Military intelligence buys location data instead of getting warrants
arstechnica.com
arstechnica.com
Honestly, I'm not sure why people care so much about the US government having access to this data while simultaneously not caring that any entity with a sufficiently large bank account can get it.
Maybe it's because so many of the people here work at the businesses that generate this data?
1. To guard against tyranny, always focus more on government overreach than corporate overreach because the government is the one with the guns.
2. Corporations scooping up endless streams of data don't get the same level of scrutiny and pithy talking points from libertarians as the entity with the guns.
3. Class of data-mining corporations collect so much data that it's functionally equivalent to a tyrannical government demanding direct access to everyone's location data.
4. The government-- the entity with the guns that we want to protect ourselves against-- simply buys access to the data from corporations to get around the law.
5. We've done a poor job of guarding against tyranny!
Edit: clarification
Right now, individuals, businesses, and the US military can obtain this data without a warrant or due process. How can you look at this and say "let's start by reigning in the military"? Who, I might add, have a far more limited scope than businesses since the military only cares about information related to whatever mission they're tasked with.
People do not understand what is being collected. I and probably everyone here has heard speculation that phones are constantly monitoring for keywords which are used in ads. It's an incredibly common idea that (afaik) isn't true, but shows just how little people understand how data collection works and again, what is actually being collected.
People do not understand how this data is used. The best example I can think of is with pregnant women. Every ad on every platform suddenly revolving around pregnancy and caring for a newborn is not the expected outcome of just googling for some mayoclinic articles. And of course if they're trying to conceal their pregnancy or worse, have a miscarriage, this has resulted in real world harm.
Finally, people cannot possibly consent to how this data will be used in the future. This should be pretty self explanatory.
Those who work for organizations that sell data or information gained from data such as Google or Facebook have to convince themselves the above is not true. In which case, it makes complete sense to insist that the US military needs to have a warrant in order to collect, since obviously a warrant is needed if the target for collection doesn't consent.
People in the mainstream don't understand what the worse case scenario is.
They give up their information and don't see any obvious consequences because they don't understand what the consequences actually are. The data gets used for things like price discrimination, which you're not even aware is happening, but then that "free" service ends up costing you $250/month.
Partisans spend all day calling one another fascists and communists, never thinking what would happen with the data in these companies if a government at the level of totalitarianism that existed in actual reality during the 20th century came to power in the 21st.
The past year should give everyone pause in this regard, no matter which side (or no side) you are on.
My experience as an American having lived in Europe now for over 7 years is that Europeans (in general, particularly in the Nordic region) have a profoundly different relationship to their governments than US citizens do to ours. The will to protect individual users' data and privacy as expressed in the GDPR for instance is a sincere expression of European values, and would be as in effect if "the power balance" were tilted towards European companies. I know European companies who avoid Google services and all American companies to hold important data, as but one example
[1]https://en.wikipedia.org/wiki/United_Fruit_Company#Aiding_an...
Have you met the British East India Company [3] and the Dutch East India Company (VOC) [4]? The VOC even has a genocide to it's name [1]. [edit] Make that two. [2]
A lot of colonialism was actually carried out by private enterprise. Substantially all of slavery. Once you reach a certain size and scale, is there really even a difference between government and enterprise - except that the voters control one and shareholders the other?
[1] https://historibersama.com/the-voc-genocide-historia/
[2] https://en.wikipedia.org/wiki/Amboyna_massacre
Even in the examples of the companies that you listed, their acts were generally state sanctioned, making government a party to that, and sometimes supplying state resources to commit them. And of course demanding their share of the spoils.
I do agree that there doesn't seem to be too much difference between large corporations and government. Also they tend to do a good bit of cross pollination of corruption.
The Brits got lots of mileage out of that one - Hong Kong for starters, and HSBC, which continues its storied tradition of facilitating immorality to this very day [3][4]. JM itself diversified after the wars and the company lives on as “a multinational conglomerate... with legal domicile in Bermuda”.
Kids, if you want to make it big without actually having to challenge yourself too much, make sure you stick to large-scale, officially-sanctioned crimes against othered groups of humans. That way, you get the George W. Bush treatment instead of accountability!
