The rise of biodigital surveillance | Hacker News Reader

The rise of biodigital surveillance

compactmag.com

109 pointswhoooooo123112 comments

There is nothing friendly or helpful or optimistic about digital identity schemes, they are domestic passports for movement, and a pervasive, specific and ongoing threat against you as an individual for giving the appearance of non-compliance, or even a lack of enthusiasm for compliance. It's dominion. Honestly, a digital ID scheme is what the next global, multi year or even decade long land war will be fought over. I know we have a convention about avoiding discussions of violence, but digital ID, just like the ID schemes of early 20th c Europe and Russia, is the thing that you either nip in the bud in the present, or the number of lives that will be lost over it just grows every single day as the cancer of these systems establishes itself in our societies.

There is zero hyperbole in this. I've worked on digital identity solutions, and fundamentally, they are not a consumer product anybody actually wants because their use cases are all about enforcing rules against the identity subject. The only way the tech survives is it must be mandated, and then it's a question of whose problem does it solve?

The only people that a global digital identity solves a problem for are the people administering it, literally against the whole world. The survivors will ask, "how did it all happen so fast, what were the warnings?" and this obscure comment will be the hunger stone and harbinger. I'm literally saying millions of people will die, partially because of my inability to be persuasive, but mostly because of your misunderstanding of what this technology does and of what it is the effect.

Not that I'm in favor of it, but India, with its ~1.3 billion pop and Aadhaar hasn't fallen over just yet.

Arguably, the caste system maintains social order in India, and so digital ID for castes who are educated to be treated poorly isn't a change. The change would be for westernized countries where everyone used to be taught they have freedom and human dignity.

strong agree -- federated Identity is still possible, and political speech with anonymity too

I cannot disagree more.

Why?

Could you elaborate more?

> they are not a consumer product anybody actually wants because their use cases are all about enforcing rules against the identity subject. The only way the tech survives is it must be mandated, and then it's a question of whose problem does it solve?

Doesn't the CLEAR example in the article's opening paragraph contradict your claim?

One could argue that the problem CLEAR solves for regular consumers is a problem manufactured by those administering it. Depends on how one feels about the TSA…

This person gets it. No argument here.

I'm in tears. So blissful to have understanding people among tech enthusiasts! Usually such topics as surveillance, biometry, privacy, control of people, digital currencies, dangers of wireless, etc. rise immediate skepticism and hate. I'm glad more and more people around are shifting from indifference.

Making things legible to the state is one of the ever going projects of any state. So while I think it’s important to make sure that refusal to participate in one of these projects doesn’t preclude you from still receiving the services of the state, it’s also isn’t surprising that the state wants to make its constituents more legible to itself. The balance falls in figuring out how to firewall these different functions to prevent certain kinds of identity from making it so you can’t receive the services that are the whole reason why you have a state.

Blanket refusal to get an ID card or passport will get you into trouble in some countries as a citizen (e.g., Germany). Possible fines etc. aside, establishing your ID in a lot of situations will get quite difficult.

Tell that to Americans who are against having an ID to vote

I don't see any value in voter ID since in-person voter fraud is exceedingly rare.

https://www.brennancenter.org/our-work/research-reports/10-v...

In practice, voter ID schemes are used to disenfranchise citizens.

https://www.brennancenter.org/issues/ensure-every-american-c...

The greater point, I think, is that everywhere else in American where I deal with the government I am required to present some form of ID. They even give you a list of a dozen or more valid IDs you can use.

However, arguably the most important interface with the government, voting is a place where I don't even have to validate I am who I say I am.

Seems strange to me.

They don't really care who you are, they only care if you are allowed to vote. At least in theory, of course weird stuff probably goes on every year due to the size of the US.

Germany requires you to have an ID document from the age of 16. You do not need to carry it however (there are a few exceptions, e.g. if you work in construction or the like where tax evasion/cash in hand is not uncommon).

Inside the EU's Schengen area, the ID is only needed at borders.

Again, once inside another Schengen country, you do not need to carry it around.

I'm not sure if the same rules apply for foreigners though, once they are inside the EU.

From trial and error over the last five years I'd say three out of five airlines will let you board flights using your driver's license as ID. They always complain but they let you through anyway.

ID checks at Schengen to Schengen borders are absent anyway since many years so this isn't a big surprise.

That said: I'm a white man.

