's not clear how many of those lead to convictions but even a tiny fraction of a percent represents a significant number of children being rescued. Encrypting Messenger, as an example, will stop 3/4s of abuse reports and make it much safer and easier for paedophiles to exchange images. There's a pretty direct line from that decision to an increase in abuses like:
>“inserting an ice cube into the vagina” of a young girl, the documents said, before tying her ankles together, taping her mouth shut and suspending her upside down. As the video continued, the girl was beaten, slapped and burned with a match or candle.
>“The predominant sound is the child screaming and crying,” according to a federal agent quoted in the documents.
I'm actually fine with some kids biting the dust (yes literally being killed) to prevent the greater evil which is that of normalization of mass-surveillance within society (any more than it is already) which will ultimately destroy more lives. I'm not saying these kids don't deserve justice but more power to cops never solves anything (especially in poor volatile countries where cops are in fact part of the problem and happy to look away ...)
FB Messager report function sends a decrypted copy to Facebook AFAIK.
Most differences between republicans and democrats are superficial. Republicans don't really believe in small government no more than Democrats really believe in social justice.
Then everyone will be like “Whoa?! Who would have thought something like this could happen!”. I feel like this is a tale as old as time.
Hawkish foreign policy would be another one.
> we
"It's a big club and you ain't in it" - https://www.youtube.com/watch?v=i5dBZDSSky0
Have you noticed routine protest and informed debate occurring throughout the US for oh say 30 years to be generous?
Political reality isn’t logical, it’s on the nose. There’s no engagement to prevent this, and decades of flag waving as enforcement funding is cut.
That has an impact.
The generation that still holds the most seats in government has no idea how any of this works.
Giving them the benefit of the doubt it’s ignorance not informed malice their intuition is nevertheless “expand police state.”
I’m sure we’ll all take a break from HN and debating flat or skeuomorphic to tell them piss off
Not sure what is the solution here, the popular people's choice couldn't even get elected.
They have continually made moves like this, in a boiling frog fashion. Until we the people wake up from the two party divide and conquer system, very little will change, excepting very rare circumstances of pressure exerted en masse (SOPA/PIPA is a good example outlier).
I've thought about solutions to this problem for a long time, and my conclusion is the things needed are the following (in order to prevent a long term overton window shift as has been happening):
1. Renewed participation in local politics and elections, especially at the state level, but also county, city, etc.
2. Once that is achieved, voting in ranked choice voting initiatives. This will enable the next step.
3. Stop voting for anyone based on party, in particular the main power structure is based on the majority rule in the house and senate... the end goal would be to take away the majority from both parties. This is a huge undertaking, so I'm not saying it would be easy, or even possible, but I think it is what is required. I think those paying attention enough and not enured to the tribalism of the parties understands they cannot be reformed from the inside. They are simply too entrenched, and have too many mechanisms to get rid of those who seek to do so. The point is that we don't need to gain a majority with this new coalition party of independents and third parties, we simply need to take the majority away from the two main parties. To get this done though, [1] must be done, because many of the state laws have been manipulated by the duopoly to prevent third parties and independents.
3.1 To avoid fracturing of the coalition, there should be some very rudimentary and base document that all persons running can agree on. This is also difficult but, since all congresspeople swear an oath to the constitution (5 U.S. Code § 3331), something that reaffirms the principles of the constitution would be the best start. If they violate this, the coalition should work to remove them immediately. (something similar to Gingrich's "Contract with America")
4. Currently, and many don't know this, congresspeople have to sign an affidavit (5 U.S. Code § 3333) confirming their oath. I think we should then work towards enforcement of the laws against violation thereof, the primary one being perjury, or something similar (18 U.S. Code § 1918, 5 U.S. Code § 7311). For example, how many people have straight up lied to congress and had no action taken against them? (Clapper is one of the more egregious ones that comes to mind, but the point is congress is in dereliction of duty in enforcing perjury laws)
This would give the people a real opportunity to start passing laws that represent the people (such as term limits), but are still constitutionally sound.