[1] https://en.m.wikipedia.org/wiki/History_of_Jardine_Matheson_....
[2] https://www.eiu.edu/historia/Cassan.pdf
[3] HSBC money laundering report: Key findings http://www.bbc.co.uk/news/business-18880269
[4] https://www.icij.org/investigations/fincen-files/hsbc-moved-...
>Once you reach a certain size and scale, is there really even a difference between government and enterprise - except that the voters control one and shareholders the other?
Voter control of countries over time and by country has varied from none to tenuous and I think shareholder control of enterprise might be the same. I think the bigger distinction is use of physical force/violence. A government is the collective with a near monopoly on force within a region. So the thing that makes it scarier when they get access to new tools of oppression is the exact thing that makes them what they are.
Maybe I’m just a tinfoil hat wearing conspiracy theorist, but I have a hard time believing media outlets are capable of giving reasonable coverage to those issues, given their entire revenue model is based upon exploiting mass data gathering in the form of modern ad tech.
A person's right to be forgotten should include their location.
Right now, the law doesn't even consider something like this as a possibility. The laws in the US governing information and what can be done with it haven't been updated for the computer age... yet another failure of our corrupted government.
People are concerned about the military and law enforcement getting the data because they're the typical "greatest threat".
If they did obey the law and not gain access to the data, people would then worry about corporations getting it and what they do with it. Priorities.
It's the #1 source for NSA reporting, eclipsing even their bulk cable wiretaps. They can hit a button and get Google Takeout, but for all major US online services, for anyone they choose, no warrant required.
These sorts of headlines pretend that their "normal" way of spying does require warrants. It absolutely does not.
A lot of people seem to still carry the misconception that the FISA orders (again, not warrants, no probable cause, issued by a classified court (also run by US military intelligence) that never denies a request) are only for foreigners ("foreign" is right in the name). That's also not true: they use it to target US citizens too.
This specific circumstance was cited by Ed Snowden as one of the main reasons he came forward and told everyone that this was happening.
https://www.eff.org/702-spying
The participants in this system as of 2013: Microsoft, Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, Apple.
https://www.theguardian.com/world/interactive/2013/nov/01/pr...
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Where is the violation?
Not saying this is good, just that it isn’t against the constitution. If the data is publicly available for purchase, nothing in the constitution says the government can’t buy it.
Heh, re: health data. HIPAA considers the name of hospital to be private information (try FOIAing the hospital names where people have died from COVID). But, if I go to a hospital with my phone on, then that fact will be available in location data that's bought by gov agencies. Through your qualification, have my rights ended by this fact?
I could get arrested too easily, by law enforcement who skipped some steps in the process and got the wrong person? Maybe LEOs more eagerly do SWAT raids when they know the person's exact location? (I'm guessing)
So, could it be a partial violation of "secure"?
"The right of the people to be secure in their persons, houses"
The problem is that we’ve all become accustomed to agreeing to give away our data, while pretending that we didn’t.
The violation is that they were able to sidestep legal processes like warrants by buying the data. If you don't see the issue with that, then I'm not sure what to tell you. It doesn't become okay just because they're purposefully avoiding legal scrutiny. It's like saying HSBC's money laundering is totally fine because they're successfully avoiding legal or law enforcement action.
The USG argues that since the same data is already being sold commercially, they can buy it on the open market without a warrant.
That is basic consumer protection common sense; but even without the pandemic and the other four horseman of the apocalypse crisis of democracy facing the US, and most if not all other nations on the planet right now, don't expect any such consumer goods to be on the agenda.
I think you just banned email hosting.
I think you might be a little lost. Whilst yes, they are buying location data. However, providers are _also_ supplying them with emails. And everything else they could want. And that isn't something that you can go and buy.
