Why 'I Have Nothing to Hide' Is the Wrong Way to Think About Surveillance (2013)
wired.com
wired.com
To me the problem is that most people think they're living a "normal" well-to-do life until a group gets power that thinks you don't or didn't and wants to arrange a circus for attention.
Some popular responses I've seen to pro-privacy concern:
- caring about privacy is "narcissistic" because nobody would possibly care about Tom or John's internet search history.
- privacy is just an excuse for people to avoid "consequences".
- privacy people are just criminals disguised as advocates.
There's commonality in these responses, but I'm not sure what it is.
If the person understands why the freedom of speech is important, you can explain that privacy is needed to protect whistleblowers, journalists and activists. Only when everyone has pivacy, it becomes hard for the government to target them.
Cheapest privacy lesson they'll ever get.
(The point: privacy about who is allowed to acquire the valuables. The owner is in control, not someone else. Once they decide to give that away: fine, now it's no longer under their control.)
Sometimes I think the issue is not being personalized enough, as in, because they do not know the person doing it, it is not an issue. It is an issue if it is you, standing next to them, but it is not an issue if you would be out of sight. It is silly.
You can also try Edward Snowden's analogy:
“Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.”
Sadly I worry that many people don't care about freedom of speech either. I wonder if such people would also be unmoved by this analogy:
“Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about the right to vote because the party you support is currently in power.”
There are hundreds of good arguments for a right to privacy. This isn't one of them.
There is a real temptation for people to think "Society is generally fine the way it is, so I don't want things to change", which makes them react negatively to things like protests or even whistleblowing (because it causes them cognitive dissonance).
Such people might feel confident that even if the government did abuse its power, it would only spy on, or silence, or hurt people who aren't like them. They therefore may not feel that these fundamental rights are doing them much good, and they don't consciously exercise them. However, many of them would exercise their right to vote, and could imagine the government turning against them if there were no more elections.
It often feels like privacy advocates start from a position that anyone who doesn't hold the same view as them must be missing some key piece of information, and are unwilling to accept that a person might decide that the tradeoff is actually worth it to them?
That could be the case, albeit that's fairly uncharitable. Usually when I talk to anti-privacy people they have a strong bond to a particular thing that makes them anti-privacy. That could be a bond with corporations that benefit from a lack of privacy or it could be some moral community that tells them a lack of privacy let's them find all the "bad guys". Of course, that's anecdotal.
Personally speaking, I don't mind decreased privacy as long as I have a way to opt out and data stays very anonymized. Providing that kind of choice, and minimal negative effects that negate the ability of a person to opt out, is the optimal choice for me.
Personally, my desire for privacy is starting to harm my daily life, as I am apparently unable to access Facebook Groups or Marketplace, both of which are heavily and almost exclusively used in my community for meetups and personal sales respectively. I know rationally that I can make a bare bones FB profile just to use these, but my personal (perhaps unjustified) paranoia currently still wins out.
On that note, if anybody knows of any open source or upcoming alternatives to those two services, please let me know so that I can see about making at least a local dent in FB's monopoly.
shared server or vps few bucks a month - add a free wordpress+buddypress, add free mediapress plugin - you have your own FB. - you can run one for friends, another for fam.. been thinking of doing exactly that as a quick spin up saas for people.
I recall a while back on HN a mention of a clone-like script for open source meetup.com on github?
Recently read that FB is making it easy to export posts to wordpress.. I have not delved into that yet, nor been on FB since that announcement. Would be great if they opened up marketplace and groups to export content (with the option for the group creators / marketplace listers to block things from being easy exported)
looking forward to less walled-gardens.. or at least more bridges.
I'm a privacy advocate, but I totally accept this. In fact, there are many instances where I have made such a tradeoff myself. The problem, though, is that very often people make this decision without fully understanding the tradeoff they're making.
That's part of why I lean heavily on the notion of "informed consent". Giving consent without being fully informed of what you're consenting to is not giving meaningful consent -- and entities that live on collecting data about people tend to avoid actually informing people what the deal really is.
This is exactly what I mean though. How are you determining whether someone "fully understands?" And why is the assumption that, after years of extensive media coverage topic, people who are still on these platforms "don't fully understand" the danger, as opposed to they understand and simply don't thing the risk outweigh the benefits?
By talking with them.
For example, I wouldn't care much about my aggregate step data from my phone or watch being used to observe walking habits or popular walking routes in my city, nor would I mind much about my aggregate location data being used to observe store patronage in my city. I prefer to opt-in to these things, and have an understanding of the data I am sharing, and who I am sharing it with, but as long as it's aggregate, non-identifiable data, I am willing to part with it and still feel that my privacy has remained intact.
But as you say, people don't value privacy until they're hurt, and I think that's a really good place to draw the line. If the data collected about me can be used to hurt me specifically - to target me or expose sensitive information about me as an individual - then my privacy has been violated.
The recent Grindr controversy is a good example. If people opt-in to data sharing in the app, and the app provides clean, anonymized data to their partners that only reveals aggregate trends, then the privacy of individual users is still maintained. But since the data that Grindr sold was enough to out a clergyman and expose the specific gay businesses he was a patron of, then they clearly failed to preserve their users' privacy. The data they sold was enough to target and hurt someone individually.