The legislative is the branch closest to the people, and this is why it should be the focus. From a cleaned up legislative we can begin to resurrect the separation of power between the branches that has been egregiously eroded, primarily by the executive. The current checks and balances system is crumbling. A huge part of this erosion is the surveillance system, which enables compromise of congresspeople by the executive and the MICC. We must fight for privacy, both encryption and anonymity, as a fundamental part of protecting the checks and balances system.
INTJ?
In fact, the patriot act has been prolongued 5 times, no matter the administration, and is still in effect.
As a european, I don't see any party that actually have american people's interest in mind.
Fighting for either seems so futile from here.
Of course, we have similar problems as well so I'm not going to pretend I have a solution.
As an American, I don't see any party that has my interests in mind. Elections always seem to be having to choose the lesser of two evils.
The EU has been considering similar anti-encryption legislation for years. Primarily supported by France, UK and Germany. The main opponents to it in the EU have been NGOs, which mirrors the American experience on this issue.
The cynic in me speculates the reason the EU parliament hasn’t pushed the issue further is simply because it’s waiting for it’s influential members states (or the US) to pass the legislation required to gut these services, so that they won’t have the potentially unpopular task of doing so themselves.
As a european, I don't see any party that actually have european people's interest in mind.
[1]Kind of, Democrats think tech companies got Trump elected, Republicans think tech companies are suppressing conservative viewpoints, but either way, they agree on the problem.
I feel vindicated for voting against her in 2018, because I thought she'd be out of touch with our interests as a state.
Feinstein wiped the floor with everyone in the primary in 2018. She took 44% of the vote, and the next leading candidate (Kevin de Leon) took 12%. When they ran against each other, de Leon lost by a fairly large margin but turnout kind of sucked.
de Leon wasn't a good candidate by any means, and I voted for the guy. He always struck me as a bit of a smarmy huckster who didn't stand for anything but reelection. But I knew that Feinstein was probably running for her last term and only cared about serving the national party's interests, and not our state. I'll take the guy that wants my next vote over someone that probably won't live long enough to get it.
She’ll send a smarmy response about how you’re clearly an idiot for thinking it has anything to do with encryption, and how she’s proud to be a co-sponsor.
She’s been completely ignoring voter complaints for decades. Before open primaries, it was essentially impossible for her to lose an election, and she knew it.
I’m extremely liberal, but if the “recall governor Newsom” crowd went after Feinstein instead, I’d sign on in a heartbeat.
Feinstein could not have been re-elected if it weren’t for overwhelmingly strong support for her in Silicon Valley.
If she is up for re-election again, please vote for the other candidate (who will probably also be a Democrat!). Also, tell your friends.
She wants to ban encryption. Her voting record is further to the right than many republicans. She votes according to Trump’s wishes more than any other Democrat in the senate.
> Her voting record is further to the right than many republicans. She votes according to Trump’s wishes more than any other Democrat in the senate.
This seems to imply she's in the middle of the pack for her democratic peers as it relates to Trump's wishes: https://projects.fivethirtyeight.com/congress-trump-score/
Richard Blumenthal (D-Connecticut) - term ends in 2022*
Josh Hawley (R-Missouri) - 2024
Dianne Feinstein (D-California) - 2024 as well... good luck with this one
[0]: https://battlepenguin.com/politics/video/does-voting-make-a-...
Also, I'd bet there are a lot of folks that read HN that are already in the top 10% of income earners. So maybe I'm speaking directly to some of the 10% now.
Politics keeps moving on. I'm still on the Iraq war. I'm not interested on any other issue until we solve that one.
Edit: s/bailouts of/bailouts and/
Rianna Pfefferkorn wrote a in-depth analysis about EARN IT which is really good to read:
https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b...
I also wrote a smaller high level article about it if you're interested in a briefer read:
https://medium.com/@console.blog/action-tell-your-representa...
Which is how we end up with stuff like the EARN IT Act that one would reasonably think would be shot down immediately, but isn't.
The ruling elite have a monopoly on this. They publicly opposite it via bills like this and use media giants to crush 'conspiracy theories' involving people like Epstein and all the people he was closely associated with in Washington and Hollywood.
