Hacker News Reader

Comment by akamaka | Hacker News Reader

It’s very disingenuous for privacy advocates to imply that the Canadian government created new surveillance powers during the pandemic.

These mobile network tracking datasets have been commercially available long beforehand. The public health agency simply put them to use to get accurate measurements of how much lockdown restrictions were actually translating into reduced movement.

Public health agencies have long been entrusted with handling personal information that is much more sensitive than movement data, so if these privacy advocates want to be taken seriously, they should do some genuine research on how this data gets used instead of simply suggesting that the public health agency must be distrusted by default.

View on HN

Many years ago I had to take mandatory privacy training for some contracting I was doing for a non-profit (open source case management for homeless shelters in Toronto).

It was actually quite informative. And what I got out of it is that I "trust" the public / government institutions in Canada a lot more than I do private ones. Yes, they're often incompetent. Yes, I'm sure there are rules broken. But years of working in the private sector and seeing how cavalier user's PII was treated vs the legal protections actually expected of government agencies... There are very stringent regulations in place on the who/what/where of data that comes into public agencies.

There is a tone in this thread, from some, of an intrinsic expectation of malice by the state. But I actually have more expectation of responsibility by layers of governance here than I do of private entities, which are generally further outside of my control or visibility, often keeping my data in American data centres, etc.

I trust the moral judgement of the average government worker more than I do the moral judgement of the average Big Tech worker or CEO, but I trust the technical competence of the Big Tech workers more.

I expect the government to try to protect my information from everyone except for themselves, but fail to account for what I consider basic security practices. I expect Big Tech to be safer from malicious hacks and tech exploits, but they'll sell my info to the highest bidder.

Basically one is an unlocked but well-guarded warehouse and one is a warehouse that requires 50 keys to open and is on the ocean floor but the warehouse company also runs key-stamping and submarine businesses.

Sure, I agree, I think you basically restated what my proposition.

The key thing is that we can fix the technical problems in government. But the privacy failures of the private sector are built into the predominant business models of the tech sector itself and harder to fix. (Full disclosure, I worked in ads for many years before walking away in disgust)

I should say that -- coming off a 10 year stint at Google -- Google takes PII super seriously and does a very good job of protecting it technically and organizationally. I'm sure most other BigTechs do, too. But clearly this data, people's private data and models of behaviour etc based on that, is a major source of revenue in our industry.

Another point on this topic: Governments and do act with malice to their populations in some situations, but in general Canadians have higher expectations of, and higher trust for, their government than Americans seem to on the whole. Hence our single payer health system and the classic motto of 'Peace, Order, and Good Government' which characterizes our commonwealth vs the 'Life, Liberty, and Pursuit of Happiness' etc. of the American Republic.

To be fair, that only applies to big tech and some fraction of non-tech companies. The rest have a fairly cavalier attitude towards computer security.

How do you think the circumstances and motivations of a government employee differ from those of a CEO?

After working for Canada's Defence, I certainly don't trust how they protect military members' medical data. It's on a separate network which requires asymmetric crypto for access, but the actual data has yet to be encrypted. I think that's unsafe, considering how it's common practice now.

>> but the actual data has yet to be encrypted.

You probably don't want to look too closely at how medical records are being kept in the private sector. Encryption is supposed to be a rule but the exceptions and loopholes mean very little is properly encrypted.

Most medical privacy rules can be met by implementing drive-level encryption, transparent encryption that protects only against hard drives being stolen but does nothing to prevent data extraction from a live drive. A small medical office can probably get away with simply turning on bitlocker.

You make this seem as if it’s no big deal at all. If that is true why wasn’t the Canadian health agency open and transparent about it from the beginning?

Perhaps people don’t want public health agencies tracking their movement? Perhaps the Canadian health agency knew people wouldn’t like it and decided not to disclose it publicly. An omission of fact is fundamentally equivalent to an outright lie.