These rules apply to everyone by law.

Sadly, the less 'Caucasian' your phenotype is, the more likely your experience with EU security forces will be for them to expect you to carry ID -- despite the above rules.

And boarding a flight with your driver's license if you are not white -- forget it.

Racism is everywhere though. It is just especially painful to see in this context.

> it’s also isn’t surprising that the state wants to make its constituents more legible to itself

And not just the state, and it's enlisting the help of private companies.

From the article:

> The privacy risks, including the possibility for constant surveillance and data harvesting, will fade into the background when you are about to miss your flight if you can’t skip to the front of the line

Personally, when going to Mexico, I was asked to submit to a photo verification to board the plane. I asked to opt out. I was told it was impossible.

Later, after verification, I realized I was lied to and manipulated: data was obtained under false pretense, under threat of being unable to board, and to top it out, with a lie!

Next time in the airport, I will only unmask to TSA agents, and only those who require I do, never to the gate because as said in the article all it takes is one leak and then it's impossible to undo:

> But as Nick Corbishley, author of a recent book on digital IDs, points out, decisions made in the moment may carry long-term negative consequences: “If biometric data is hacked, there is no way of undoing the damage. You cannot change or cancel your iris, fingerprint, or DNA like you can change a password or cancel your credit card.” Unless we collectively decline to participate in this new social experiment, digital IDs—tied to private demographic, financial, location, movement, and biometric data—will become mechanisms for bulk data harvesting and tracking of populations around the globe. Welcome to the new abnormal.

yeah the nasty thing is the private company loophole works. like the TSA puts in these stupid ass measures everybody hates then is like "oh well you can get clear if you don't like it!"

it's supposed to be illegal for the feds to use private companies to do what they can't but for some reason this hasn't gotten killed in court. literally the agency shouldn't exist nor should airport security like it does now.

Is there any hope for those of us that used Facebook when it came out then deleted it? Seems like they already have all our data now. My DNA is everywhere and my fingerprints are technically everywhere too. Wouldn’t be hard to get it.

It always works this way, “Oh it’s completely voluntary.”…a few years later “we’ll you can’t keep your job if you don’t.”…a few years later “we’ll throw you in jail if you don’t.”.

It’s important to send the message now that these programs/services are not wanted and should be shut down immediately.

Not always.

https://en.m.wikipedia.org/wiki/Social_Security_Act

I hope people realize this includes things like gait and gesture recognition and RF fingerprinting across multiple RF spectrums.

Just talking about the US here, but what about our current identification systems are so deficient that we need this?

SSNs are incredibly insecure (and also used in a way they were never intended). I don't think we need biometrics to replace them, but if there's a push to replace them, people will likely push for biometrics as hard as possible

EU is issuing biometric passports where are loaded your fingerprints and some EU states started to issue biometric citizen IDs, where are fingerprints stored too. So it is kind of already going on?

Additionally citizen IDs are nothing new, at least in Eastern Europe, where you will get one when you reach 15 years of age.

In Spain you get your fingerprints printed when receiving the (essentially compulsory) ID card… And this is seens as “good” and “normal”…

Sigh.

Aren't those stored on the card/passport, not in any central database? They already have your photo printed on them (as well as stored digitally in some cases). I don't really see a difference between a fingerprint reader comparing against the print stored in the ID card and a camera comparing your face to the photo printed on it.

Of course there is the case of a rogue terminal surreptitiously saving your fingerprint or photo, but even before we had automated facial recognition at border crossings, you'd still have to hand in your passport to be scanned (to read the MRZ) and stamped, so a rogue terminal could have been saving photos all along.

On passport, but also in the database of the department. Thing is that my country government administration sucks and those databases are not shared, so when you will get citizen ID with your fingerprints and photo, then you will go to get your driving license, you will need to get them photo again, because internal affairs department and traffic department does not talk to each other despite the fact, that they have offices in same building.

Ok yeah, that horrible. In Slovenia, your fingerprints (for biometric passports) are sent along with the print order to the manufacturing facility and then deleted. For all photo IDs (passport, ID card, driver's license, weapon permit), your photo is either scanned and sent along with the order or uploaded to a database that deletes it after 2 weeks. Nothing is ever stored permanently or accessible by anyone other than the people and systems directly involved in getting your document made. *

* That is, of course, what the law says. I have no reason to believe "the government" is breaking that law, but no way to verify either. It would probably be discovered and leaked very quickly if they were though.