I think if we actually got evidence and leaks on how bad child abuse within politicians are, Americans would be absolutely horrified by the straight up hypocrisy.
EARN IT looks like a compromise compared to this: https://cyberlaw.stanford.edu/blog/2020/06/there%E2%80%99s-n... which is I assume why it was pushed only a few days ago.
Do you want creepy gov't contractors spying on your kids?
Perhaps instead of supporting politicians who "say" they're going to do X, Y, and Z we should support politicians who have a track record of doing exactly X, Y and Z regardless of how politically convenient it is to do something else.
More laws will not fix the problem of having too many bad laws, in my opinion.
In another sense, this is much crazier. There wasn't much at stake commercially in the nineties, but today, legislatively screwing up crypto could compromise trillions of dollars worth of commercial transactions if something goes wrong.
The Earn IT act is just another instance of the sort of incomplete thinking that produced the Clipper chip.
Reading the actual bill[1] rather than sensational headlines, you can see this is mostly about creating a tip line and bureauracy for reporting CP. Ctrl+F "encrypt" 0 results. Me no care. Deal with it Discord. Pass it.
[1] https://www.congress.gov/116/bills/s3398/BILLS-116s3398is.pd...
>>>Whenever the Attorney General has reason to believe that an officer of a provider of an interactive computer service has filed a false certification ... the Attorney General may issue ... a civil investigative demand requiring the provider to (i) produce any documentary material ... answer in writing written interrogatories ... give oral testimony ... furnish any combination of such material, answers, or testimony.
>>>The Attorney General shall maintain on the website of the Department of Justice a public list of each provider of an interactive computer service for which a certification has been submitted ...
>>>The best practices required to be developed and submitted ... shall include alternatives that take into consideration ... the transmission and storage of information on behalf of other interactive computer services ... provides the capability to transmit data to and receive data from all or substantially all internet endpoints on behalf of a consumer
For the last 10 years, encryption/privacy has become the watchword for people around the globe. I remember back when gmail was the first to use HTTPS for email and people freaked out. Today it's an expectation for everything and every service.
I think there are competing concerns here. The need for privacy and the need for safety. In order to keep everyone safe, we need to monitor what your doing. Some people will buy this, others wont. I think it depends on if you trust the monitor.
Its back to the 'do you have anything to hide' conversation, which I think misses the point. The point, I think, is that there is a fundamental right to privacy, that in some sense, is frustrating and annoying. It's the battles over WhatsApp, Apple IPhones, etc.
Safety and Freedom don't always go hand-in-hand. I remember watching TV shows/movies back in the day where there Soviets with AK-47s asking people for their 'papers' as they get on a train. Today there are armed police walking the hallways of my kids schools, at concert venues, TSA screeners at the airport, etc. There is a price for safety imho. There's a price for freedom too.
I'm not sure what the right answer is, but i wholly support petitions like this because they are the voice of the people.
The solution proposed by the researchers in the referenced documentary is to create AI agents that can automate the work of posing as offenders or posing as victims. This solves the scaling problem of the law enforcement agencies.
edit: It seems there is a misunderstanding of what the AI does. It simulates human traffickers in text or video chat in order to find people who try to exchange money with them, and it simulates children in text and video chat in order to find people who try to groom them. It does not simulate child sexual abuse material or proliferate child sexual abuse material.
If I texted you and told you I'm 13 years old, would you start hitting on me?
Tie the "correct" solution to their real political motivations and it will get done in a heartbeat. It has to be something they can sell to their base though.
Sadly, I think issues need constant re-engaging since they pop up under different names and in different forms.
https://www.eff.org/deeplinks/2020/07/new-earn-it-bill-still...
