Hacker News Reader

Comment by ehnto | Hacker News Reader

Hm, it's challenging because of the new medium but maybe we could discuss a real world analogue:

You walk in to a home expecting to meet your friend, when you enter there is a man from the TV network there. You didn't expect him, his intention is just to watch you and your friend talk about television shows.

Perhaps an example that gets closer to the crux of the problem:

You're at a restaurant with a friend, and an unrelated stranger nearby can overhear the conversation. Not a participant, right? Now imagine they were sent to listen to you, and report back to the TV networks. I would say that, they have a very clear intention to participate in the conversation.

View on HN

What if the "man from the TV network" is really a "man from Amazon" only it isn't a man. It's a Ring doorbell, clearly labeled when you came through the front door. Or it's a little Echo in the corner of the room.

Does that mean Amazon was invited to the conversation? Should you as a visitor to the home expect that every logo you see in the house means that you agree to have that company present in your conversations during the visit?

Does a Facebook icon or a Google icon or an Amazon icon on a webpage give them the right to participate in your conversation? Does a Windows logo in the corner of your screen give Microsoft the same right?

Is it ok if they don't record audio or video, just metadata?

In most states and federally, one party consenting to a recording is sufficient, so in those cases it doesn't matter that you, the visitor, give consent.

In states with two party consent laws, I think you're required to have signage or other explicit message that declares recording is in progress (this may be different for residential properties): a Ring logo may not be sufficient.

There’s usually an option to not record audio in the software because in the states that require consent of all parties, audio recording is usually still not allowed without explicit consent of everyone in a non public location even if a notice is placed.

What about a 3rd party? You give consent to the homeowner, but do you also give consent to Amazon?

One party is sufficient. Whether you give consent -- to anyone -- doesn't matter. Your interlocutor is free to consent anyway.

AFAIK there is only one state with single party consent.

FWIW: https://recordinglaw.com/party-two-party-consent-states/

> Does that mean Amazon was invited to the conversation? Should you as a visitor to the home expect that every logo you see in the house means that you agree to have that company present in your conversations during the visit

In short. Yes. Some states only require the _owner_ of the device to consent to being recorded. PDF download below

[1] https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

Some states only require the _owner_ of the device to consent to being recorded.

I hope that's the law everywhere (especially private property) or else security cameras could not exist be legal.

I am fairly sure that some places do not, but consent is implicitly obtained through signage.

And heavily regulated signage at that, in terms of design, content, and visibility—not just anything that says something somewhere.

It's not. In e.g. Germany, security cameras may not film public areas, or anything outside of your own property (and also not private streets leading up to your mailbox).

Additionally, they must always be clearly labeled, clearly visible, and before getting into the range of them you'll have to have a visible sticker warning about them, and having a clear GDPR privacy policy as well as contact data for whom to contact to retrieve or delete the footage in case it might contain you.

Consider this though: you walk into a casino and start gambling, and the casino hires a third party company to watch its security cameras. No one seems to have any issue with that arrangement; is this really so different? I think the key to understanding the situation is that the establishment makes the rules; the establishment put the like button there.

This calls out a really interesting extrapolation of privacy laws that have existed for many years.

For a long time, I (as a human) have permission to watch people around me.

I also have the legal right to record what is happening around me (many states only require one people to be aware of recording activities)

I also have the legal right to record YOU, assuming we are in a location where I can lawfully stand. And I can tell other people what I saw.

Now, I can put a camera somewhere, record EVERYONE, track people, and sell that tracking information.

All because we didn't anticipate the computing potential to record and process EVERYTHING.

So do we consider the web and websites to be public places or private places, and does out change depending on who runs the site?

Is a government website a private setting? Is a personal blog private or public?

I wonder if other countries have already explored this and written some law about it.

Any website that is not behind a pay wall or does not require me to login to read the content, I would consider it to be a public site.

I think you are using "public" differently here than a lot of people would. A public bathroom is still "public" in that it's available to anyone and doesn't require specific information about you to use. However, most people would still consider it a private place, and expect their privacy to be respected while using it.

That's a good distinction. If the casino sent someone to listen at an unaffiliated restaurant that is different to the casino having agents in it's own premises.

Expectations of privacy are already pretty well defined: https://en.wikipedia.org/wiki/Expectation_of_privacy

You have an expectation of privacy in your own home - but you can't take back what you shared to your friend when you discovered he writes down every conversation on his blog. Intent isn't super relevant.