Wait, what are the other options? How do they do identification without IDs in other countries? I heard that you can use driver’s license as an ID in the US, but isn’t it issued based on an actual ID? And not everyone can drive, no matter how auto-centric the US might be.

My only government-issued ID in the UK is my passport and my driving license. In theory if I didn't drive or leave the country I wouldn't need an ID at all.

Although the crackdown on illegal immigration means that I now need to prove my right to work in the UK whenever I take a new job. I'm not sure how I'd do this if I didn't have a passport.

The 4th Amendment right to privacy has been so badly violated by the US Federal Government and TSA that the Constitution is no longer valid - the contract is beyond broken, the US government has descended into absolute dictatorship and it is the duty of all Americans to “dissolve the political bands which have connected them with another.” “it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security.”

Remember the Alien and Sedition Acts?

I remember them being controversial at the time and expiring without opposition.

> I remember them being controversial at the time and expiring without opposition.

Controversial, sure, but the other part is only half right.

The “Alien and Sedition Acts” consisted of four separate acts passed in 1798, by their popular names:

1. The “Alien Friends Act” had a two year term and expired.

2. The “Sedition Act” had a two year term and expired.

3. The “Naturalization Act” had no fixed term but was repealed and replaced in 1802.

4. The “Alien Enemies Act” had no fixed term, and remains in force with some amendments.

>The 4th Amendment right to privacy has been so badly violated by the US Federal Government and TSA that the Constitution is no longer valid

Without the constitution, would you be holding all the cards or would the Army?

We have a Constitutional Convention, enact a new Constitution and a new Capital, then release all the dirty secrets from the old (current) government similar to how documents were released in the early 1990’s when the Soviet Union fell apart.

The armed services, being part of the old government would lose their authority along with the rest.

This assumes a peaceful transition of power, if violence is used instead all bets are off.

> This assumes a peaceful transition of power, if violence is used instead all bets are off.

You expect the US government to simply step down?

Civil disobedience is a serious threat to the power of the US government. 19 states out of 34 states have already committed to the convention of states. The US Federal government knows all too well how to deal with violence but they don’t know how to handle peaceful mass non-compliance.

> Civil disobedience is a serious threat to the power of the US government.

Potentially if it could be organized.

> 19 states out of 34 states have already committed to the convention of states.

This is a non-sequitur and has nothing to do with civil disobedience nor the dissolution of the federal govt.

> The US Federal government knows all too well how to deal with violence but they don’t know how to handle peaceful mass non-compliance.

I think a lot of people would dispute this. The standard ways to deal with peaceful mass non-compliance have been known by western governments forever:

1. Split the population into factions with extremes who won't remain peaceful.

if that fails the:

2. Insert agents-provocateur into the peaceful group to spur violence.

Either way the formula is the same - turn an non-violent protest into a violent one and then deal with it as such.

I suppose that there are some good examples of Government inserting agitators recently like the Canadian truckers protest in Ottawa and the Jan 6th protest in Washington DC. However, the government was not entirely successful at destroying these resistance movements and they occurred during a time of relative economic prosperity. Economic forces will have a major impact on the willingness for the population to resist en masse so it may simply be a matter of timing.

> Economic forces will have a major impact on the willingness for the population to resist en masse so it may simply be a matter of timing.

If that happens, there is no reason at all to imagine there will be unified non-violent protest leading to the peaceful stepping down of the US government in favor of something less oppressive.

You only have to look at what has happened in other countries where the populous has been impoverished.

While I wholeheartedly agree with where you're coming from (most rights listed in the Bill of Rights are being violated in some blatant manner), the problem is that vein of thought has now been claimed by an authoritarian movement idolizing an empty huckster who wears a diaper. Something similar happens to every good political critique - when it finally starts getting traction in the wider sphere, it's taken over by opportunists leading morons, and the whole thing just goes sideways.

I've reacted by becoming much more conservative, voting for deep state supporting candidates because at least they're the devil we know. I guess I'll just keep my head down politically and keep working on communications technology that might extricate us from the state gradually. Because replacing the state top-down with fascist madmen certainly isn't going to lead anywhere good.