Googling, I found this https://nymag.com/intelligencer/2019/01/report-demonstrates-... , which seems to say it involved someone with access to the data selling it in an unauthorized way that's supposed to be against the rules of the company but is maybe not enforced much.
https://www.eff.org/deeplinks/2018/01/state-union-what-wasnt... link found at https://www.eff.org/702-spying
The wording here seems to suggest they can only use it for diagnosing their T-Mobile network, to emergency services or as required by law. Where is the loophole?
[1] https://www.t-mobile.com/privacy-center/our-practices/privac...
>and business
Loophole is right there. The improvement of their business can be interpreted as anything. Winning a government project, PR win, getting rid of a meddlesome or unsavory customer, supporting an unpopular government action to avoid unpleasant consequences.... All of those fall under improving their business.
Generally speaking, any phrase not explicitly defined and constrained in any sort of legal document is where you go to start looking for wiggle room.
If the DoD thinks it has the right to this data then whatever agreement you have with T-Mobile doesn't really matter. Ultimately that is what needs to be challenged in court.
https://www.wyden.senate.gov/imo/media/doc/at&t%20letter%20t...
That is the important part, everything else are just suggestions. If they view selling user data as one of their services then selling your data to someone else is a part of things the contract covers.
In that regard, the whole thing can be thrown out as <fancy word for> trickery.
The word that connects the first part to the list of reasons is ‘including’. Not ‘limited to’, not ‘strictly’, just ‘including.
Does that mean they are collecting location even if my device is on airplane mode with wifi and bluetooth off?
> The Supreme Court held in its 2018 Carpenter v. United States ruling that the government needs an actual search warrant to collect an individual's cell-site location data.
These appear on the surface to be 2 separate things. If they’re not buying “an individual's cell-site location data” then they are not circumventing the warrant process.
If a judge rules that aggregate metadata also requires a warrant (which I’d be ok with) then we have a path to object here.
My understanding was that cell phone companies sell data in aggregate but not for individual numbers.
Santa Claus has a bridge to sell you ;)
Even if there are no official channels, I'm sure there are informants willing to sell that data for the right price.
https://www.vice.com/en/article/43z3dn/hundreds-bounty-hunte...
From 2018. The wording says "as appropriate" to provide you with services. I'm not seeing anything here about collecting your location to resell. Does anyone have an explicit wording in a contract they can refer me to?
[1] https://www.verizonwireless.com/dam/support/pdf/collateral/C...
The carrier only has tower triangulation, which is less accurate but still valuable.
https://www.vice.com/en/article/j575dg/what-a-gps-data-is-an...
Does iOS grant apps access to your phone number or do these third party aggregators need another mechanism to link devices to phone numbers?
No - unless you grant access to Contacts.
For example if you're renting a vehicle from Avis in the mainland US and need roadside assistance because your rental vehicle won't start, they can use your phone number (if you give consent) to find where they should send the tow truck.
Next time you rent a vehicle from Avis, call their roadside assistance number to see this in action for yourself.
This is a useful service, most people renting cars are doing so in places other than where they live, and may not be able to describe the location they're stranded at. But it does raise the question of who else is receiving your location information.
In principle, yes.
In practice, due to the absence of meaningful remedies other than the exclusionary rule, not so much.
Rules are only as strong as the consequences for breaking them.
(But this doesn't seem to be a violation, anyway; data in a custody of a third party that is legally permitted to sell it publicly is neither being searched nor seized when it is purchased in a mutually-voluntary exchange by the state.)
Intelligence agencies have no authority to arrest you, nor would they have any interest in doing so. Their job is to gather information about what other countries are doing that might be harmful to the US.
Even then, I think warrants generally aren't required for publicly available information.
Privacy is liberty and property is property. Unreasonable search and seizure is unreasonable and prohibited (even if there is no current effective remedy) in all cases, not just criminal justice.
> Even then, I think warrants generally aren't required for publicly available information.
This does seem to be the decisive issue in this specific case.
Your water utility voluntarily selling information about your water usage to the government is not unreasonable search and seizure, and does not deprive you of any property.
I don't think you're going to meet a lot of legal success by framing privacy in this context.
Last I heard, Snowden is still scapegoated, and nobody from the NSA has been held accountable, or anyone inside any of these other 3 letter government agencies...