Which then begs the question of what else they aren’t disclosing.

Why should people trust a lying public health agency?

>> Perhaps people don’t want public health agencies tracking their movement?

Sure, nobody wants the government to track their movements. But lots of people are perfectly happy with government doing practical contact tracing of covid patients. The only difference is wording. Personally, I very much want to know if I the guy sitting beside me on that flight/bus was carrying omicron. If that means a government agency occasionally looks though cellphone records, so be it. I actually trust my government to do such things.

Unlike Americans, Canadians generally give their government much more credit in these areas. A Canadian generally trusts that such information isn't going to be handed over to police without good cause. And they know that the police have better things to be doing that tracking people for petty offences. And even if caught for some crime, Canadians aren't subject to the US prison industry. At each layer their is a greater level of trust in government. The net effect is that these stories don't really bother much of anyone.

That’s fine. Different people from different countries with different laws can have different opinions about surveillance.

But that just further begs the question of why the Canadian public health agency wasn’t open and honest about it.

Contact tracing involves some degree of consent, but this is dragnet surveillance without your knowledge.

> I very much want to know if I the guy sitting beside me on that flight/bus was carrying omicron. If that means a government agency occasionally looks though cellphone records, so be it.

Put me down for definitely not wanting this. I'd rather have omicron.

Contact tracing isn't about you. If you were on that flight beside that guy then you now likely have it either way. Tracing is about allowing you to know that you have been exposed so that you can prevent yourself from spreading it to other people. It is about sacrificing some personal privacy in order to protect other people.

This hasn’t been hidden at all. Here’s an announcement from a year ago about researchers in Canada using cellphone data: https://munkschool.utoronto.ca/research-articles/mobility-an...

Independent researchers is not the same as a government health agency. Presumably these independent researchers don’t also have your private health data.

And again, if it’s not big deal why wasn’t the Canadian public health agency transparent about it from the beginning?

Not sure why you are nitpicking. The point is that it’s no secret that this data is out there any available to anyone. Here’s an article about Toronto Public Health using cellphone data, also from a year ago.

https://thelogic.co/news/ai-firm-bluedot-helping-toronto-pub...

That's all fine and dandy; except what every comment here fails to challenge is "how did the data make actual decisions?"

Because as a Canadian, living in a prairie province, all the COVID-19 measures certainly didn't indicate any sort of intense number crunching took place. "No serving drinks past 11", "50% store capacity", "gathering limited to 15 people", etc etc.... All numbers that appear to be just like any other mandate - arbitrarily chosen in the moment.

There’s always a balance to be struck between what the actual science says and what will be manageable as law.

Like, sure the science could say that if the temperature range is between 10-15c you can safely gather with 20, 15-17c only 15, and 17c+ only 10. But that’s probably not the policy that is going out to the public because it’s too hard for people to actually live with and enforce.

Plus most of the purely scientific considerations were bastardized when they came in contact with political and economic considerations before being made into policy.

It's interesting, as I've heard the same reasoning with taxation too. We can have all these sophisticated statistical models, risk models, and so forth; yet what ultimately gets produced is a basic tax bracket step scale that (hopefully) anyone can understand.

So is there actually academic research on how to best 'dummy down' complex models for society? Or is it end of day the actuaries, statisticians, and mathematicians tell policy makers their findings and some polysci major just approximates from there?

I can’t speak for your specific province, but throughout this pandemic Canadian researchers have been studying how well each restriction works to feed back into more precise decisions during the next wave.

It’s easy to find it if you look: https://scholar.google.ca/scholar?hl=en&q=canada+covid+mobil...

It's good the studies take place; but cursory glance that's 'diagnostic analytics' more than 'predictive' or 'prescriptive analytics'. Tracking data should be used to get ahead of these things; not to augment post-case studies.

There have been several waves of covid, and each time new restrictions were put into place, they were adjusted based on the studies which showed what worked in the previous wave.

