Hacker News Reader

Comment by wongarsu | Hacker News Reader

In principle I don't have a problem with the police getting a warrant to find out who searched for a specific name or place in a constrained time frame. It's a bit like the police asking the library who checked out a specific book.

The problem is that this could obviously be used with keywords that target a wide group of people, e.g. finding everyone who plans to attend a protest. If we continue to allow keyword warrants we should add a law limiting their reach, e.g. by limiting the number of people who can be revealed in the answer to any one such warrant.

View on HN

> It's a bit like the police asking the library who checked out a specific book.

And you have no problem with this? Government and police looking into and judging you based on what you read is one step away from policing wrongthink. You can't learn anything deemed dangerous anymore without being arrested. Can't look up how a bomb or sarin gas works without SWAT coming down on you because you're obviously a terrorist.

This government collusion with Google is the same thing. Government and police show up and say "find me a list of people who searched for dangerous knowledge". This is normal now, without even the trepidation depicted in films like Se7en.

They said “specific” book, which I take to mean “we found this book at a crime scene, can you tell us who checked it out?” Not, “I want to know everyone who checked out war and peace this year.”

But after thinking about it, I think they meant the former and you meant the latter. But to the library, it’s the exact same thing. A library doesn’t (traditionally) track each and every book, so if it’s a popular book, it could have been checked out by any number of people.

I think this is fine, as long as courts work to keep the scope small and laws allow people to do whatever they want without hindering freedom.

Libraries track books individually. If you and I each check out a copy of War and Peace, and you turn yours in on time but I don’t, they know who to pester.

I think there’s a continuum from the cops being able to say “we found this here book at a crime scene, who had it checked out?”, which should clearly be allowed, to “the security footage shows a copy of War and Peace with the libraries sticker on it in the crooks hand, who had it checked out”, which should probably be allowed, to “we need to know everybody who checked out The Anarchists Cookbook in the last six months because the crook used an IED thats described in there”, which probably should be allowed.

> If you and I each check out a copy of War and Peace, and you turn yours in on time but I don’t, they know who to pester.

They track checkouts. But back in the day, we could switch checkout cards in the cover of the book and return them and the library would never know the difference. With modern computers and barcodes, I do believe the individual books are tracked.

I hope you forgot a “not” in your last example!

Indeed!

I think the library warranty thing depends. If the government wants to find out who checked out the Communist Manifesto so they can jail them for thought crime - that's bad. If the police want to know who checked out this specific copy of Harry Potter because they found it at the scene of a murder, that's good.

Sure, I might've just dropped my copy of Harry Potter near a murder as I innocently passed by. And yeah, I might've been looking up the victim's name and address in Google purely out of curiosity right before they got murdered. Neither the Google search nor the book are dispositive but they fit into a broader context which could be used to convict or exonerate me.

Ultimately we need laws or judges to set reasonable limits on powers that could be used for good to make sure they aren't also overused for ill.

There's an in between situation where someone is looking for correlations with a crime, but they are simply searching so much data, that they inevitably get a huge number of very close, but invalid matches.

This tends to be a problem more and more with ever increasing databases that are convenient to access.

People have intuitions for coincidences that are not appropriate for vast amounts of data.

Things like this make me think of the movie Gattaca. Mild Spoilers After the murder, they just go around vacuuming up any and all organic material to test for DNA. They get a hit from someone who “isn’t supposed to be there” and immediately focus the entire investigation on that person. It fits the very real pattern of using science to just confirm the human biases held by the people using it. If police can sweep up and search through a mountain of data, it is going to be the Muslim immigrant hit they focus on over the white middle manager. It will be the person struggling off and on with homelessness that gets arrested because they matched a pattern and didn’t have an alibi, over the suburban mom.

That if you give police a list of random correlations, they will focus on “those people” that are assumed to be more criminal and usually have less means and ability to fight back.

This is a really great insight, and demonstrates where the "library book" example is lacking.

Since Google is so vast, I can find a page of search hits to support any particular belief I might have, no matter how wild.

> And you have no problem with this?

It was only a problem when George W Bush wanted to do it. :-p

I always thought that it was generally accepted that if people tried to get hold of your library-loan records; that that was a red line. You can't call a place a free country if the police can ask for your library information.

For instance: In the Netherlands, libraries tend(ed) to destroy your loaned-book information ~ when the books were returned. (They seem to have since picked up some data-mining habits?)

Historically, I don't think there was much concern in the US over library records. Before library records were computerized it was often easy for anyone to find out who had checked out a given book and when.

A typical system might work like this. Inside each book there was a pocket attached to the back of the front cover, and in that pocket was a card.

When you checked out the book, your name and library card number and when the book was due were added to the card, below the entries for previous checkouts, and the card was filed somewhere. A card showing the due date was placed in the pocket and you could then leave with the book.

When you returned the book the checkout record card was put back in and the book re-shelved.

Want to know who has checked out a book before? Just walk into the library and look at the checkout card. No need for a warrant, and no need to even ask a librarian for the records.

Eventually the card would fill up and they'd have to start a new one. I don't know if they kept the old ones or not. Since storing them would take space, I'd guess they were probably thrown away (perhaps after recording some stats on how frequently the book was checked out, because those might be useful in the future when deciding on changes to their collection). If they were thrown away, I don't know if they would have taken care to destroy them or just toss them in the garbage.