For the purpose of the wiretap act, 'participant' is unrelated to intent.

Interesting, I didn't realize "expectation of privacy" was related to (and dependent on) the 4th Amendment. Seems like a gap in our laws; expectation of privacy from people who aren't the government.

I mean, society won't function if you have to give everyone outside of your home consent to look or speak at you. Unless you plan on blinding and deafening the whole world, there's going to have to be a line somewhere about what we are allowed to learn about the people around us.

The concept you are looking for is "reasonable expectation".

Maybe the analogy should be: you go to meet a local contractor, and a representative from the cable company is there to help advise on the work. Neither of you are aware that he is recording the whole conversation, and that will use that information to send you targeted junk mail.

You're moving the goalposts.

Here, let me refocus the goalpost for you.

> I have no way to know that their widget is even on the site until I visit it

You can ask, and expect an honest answer, from your friend about any TV news crew.

And you don't really have an expectation to privacy in many restaurant settings.

The analogy wasn't really about that though, I was trying to explore whether or not the third party is considered a willing participant or not, which changes the implications of the data collection.

A stranger in a restaurant can't help that they heard you talk about something private, but it was entirely the fault of the person sent to intentionally record a conversation so you could say they willingly participated in the ordeal.

Backing out of the analogy, Facebook willingly collected the data, it was entirely their intention to collect the data. So the responsibility of that data collection is theirs, and they were an active participant. I think it's important to set that precedent, because we all know the technology was entirely indifferent to what it was collecting, but we can't use the inadequacies of a technology and process as a way to excuse companies from responsibility. Holding them accountable would force them to get better processes and improve the technology so it doesn't happen again.

How about this analogue:

You come to a restaurant to eat dinner with your friend, who arrived early. Unbeknownst to you, your friend arranged for one of their acquaintances, who you don't know, to sit at the next table and secretly record the whole conversation.

And your friend might or might not know that the acquaintance is recording.

This is perfectly legal in most of the US.

Famous people and their paparazzi followers probably know all too well that when you are anywhere an eye can see from a public location you can be recorded.

Famous people have different expectations of privacy than ordinary people.

Citation?

Public Figure Doctrine in the US. According to it, if you are a public figure libel and defamation have much higher burden's of proof whereas if you aren't a public figure you don't. And there are concepts like "Limited Purpose Public Figure" (as distinct from 'all purpose public figures'). All purpose public figures- people who are in "positions of such persuasive power and influence that they are deemed public figure for all purposes"- like movie stars, sports stars, and politicians, have essentially an impossible time winning any court case bringing libel or defamation (they need to prove "actual malice" on the part of the person doing the defamation). LPPF's are people who make themselves public figures on a single controversy or issue, and have a hard time proving defamation on that topic, but are still private citizens for other purposes. Say, an otherwise unremarkable person who is the named defendant in a Supreme Court case- for the issue that went before the Supreme Court they will have a hard time proving defamation but in terms of the rest of their life they have the same protections that anyone else holds, and a lower burden of proof for damages.

All of this was worked out in the 1960's and 1970's, and I don't keep up on it so I'm not sure how courts have mapped Limited Purpose Public Figures onto modern social media: is an Instagram influencer a LPPF or a all-purpose public figure or a regular person?

I found this:

> My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as "reasonable."

[0]: https://en.wikipedia.org/wiki/Katz_v._United_States

As I understand it (and IANAL) there is a pretty well-established legal distinction between people whose job or avocation inevitably involves being famous and noticed, and just ordinary citizens. If you become a politician, singer, actor, etc. it is assumed that your expectation of privacy is different than for most people. Again IANAL, but my understanding is that just because photographers are allowed to hound famous actors, doesn't mean they can do it to someone who isn't newsworthy or otherwise in a public profession. IANAL.

and the acquaintance is paying for the free restaurant food.

For doing that, he feels entitled to share his notes with anyone who pays him.

In this already murdered analogy, they aren't even paying all of the rent. There is a rumour they paid a server once but nobody has ever seen them. You have to bring your own food and wine and cook it, but you're encouraged to share with other tables. Some of those tables were paid to be there. There is also a stream of bored looking people wandering round, occasionally one of them will drop a snack on your table.

The only people you can see that your friend hired are interacting with these snack droppers, telling them which tables to go to. It's unclear if this is very effective.

This seems to be getting out of hand, but unfortunately the accurate analogue representation is even more complicated.