Again, I can’t speak for your provincial government, but in most of Canada, each successive lockdown was more finely tuned than the preceding one, thanks to the data that was collected.

Those decisions were made by your provincial government, not Health Canada.

Health Canada may be utilizing the data, but what good does it do if they don't share results analysis with the provinces to make informed decisions?

I'm sure they are. But don't fool yourself into thinking the provincial leaders are making decisions based on data. Most of what was done by provincial governments during lockdown was based on political calculations, not data.

Amazingly a large % of the electorate seems to blame Trudeau for these actions. The feds don't have jurisdiction on this issue. Lockdowns etc and their poor methods of implementation (curfews, letting big businesses stay open but shuttering small businesses, etc) are the result of provincial governments.

So you're pretty much okay with surveillance?

That's absolutely not what OP said.

Surveillance was already happening at scale and being put to use for whatever nefarious purpose. As long as it wasn't public, very few people cared. Now that the data is used for public good (helping determine health policy), media and activists jump on the bandwagon because, duh, "government surveillance = bad" knee-jerk.

Public servants putting high-tech tools to work to get people their tax money's worth? It's actually the _only_ ethical use for this collected data!

First of all, the reason people view the government using the data as different is that the government has coercive powers (and a monopoly on Violence) that other actors don’t.

Secondly, the government making use of an unethical or nefarious practice only serves to legitimize it, and make it harder to roll back.

Lastly, if everything was above board, why be forthright about the use the employment of such data sets?

> First of all, the reason people view the government using the data as different is that the government has coercive powers (and a monopoly on Violence) that other actors don’t.

But that's not really applicable here because they're not using their "coercive powers" to get the data. They're getting data that anyone else could get by paying enough money.

But some advertiser can’t put you in prison

Don't be fooled by the government vs private sector dichotomy. State may have a "monopoly on physical violence" but dutifully lends said forces to protect private assets. In return, corporations let intelligence agencies tap into their data streams to scan for "interesting patterns". It's one system.

Also, advertisers _do_ maintain a prison of the mind by entertaining futile, elusive, ever-shifting goals to divert energy that could be spent in trying to change things.

> Surveillance was already happening at scale and being put to use for whatever nefarious purpose. As long as it wasn't public, very few people cared. Now that the data is used for public good

Why do multiple person believe the issue is that it's the public sector that use it? I didn't know the data was available. The issue is definitely not who use it.

I disagree. It crosses a line and it is one step closer to the rcmp just tracking everyone regardless of legality. Most Canadians are not aware their cell phone providers are selling their location as you say. We are unhappy about that too and would be just as unhappy it was used by anyone for any reason. It is very easy to deannonymise someone given that it would be trivial to see the home location a person is at most times then see where they go to. If they were doing this there should be a mechanism to opt out to avoid abuse of the system. With the Snowden leaks we already saw abuses happening. Workers tracking their lovers. It would be very trivial for someone to look at their girlfriends location simply by watching that location in which she lives and then following her signal even if it is anonymize. We were never told about this or how it would be safeguarded from abuse. This is bullshit despite what you and others here on HN are fighting against our disdain.

There is never a good time to stand up to incremental tyranny.

By design

>These mobile network tracking datasets have been commercially available long beforehand.

Hopefully not. Canada has fairly strict privacy legislation.

It is in fact a Toronto company that invented the technique of tracking pandemics with cellphone data, after the 2003 SARS outbreak, and it is being used in a number of cities:

https://thelogic.co/news/ai-firm-bluedot-helping-toronto-pub...

https://www.smartcitiesdive.com/news/bluedot-coronavirus-pri...

https://www.cbsnews.com/amp/news/coronavirus-outbreak-comput...

Maybe the raw datasets aren't available, but another commenter has mentioned that they're willing to sell aggregated/anonymized data to anyone who's willing to pay: https://news.ycombinator.com/item?id=29680578

Yes. Unfortunately over the last several years the national post has shown its right wing bias to an increasing extent. It's not usually as obvious about it as a Fox News, but the intent of pieces like this is clear.