I've struggled a bit to find resources helping to describe what section 230 protections are actually for, however. Many of the examples explaining section 230 protections seem to revolve around things like defamation in Youtube comments or product reviews, but I'm having trouble making the leap from that to why messengers are so concerned about this bill. Why do tools like messengers need section 230 protections to begin with? AFAICT they still have to submit to things like national security letters, so what does section 230 buy, say, Whatsapp or Signal?
that said, there is also some text that changes specific wording in other existing laws that may have an impact on future court cases, e.g.: “(2) CIVIL REMEDY FOR CERTAIN ACTIVITIES RELATING TO MATERIAL INVOLVING THE SEXUAL EXPLOITATION OF MINORS.—Conduct by a provider of an interactive computer service (as defined in section 230 of the Communications Act of 1934 (47 U.S.C. 230)) that would violate section 2252 or section 2252A if that section were applied by substituting ‘recklessly’ for ‘knowingly’ each place that term appears shall be considered a violation of section 2252 or section 2252A for purposes of paragraph (1) of this subsection.”.
We could be charitable about what 'recklessly' means, but given the tendency of pre-digital judges to misunderstand technology - I can understand why there is a pushback against this kind of language.
"What do you mean you don't keep a history of your clients' internet activity? I would construe that as reckless behavior."
Needs elaboration, but I see two major points:
1. It puts our national security at risk. It opens up American cyber-security at large to nation states like China, Russia, and Iran, as well as more sophisticated terrorist groups.
2. It hampers innovation and competition in the tech industry. Compliance will increase costs, especially for startups, especially in a Covid19 environment, and the global market will not be able trust the cyber-security of American networks.
https://act.eff.org/action/stop-the-earn-it-bill-before-it-b...
Just enter an address in the box on the right and it will find your representatives/senators for you, select the right options for contacting them and then present you an editable form letter for sending to them.
Note that your senators and representatives may abuse your email address and phone number if you provide it: after having sent letters to Diane Feinstein and Kamala Harris' offices this way, I've received a lot more political spam calls and emails.
I'd really love to be missing something. It feels like this is just fading into the background... and while I can acknowledge the idea that you might just try to fight this as unconstitutional after it passes, that feels inherently risky given this administration (if not downright stupid).
It has been used encryptions and ciphers have been used for a long time, you cannot stop people from using a math function. It's like DO NOT USE multiplication from now on.
Then the government decided to ban encryption and then things started to get clearer.
Well, they can if it gets onto their hardware before being encrypted or after being decrypted, such as if it is encrypted or decrypted on their hardware, and since Huawei makes a lot of consumer gear...
In fact, the book is titled "Nothing to Hide: The False Tradeoff between Privacy and Security" by Daniel J. Solove. I would highly recommend for those who are security and privacy conscious.
I mean people should have a right to know who has had access to this information and why, right? Surely the constitution says something about illegal searches?
Why do we need all these analogies? Why not discuss real-life repercussions and pros cons of the choices before us, and based on that, decide what society we would rather live in?
I mean, the government already legally demands that all the large corporations make them a copy of all of your communications that pass through them. So why should it be legal for you to encrypt any of it without them being able to decrypt it? How are they supposed to spy on you effectively with just the meta-data, you know?
In the span of many decades, perhaps centuries, all manner of governments evolve into their final form: tyranny.
New version of EARN IT.
One would argue that terrorists will simply use other inventive ways to get around lack of main stream encrypted tech (and they will). Or that a back door for the govt is a back door for anyone (which is true). Both are logical points.
I posit that this is known among backers of Earn It - they're not that dumb. Therefore, this isn't about child porn or terrorists, its about dissenters of established institutions (government, corporations, media, etc). That's the move - the "party of Davos" sees the populist wave from both left and right (AOC, Bernie, BLM, Trump, Bannon, etc) and this how they think they will stop it.
The next AOC, BLM, or any populist movement will be labeled as threats to the established order, maybe as domestic terrorists. With Earn It, you can see who they organize with, when they meet, how they strategize, etc. This is COINTELPRO with smart phones [1]. Very slick, very effective. It's what I would do in their shoes.
The only flaw is that it is poorly marketed. It's so transparent, it's cute.
J Edgar Hoover is smiling somewhere in the after life.
Do yourself a favor, treat your phone and email like CIA recording device. We'll be fine.
[1] https://en.wikipedia.org/wiki/COINTELPRO#:~:text=COINTELPRO%....
works much better.