The country/world leaders are probably still thinking in analogue terms, so it might be important to find an accurate representation.

They might also be disincentivized to change anything, so it might also be a fool’s errand.

I'd go a step farther, because I think it's what should really be relevant in this case.

You come to a restaurant to eat dinner with your friend, who arrived early. Unbeknownst to you, your friend arranged for one of their acquaintances, who owns a business, to observe and document your arrival, from a concealed location, behind a sign for that business.

What's relevant in this case should be that a reasonable person, upon observing a Facebook "Like" button on a page, comes to the conclusion that "that button exists for me to interact with, and interact with Facebook, related to this business."

More specifically, a reasonable person would not come to the conclusion that a Facebook "Like" button allows Facebook to load arbitrary code into your session with the business, the purpose of which is to track you and compile information on you.

It's unreasonable to expect people to choose to opt out of what they don't even understand.

Since we are stretching to find analog analogies, the Facebook case is more like:

You are communicating with your friend, but instead of talking directly, you write a note, hand it to Mr. Facebook, who opens it, reads it, then closes it and hands it to your friend, who in turn writes back, handing it to Mr. Facebook first. That’s more how communication happens on FB. FB acts as the mediator of the communication, a middle man whom both of you interact with to have the conversation. They are not spying from afar—you are directly giving them your communications.

Add to that:

If you write something on your note, which Mr. Facebook doesn't like he takes the liberty to alter the note before handing it to your friend.

Are you sure?

If I write “A” is it possible that “B” arrives?

Or are you talking about censorship, so if “A” is unlawful, then it does not arrive at all?

A lot of links are on Reddit, which I can't access. But have a look at [1] and more specifically [2].

[1] https://www.google.com/search?q=facebook+censoring+messages

[2] https://linustechtips.com/topic/912936-facebook-private-chat...

I'd say it's more like, VendorA gives VendorB special buttons (like they kind you pin to your shirt) that promote VendorA, analogous to the "like" buttons.

You visit VendorB for private financial counseling (like an https web session). VendorB is wearing the button during the session.

Unbeknownst to you (and probably VendorB), the button is recording some metadata of your encounter: when you went there, for how long, how loud your voices were, and VendorA periodically scans the button for this data and collects it.

Just like on the web, you were never aware of the implications of the VendorB button, and had no chance to opt out before the recording began.

> it's challenging because of the new medium

I think this is the whole crux of everything. Trying to look back on past analogues really don't make much sense in my opinion. The fact is the old decisions were made in the past environment they were a part of. That environment has changed dramatically. The surveillance possible today simply wasn't possible in the past. Sure someone could setup a wiretap or a directional microphone, but the shear ubiquity of easy surveillance by so many different actors makes the environment fundamentally different at the application of past analogues pretty much pointless (in my opinion anyway).

I understand that legal precedent is built into the US legal system, but I think its applicability is often over emphasized. These are new times. Trying to apply past logic when the game has so completely changed is a fool's errand.

I'm not sure I would push the analogy that far.

There are real world examples of ad tracking that are more similar. Bluetooth trackers in physical retail, digital billboards. For the TV if you're using Roku or similar they are probably running content ID and know what you are watching.

A problem with all of the responses here is that they swing and miss at trying to find an allegory that matches this situation, and then conflate their allegory as truth, losing any of the nuances of the Facebook situation.

You can skew these examples to make your point stronger, too. (The Radio in the restaurant is listening to me!)

The only situation that matches is the exact one at hand: Facebook tracked user information in their share/like widgets. Is that ok under the law? It wouldn't surprise me if it was, but I don't I think the laws should be tightened up on this as well.

Really, we can expect this to go all the way to the Supreme Court, and I would not be at all surprised if one of the reasons that the Supreme Court did not quash it is that they know they will have to provide guidance (in the form of a precedent) for lower courts on expectations of privacy in internet situations, but they want to let every court below them kick the tires on this case first so that they can benefit from all of that investigation and discovery before they have to issue a ruling on it.

What about this:

Every shop you walk into has a secret camera that tracks everything you do. The cameras are all owned by a private advertising company that uses them to build a very detailed profile on you. On the plus side, the goods in the shop are often free.

A better analogy is a landlord having a camera recording their tenant, that for whatever reason the tenant agrees to.

A better analogy for the cafe is the eaves dropper works for the cafe.

Reply on news.ycombinator.com