It's a fair criticism that substantially all of Canada's non-CBC media is owned by fairly right-leaning American entities (at least, right-leaning by Canadian standards). I'm not sure this is something that even most Canadians are aware of. National Post is owned by Postmedia, which is in turn 66% owned by American media conglomerate Chatham Asset Management.

I'm not claiming that has anything to do with this specific article - I don't know enough to - just hoping to provide some color around parents comment.

With that in mind, I think this is a completely reasonable use of anonymized data by PHAC and the article does feel heavily sensationalized. I assume all the major insurers in the US are doing this - and far worse - but being private entities we have zero insight into it whatsoever. I would much rather PHAC have this data than a federated Kaiser-type entity that has my financial and physical health by the short-and-curlies so to speak.

There's a lot of interesting things for HN to talk about, but for the general public this should be a non-story.

Wait, the GP is claiming expanded new surveillance behaviors should be normalized. This is like Fox news.

Yeah. Why is trusting government supposed to be the default? Any organization with power should be continually distrusted, required to constantly and endlessly prove itself. In a democratic situation, the price of power is the responsibility to prove yourself trustworthy and competent enough to hold it. The whole point is that power is granted contingent to the will of a people for the good of the people.

You should never trust government. If your democracy is working, you can sometimes trust that government actions were good and competent after the fact. Trusting up front is abdication of your responsibility to guard against abuses as a citizen. Every tiny step towards surveillance and acquisition of data that can be abused should be resisted and assumed to be motivated by the worst possible incentive.

It's up to the agency or bureau to prove, up front, to the satisfaction of representatives and citizenry that a tool or power is necessary.

"But it's not illegal" is a weasel move, and heads should roll.

Despite downvotes this comment is very true. A modern constitution (the foundation of a country) is all about citizen rights to counter power, if you think government should just be trusted without actions to require more safeguard and transparency then you are pretty much waving your rights, and you probably don't deserve them.

If your government is untrustworthy the correct action is to replace the government not simply accept this as normal.

I'd like to know how we can vote out the NSA.

Same. Also, I am not a US citizen that is not living in the USA. How can I affect US policy that is affecting me?

It seems like GP is claiming that this is not new, and also does not represent meaningfully expanded surveillance.

How did you come to that conclusion? The GP only states that the public health agency used already-available information, I don't see where they express any opinion on whether the availability of that data is a good thing or not.

Not surprising.

The reporting here is National Post, which is essentially the Fox News of Canada. They're trying to attack the Liberal government with this story.

That really isn't accurate. The National Post is Canadian center-right, but it's generally a pro-business perspective rather than a socially conservative perspective, as it inherited much of its readership from the Financial Post. A better American analogue would be the Wall Street Journal.

As for the GP comment, I think it's always fair to be more skeptical of government access to data given the government's unique powers and access to other sources of information for potential correlation or deanonymization. They should have to prove that this can't pose a privacy concern, not "move fast and break things".

>> it's always fair to be more skeptical of government access to data given the government's...

I'm not willing to take accept this as an absolute regardless of context. You could also make the case that government is accountable, given democracy, some level of transparency, oversight etc.

There are quite a few private actors with the ability to correlate, deanonymize, etc. If a dataset is commercially available, it isn't private. Maybe it should not exist as a public dataset at all. If someone has to prove that a dataset does not pose a privacy risk, it should be whoever is selling it... or anyone who touches it.

The idea that google, pfifer & citibank can access a dataset... without oversight or accountability, but a public health agency can't because privacy... it seems ridiculous to me.

That was true maybe 10 years ago but the Post has been shockingly radicalized in recent years - now a home for climate change denial and other wingnuts.

G&M is the new Post, Post is the new Sun, and Sun is the new Weekly World News.

Reply on news.ycombinator.com