That's certainly not a bright line in any American jurisdiction. Courts can and do order the production of library loan records. In general an American court can order the disclosure of any record maintained anywhere by anyone for any purpose. There are no records that are private and privileged against a court order, with a few narrow exceptions. The police can't order someone to produce anything; they need a court order to do it.

Hmm, this appears to be a relatively new power.

https://www.propublica.org/article/remember-when-the-patriot...

No, American courts can order the production of any kind of records, and always have done so. Law enforcement goes to the court, shows "probable cause" regarding a current case, swears to the facts of the case, and the court orders some third party to produce the information. The third party is obligated to comply or contest. This is the legal process to which people are due in the phrase "due process of law".

The Section 215 powers you refer to move jurisdiction of certain matters from one court to another. That's perhaps not great but the main effect of it is giving law enforcement a more secret venue in which to seek warrants.

Also note that this legal theory only comes into play if they're compelled to do so. The police and investigators can always just kindly ask for records to be produced without a warrant and it's up to the institution to honor that request or not, much like how Google does its own review of law enforcement data requests in absence of a warrant.

It seems you are right. And other countries have long done similar or worse.

I always thought that in the west you had a freedom of thought and could pursue whatever direction of research you wished without consequence. After all, without freedom of thought, you can't really have proper freedom of conscience, let alone freedom of speech.

I'm slightly disturbed that apparently it's not quite that simple. Today I'm one of the (un)lucky 10000 I guess. https://xkcd.com/1053/

Jeffbee is right, but I would also point out the number of hurdles identified. Before the patriot act there were 100% violations of personal liberty and restrictions on consumption of information but there were more hurdles.

The point of the post here isn't that Google is providing records (which they have always if the situation has been identified as appropriate by a judge + public safety + ....) but that they are providing a really high level, in no way targeted or restricted request for records

Wasn't there a fuss about Robert Bork (Supreme Court nominee) having his video rental records disclosed? Long before the Patriot Act.

Yes but again, please don't conflate these two unrelated topics. Bork's video rental records were voluntarily disclosed by a video rental shop to a newspaper reporter. A person has no particular constitutional right to privacy in such matters. This was Bork's own opinion on the matter! Later, Congress passed a law making such records private.

But that's all neither here nor there. We're discussing a court order. No law prevents a court from ordering the disclosure of video rental records, even today with the Video Privacy Protection Act, because the VPPA allows disclosure "to a law enforcement agency pursuant to a warrant issued under the Federal Rules of Criminal Procedure". Because that's what courts do. There's really nothing that is protected from court orders in the US, except for a few well-known, very narrow exemptions.

>"If we continue to allow keyword warrants we should add a law limiting their reach, e.g. by limiting the number of people who can be revealed in the answer to any one such warrant."

What's frustrating is that that limit is already present in the constitution itself: "upon probable cause... and... *particularly* describing the place to be searched, and the persons or things to be seized". "Particularly" isn't syntactic sugar; it is a word with meaning. "Specifically, uniquely or individually"; "In detail; with regard to particulars". Mass/dragnet/geofence warrants aren't constitutional.

https://en.wiktionary.org/wiki/particularly#Adverb

Plenty of federal judges seem to agree,

https://www.eff.org/deeplinks/2020/08/new-federal-court-ruli...

"...geofence warrant violates the Fourth Amendment’s probable cause and particularity requirements"*

Why would a library have records of who borrowed what?

The old manual system in the UK worked on a system where your library card was a sort of envelope into which the book's card was placed and then it was placed in a tray in chronological order. When you returned the book you got your card back and there was no trace.

The library would only be able to say who had the book at the moment when they were asked not for times in the past.

See https://www.1900s.org.uk/1940s50s-library-systems.htm

Most people do not have unique names. The number of unique names in the USA is estimated to be around 750,000 (using census data). Out of a population of 330,000,000 people. Which means, on average, 440 people will have the same name.

And these names will be clustered in population centers because people cluster in population centers. And since surnames are generally familial, people with the same names are very likely to live near other people with the same name.

You can use public records searches to find people nearby with the same name as you. You might be surprised at how common it is to have people near you with the same name. There are a few people locally who share a name with me, and who own businesses that probably get a decent amount of internet traffic based on name searches.

> It's a bit like the police asking the library who checked out a specific book.

After the patriot act was passed enabling the government to seek this kind of information my local library changed their records policy to not retain information on who checked out books after they were returned (or at least only for a strictly limited time after), as well as a host of other pieces of data-minimization. My library also put up signs explaining how to use the library most privately (e.g. that if you visit and read books on-site no one will ever collect your name or other personal information).

I understand many other libraries did as well and that the ALA promoted such changes.

Access to your library history is a violation of your mental privacy. Imagine you found yourself questioning your sexuality, -- you might check out books on the subject. A few years later a repressive regime could come into power and you might find our that your inquisitiveness a few years back placed you under enhanced scrutiny.

Because the access to search is even more casual the invasion is even more severe. And unlike your local library Google is MUCH less likely to consider your personal freedom a big priority.

>It's a bit like the police asking the library who checked out a specific book.

https://www.theguardian.com/world/2015/jun/05/nsa-surveillan...

https://slate.com/technology/2015/06/usa-freedom-act-before-...

> In principle I don't have a problem with the police getting a warrant to find out who searched for a specific name or place

Wow. So, people like you actually do exist. This is both scary and sad.

Wow. So people like you actually do exist.* This is both scarier and sadder.

*ie not already realising that people like them actually do exist.

Reply on news.ycombinator.com