"China is using all the means available to an authoritarian state to reach its 5‐year R&D plan to make the biotechnology sector 5% of its GDP by 2020." - Tara O'Toole statement to Senate subcommittee 2019

Social Credit Systems are just lakes of aggregated data accessible by a government. From your health to how you choose you will end up a model in a prediction system.

System detected you bought a toy bear

System detected you bought yellow paint

System predicts you will spend 1 year in prison

Yeah, hard pass.

> This may at first glance sound sensible. But consider: If an impoverished family doesn’t accept the health NGO’s preferred interventions for its children, these children may not be provided any other opportunity to establish a “legal, broadly recognized identity” necessary to access things like primary school. In other words, you are literally nobody until you are vaccinated.

Author is making quite a leap that the _only_ way to receive a digital ID is to get vaccinated. If a program like this ever does take off you will see alternative methods of identification acquisition. Case in point: I don't need a driver's license to get a state issued ID. Functionally they are the same in terms of proving I am who I say I am, but one affords additional benefits of stating I can drive.

The way it works today is they you either get the school vaccinations or a sometimes limited exception, otherwise you don't get to attend. It seems like they're just putting a layer on top of this.

Since primary school is mandatory in my country, they have to accept all kids, with or without vaccination. Kindergarten aren't mandatory, so it is up to them if they accept unvaccinated kids or not.

There are exceptions for kids that cannot be vaccinated because of medical reasons which is argument for those parents who does not want to vaccine their kids and still want get them to kindergarten regardless their health condition.

Primary and secondary school is mandatory here too. They won't let you go without shots, or an exception (medical, or in some states a religious/belief one). The alternative is that you're home schooled (even private schools are required to mandate the shots).

How mandatory is primary school when it require medical intervention? Isn't education unconditional right?

It's legally mandatory. That's why they'd be required to home school (standards are set by the state), or face charges.

> The stated mission of ID2020 is to provide digital identities for all people worldwide by 2030

I'm guessing the stated mission has been changed once or twice since it was founded.

Sounds like they were years ahead of their time.

One aspect I find interesting about HN is that most of the posters there are involved in adtech, data-gathering, FAANGs, or adjacent businesses, whilst reaping very high rewards for their troubles. At the same time, they have an enduring interest in adblocking, freedom, liberal or libertarian values and so on. This creates a situation where their economic wellbeing and working life is directly aimed towards enforcing surveillance capitalism and authoriarian tools, while at the same time they receive enough resources to avoid the brunt of the consequences, and their mental landscape deals with the cognitive dissonance to maintain an identity of progressiveness.

It directly mirrors the feudal system with a tiny portion of the population living in unimaginable luxury and employing another much larger but still small portion overall to keep the hierarchy running. In other words, billionaires supported by well-compensated SWE vassals who devise ever more sophisticated tools to extract value and data-powered obedience through surveillance from regular workers.

Do "most" posters at HN work at FAANG or in adtech? There's a lot of those people here for sure, but I can't believe they're anything close to the majority.

I don't have actual stats of course but intuitively if you tally:

- All the FAANG/FAANG suppliers

- All startups or established projects that involve data gathering, advertising, SEO, skinner boxes, dopamine response, parasocial relationship manipulation, optimizing time spent on controlled platforms and products

- All projects that facilitate the above as suppliers or second-order businesses

- All gig economy/surveilled/taylorized work facilitators

- All coding work that involves ranking and surveilling people for life altering services such as loans, insurance, healthcare

- All coding work done to optimize the wealth of the noble class (themselves the main beneficiaries of surveillance)

...there's probably not much left. Even if you maintain a strict definition and include only direct adtech shenanigans I wouldn't be surprised if that were a huge number in and of itself.

I think your assumptions are incorrect, but it would be really fun/interesting to test our thoughts out with a user survey.

One aspect I find interesting about HN is that most of the posters there are involved in adtech, data-gathering, FAANGs, or adjacent businesses, whilst reaping very high rewards for their troubles.

That seems quite a strong statement. Has there been some sort of survey that motivated it?

(Full disclosure: I've been here a long time. I make my living from building tech. I have no interest in doing that kind of work for any employer at any price, nor in running my own business interests that way. I'm well aware that this probably leaves lots of money on the table in both cases and I have absolutely no problem with that. And my cognitive dissonance can look at itself in the mirror just fine when it wakes up in the morning before browsing an adblocked version of the web over breakfast.)