The big issue I see is that most corporate data-sharing agreement put some of the burden of privacy of the recipient of the data, with the expectation that the data be handled in good faith and NOT be used to target people or mine information about specific people. The burden should lie entirely with the seller of the data to ensure that no privacy-violating data could be inferred from the data (including if combined with other publicly/commercially available datasets), and if they cannot ensure that then they should have no legal right to sell it, because there's no way they can ensure that it will be handled in good faith.
Last I checked, most people understand privacy from other people at some level. I only say that because I still see people wearing clothes and closing the door when using the restroom.
What they don’t understand is why they need privacy from centralized points of failure/exploitation.
This SMBC comic about government-mandated backdoors also uses intuitions about clothing to make its point, and it applies equally well to the issue of surveillance:
But that fundamentally doesn't matter in the least. I don't care what they do; but they cannot get access to my data without my approval. And they're definitely not getting my approval without some really good justification.
It's my data; I have no obligation to anyone else(*) to disclose anything about it.
(*) legal restrictions aside -- which is vastly different from someone who wants your data claiming they're legally entitled to it.
Let's say your brother is feeling depressed, you are naturally concerned, and do research on treating depression and suicide prevention and ask for advice on appropriate forums.
Unsurprisingly, it turns out that these activities correlate very highly to people with depression and low productivity, An employer then uses this information and decides to hire someone else for the job. The loan officer at the bank decides that you are not a good credit risk right now because of your recent search history and declines your loan application. At the same time, your health insurance decides to raise your rates because you are now in a "higher risk profile."
You would not be able to contest or correct these decisions because you would never know why they were made.
Furthermore, the people making the decisions based on the data would not know or care wha specific actions resulted in your profile or score.
It's not about you. It's about people who do have things to hide. Journalists and their sources, whistleblowers, dissidents, lawyers and their clients. They need privacy. Therefore, be on the side of privacy.
There are of course many other arguments, but this is the only one where I've felt like people I spoke to listened and began to change their minds.
So, why do you close the door of the toilet?
So, why can't I have your credit card details?
So, why can't I read all of your mail, email, and phone texts?
So, why was it so bad for the Stasi to do all of those surveillance things but OK that the Government now does the same things?
Knowledge is power.
Knowledge asymmetry places you at a disadvantage, always.
Further discussion:
4 years ago https://news.ycombinator.com/item?id=13965302
8 years ago https://news.ycombinator.com/item?id=5877973
My greatest argument for privacy is that being observed "freezes" your behaviour. You know that you are being judged, and that this has consequences, but the rules of the game are opaque to you. You can't tell which actions and labels your behaviour triggers. This will push you to err on the side of cautiousness, and to suppress any quirk that could draw attention.
For example, if your browsing history is made public, you might worry about what a person would conclude from it. Perhaps you like German military history a little too much, so you'll watch fewer videos about that. Perhaps you are a bit too keen to defend socialism, so you will moderate your speech. Let's not get started about the porn you watch.
Not only that, but the judgement is now done by a machine that sees, remembers and cross-references everything. The machine has authority, but no credible oversight. Its thinking process is opaque, and possibly inspired by the biases of its predecessors, from which it learned. If it considers you guilty, its owners also will. It will be your job to prove your innocence.
What is collected about you is remembered forever. It's not on an index card in a box deep in some archive. It's in a well-indexed, instantly accessible database record. It can be machine-processed, machine-scored and machine-judged in seconds, without leaving a trace. It can be duplicated and shared with third parties, also in seconds. There is no telling where that information will end, and how it will be used.
If it's not used now, it could be later, by a different group. It could be used against the person you are not anymore. If you think cancel culture is bad, imagine it being applied to the things you don't say.
The reason the "nothing to hide" argument is wrong is because its starting point is wrong. The surveillor has to justify themselves, not the surveillee.
Put another way: I do not have to argue why someone else should not get access to my information. No one else should get access to my information unless and until they come up with reasons -- and I accept those reasons.
You do NOT need to justify why you're not sharing data.
False. You’ll fear losing privacy and freedom to speak freely even if you have nothing to hide. We have seen this effect in real-time as governments began “secretly” monitoring communication in 2006 and even more so as tech companies started banning speech. You will self-censor even when you have nothing to hide.
Privacy is like the bathroom door. We close it even though everyone knows what we are doing. It’s not a secret.
It’s like the freedom to speak even if you have nothing to say.
You wouldn’t use a public bathroom stall that didn’t have a door. You would be plenty angry and confused if I started arbitrarily dictating what you could and couldn’t say.
You have plenty to fear even when you have nothing to hide.
Privacy should not be confused with secrecy. These two are often conflated by those who wish to compromise your privacy.
You're the boss of you; no one else has a right to info about you.
(sure, barring legal circumstances -- which should be challengable in a court)
I agree with it. Group powers are abused by the individuals in charge, and frankly I just value the individual above the group. But worth noting the distinction.