Paul Baran, co-inventer of packet-based networking, wrote "On the Engineer's Responsibility in Protecting Privacy" (https://www.rand.org/pubs/papers/P3829.html) in 1968, some 51 years ago. In it he remarked on both the risks, and industry attitudes:
There are many amongst us who would not hesitate to build equipment to compromise the privacy of any given individual provided the price is right. These are the whores of industry. They would not hesitate building systems and devices contrary to the public interest; their only concern is the buck.
The full paper, and in fact, all of Baran's RAND publications, are online in full-text, following my request to RAND. I remain grateful to them for this.
Baran was also interviewed for a 1966 BBC documentary:
"Well, he who has access to information controls the game. This is very dangerous. I think both your country and mine have never trusted the government completely. We do so for good reason. Here we have a mechanism that could be abused. Here we have a mechanism that would allow the creation of a dictator. . .
I've yet to see an expression by anyone in Congress about this new type of danger. In fact, we see proposals for centralizing information, we see proposals for rushing ahead into new, more efficient computer information systems, and very little thought is being given to the dangers of the misuse of these systems. . . I ask a lot of people about privacy, why they valued it, and I was surprised by the number of people who said "Well, I don't do anything wrong. Why should I worry about privacy?" And then, on the other hand, I think there's a more wise group that says, 'Privacy is really the right to be wrong, then go on and live the rest of your life, without having it mark you forever.' I tend to think this latter view is the view we should hold.
The video is, unfortunately, no longer online, though it was previously at:
https://youtube.com/watch?v=FwaDvJYZTVk&t=29m31s
Internet Archive reveals that the programme was "BBC Panorama - California 2000" (1966) (https://web.archive.org/web/20180526090012/https://www.youtu...). But does now seem. to be on Vimeo: https://vimeo.com/170324749 Quoted sequence begins at 31m.
Another view was expressed by AI pioneer and Nobel Laureate (economics) Herbert Simon:
"The privacy issue has been raised most insistently with respect to the creation and maintenance of longitudinal data files that assemble information about persons from a multitude of sources. Files of this kind would be highly valueable for many kinds of economic and social research, but they are bought at too high a price if they endanger human freedom or seriously enhance the opportunities of blackmailers. While such dangers should not be ignored, it should be noted that the lack of comprehensive data files has never been the limiting barrier to the suppression of human freedom. The Watergate criminals made extensive, if unskillful, use of electronics, but no computer played a role in their conspiracy. The Nazis operated with horrifying effectiveness and thoroughness without the benefits of any kind of mechanized data processing."
https://pdfs.semanticscholar.org/a9e7/33e25ee8f67d5e670b3b7d...
There is, of course, one slight problem with Simon's argument: The Nazis did make heavy use of mechanised data processing, provided and supported by IBM. Edwin Black documents this meticulously in his book IBM and the Holocaust:
We've had warrant-proof encryption for a long time now in our society (at least 20 years?).
'JoshTriplett explained it better than I did: https://news.ycombinator.com/item?id=23704928
This is an obvious short-term mitigation tactic until they develop brain implants that can pre-emptively moderate harmful thoughts.
- Undercover police work and informants, which is how most large busts already happen now. The worst offenders are not swapping child porn on Facebook or Dropbox
- Encourage marriage and remove benefits penalties for two-parent households, as children are substantially more likely to be abused when their biological father is not in the household
- Institute the death penalty for child sexual abuse and make sure it is performed swiftly and publicly
What you can crackdown on are the producers.
You can infiltrate the places where it is originally disseminated.
You can run face and voice recognition on the content.
You can flip lower level mass distributors into informants to gather evidence on the producers.
For rapists.
You can train teachers and counsellors to identify children who have been abused and to handle other psychological problems like depression which are endemic in our society.
You can train police officers to better spot criminals on a basis other than race or status.
You can better fund the CPS.
You can conduct assessments on parents who appear to be mentally unstable.
Before you think that's too harsh, consider that the other options are to ban encryption or to not try to stop it at all (quasi-decriminalization).
I don't think anyone would oppose a bill to make CP carry the death penalty. The problem is they won't ever make this law because then they won't be able to milk the cow anymore.
Problems start to arise when the government pretends they _are_ the former and pretends they _are_not_ the latter.