> One aspect I find interesting about HN is that most of the posters there are involved in adtech, data-gathering, FAANGs, or adjacent businesses, whilst reaping very high rewards for their troubles. At the same time, they have an enduring interest in adblocking, freedom, liberal or libertarian values and so on.

I think attributing features of the community as a whole to individuals within that community like this leads to incorrect assumptions. The HN community is varied. I suspect if you were to put an HN reader who strongly values user freedom and privacy and an HN reader working on adtech in the same room, we would not agree on many of these topics.

There are a ton of profiles I've seen over the years. A few seemed to have lifestyles so independent and idiosyncratic that they'd put the Unabomber to shame. Many were involved in fascinating and helpful projects. But I find the assumption that the overall tone is of venture capital, digital nomadism, gentrification and so on to be fairly sensible as well as the idea that as whole the community greatly contributes to increasing authoritarianism.

> This creates a situation where their economic wellbeing and working life is directly aimed towards enforcing surveillance capitalism and authoriarian tools

Adtech doesn't have to be surveillance capitalism

If we're talking about personalized adtech, sure. But if we're talking about just adtech in general, not necessarily

"adtech" implies targeting and/or personalization, otherwise it wouldn't have the "tech" part - just "advertising".

Whenever I've heard it used it's referring to general ads infra, which includes personalization. But there's also a lot more to it

If you provide infrastructure or support for something, and that something is almost exclusively surveillance and data-gathering based, that's not so great either.

I'm grateful to have served a career that has mostly kept my conscience clear.

I began life as a NOC operator at a regional ISP, when ISPs were merely an on-ramp to Al Gore's Paradise in the Cloud.

I helped many employers and clients connect to the Internet somewhat securely. If the Internet is evil then so am I. I've never worked for FAANGs or adtech or data-gatherers.

Late in my career I came around to academia. Worked for a NASA-JPL project at a university. Now I work for an online program manager.

The data we collect from students is protected by FERPA, and I'd say we make an effort to collect as little as possible, and the students offer it all voluntarily. Win/win.

One thing I notice from the community is that for previous generations (let's say pre-2005) it was significantly easier to make a great living as a programmer without engaging in shady nonsense. My post was very critical, but to some extent it's hard to escape the logic of the times when you have to navigate them.

A lot of positions even within FAANGs have nothing to do with Surveillance.

If someone works for a surveillance company in a non-trivial role, they are furthering the progress of surveillance. They can't wash their hands of it.

Not really, I don't blame a mechanical engineer working on flying cars at Alphabet for Google's surveillance. Doesn't make sense.

The end result of their work is to increase the power and success of a surveillance company, one of the most successful and powerful surveillance companies in the world if not the most, so how could they possibly not be involved or morally responsible? They don't exist in a vaccuum where their work is magically independent of their employer. This is typically the sort of cognitive dissonance I'm trying to highlight.

Can you imagine someone saying "Nah I'm not responsible for what the Russian army does, I'm just paid by them to help with logistics"?

Logistics is in direct support of, and enables, Russian military action in your example. Designing a propeller for a flying vehicle does not further surveillance.

If I lay out the reasoning more precisely and in the simplest terms, maybe it would then be easier to identify which part might be the stumbling block here.

1. An employee of Google makes propellers for Google.

2. The sum of their work benefits Google, either in profit, new assets or some other way, because Google isn't employing them just for fun

3. As an adtech company, surveillance and datagathering are at the core of Google's activities and modus operandi.

4. The growth in power and reach of Google thus directly implies increased surveillance

5. As per 2., The employee currently dedicates their working life to making Google more successful and powerful

6. Therefore the employee furthers surveillance and datagathering, even if their contribution might be small

2. and 4. are not necessarily givens.

Perhaps the product this engineer works on does not pan out, maybe he unwittingly makes the company weaker by siphoning capital on a project that eventually fails. This seems to be a common case at Alphabet.

It could also be the case that reinvestment of capital from the engineer's efforts is in a line of business orthogonal to surveillance. Indeed a company making flying cars and engaging in surveillance is clearly already not contributing 100% of their working capital to expand their surveillance capabilities.

It's a mistake to use biometrics for authentication. Perhaps as weak identification it's acceptable.

It's a username, not a password. Because it's public, shared (you leave bits of bioinformation everywhere you go) and not deliberately changeable.

A password is none of those things.

Reply on news.ycombinator.com