Hacker News Reader

Comment by InTheArena | Hacker News Reader

Reading through the slides, it appears that what has been discussed is sharing signature and fingerprints for travel into the USA. There is a lot of weasel words, but it's probably worth nothing that the USA currently collects this information for foreign nationals coming into the USA (as the EU does for Americans traveling into the EU). This is being done in the context of a DB query as part of the e VISA application.

It's worth noting that almost all of this is still the output of the 9/11, where US and Saudi systems did not communicate and resulted in known terrorists in Saudi Arabia being able to travel at will into the USA.

I don't like biometrics, but the hyperbole needs to be tuned down a bit here.

View on HN

I'm not sure that hyperbole is possible when you're discussing the necessity of having worldwide biometric "terrorist" lists that countries like Saudi Arabia would participate in.

-----

edit: How would you code "terrorism through public demonstrations of driving while female" or "terrorism through being Yemen?"

"Terrorism though applying for a marriage license after being mildly critical in the WaPo."

Finance background here.

All these PEP, sanction lists, ofac monitoring, financial sanction lists already exist and every company with a worthwile monetary turnover ever facing an audit runs these background checks.

The laws are there, they are called the aml directives, the lists are there.

And most of the entries there are provided by eitjer uk or us entities, youll usually find foreign military personells data there, dob, rank, id number, name but not much else.

It is bit of a joke as many muslim people have similar names and joe shmoes get flagged for nothing very often.

Meanwhile, the people on these lists are very high up within their own government hierarchy, they probably have 5 differe t passports.

Btw, these lists are csv files often...some sophistication.

Yea, monitor peps, fugitives and terrorists, but find a way without combing through the whole worlds innocent citizens.

> Btw, these lists are csv files often...some sophistication.

And surely this critically sensitive data is not left on a shared location with loose permissions, or sent around as an email attachment, right? ...right?

I'm worried about the ability of this data to enable authoritarianism and I'm also worried about it being handled by those with the competence of the average government official.

"Never blame on malice what you can blame on stupidity", however the problem is government has both of those in spades.

Critical sensitive data? You can access the lists directly in several different formats, all publically available... Wouldn't be much of a sanctions list if you couldn't

https://www.gov.uk/government/publications/financial-sanctio...

Sanctioned persons are not the same as politically exposed persons. You are still allowed to do business with PEPs.

Those are blacklists, i.e. known criminals. The US is asking for whitelists, i.e. everyone and without motives

No it isn’t. There is no bulk access, just responses to queries of biometric data for persons of interest.

That "just" is holding an enormous weight there, friend. Have you seen the query responses themselves to know whether they're not not getting back bulk info? And have you seen the giant private-public systems they'll want to funnel this info into?

Just from my own research on surveillance, I got back a bunch of records in a FOIA lawsuit that included the the query results of a bunch of license plate scans. Large XML blobs. For whatever reason, they didn't redact a few thousand pages of those query results.

A lot more info was in those query responses than you'd imagine. For example, SSNs of people whose license plates matched the first three digits of a "person of interest"'s car.

Mind you, this was after them arguing for months, with affidavits, that they don't have audit logs. So, yeah.

Sure, sure, and the query looks like:

  SELECT * FROM Person JOIN Biometric_Datum ON Person.id = Biometric_Datum.person_id;

See, no bulk access. Just a response to a query, only once an day, or so.

On the related topic of Arabic names, I currently visiting Tunisia. The other day I asked one of my friends how to spell her name using Latin letters, and she said “you can use one C, two Cs, one K, it doesn’t matter.” Now I’m wondering how many people have problems because their names have been casually spelled a few different ways and linked to someone else’s name in accident.

This is a problem with all transliterated languages.

It’s worse for Arabs because until modern times they didn’t have “conventional” surnames. Their name was a composition of a given name plus that of their forefathers’, often appended with “Abu” (meaning father in Arabic), and sometimes the addition of a clan name. In my ancestral home of Egypt, the government often standardized everyone about 100-150 years ago with whatever names they were carrying at the time.

So you could be completely unrelated to someone and have a partially matching last name.

Combine that with America’s gleefully racist views of Arabs - particularly after 9/11 - and you have a recipe for disaster with no-fly lists.

It has already happened https://en.wikipedia.org/wiki/No_Fly_List#False_positives

The US doesn't care: if your name seems to match a terrorist's, you are that terrorist.

This.

There is nothing scientific about anti-money laundering. It is one of the ways modern nations hang themselves with self-inflictes inefficiencies for very little gains. Because it's run by police organisations, you cannot criticise it as you would be labelled as a friend of terrorists.

In Saudi Arabia atheists are terrorists. And they also have the death penalty for terrorism.

I suppose on the plus side at least they actually sentence them, some countries just lock them up in extra judicial camps or orders a drone strike and never says a word.

This is misinformation. Saudi Arabia is not well regarded when it comes to religious freedom, and it has a law against apostasy (when a Muslim renounces their beliefs), which is a capital offense, but they don't classify atheists as terrorists.

It's so horrible. They probably think that they're helping atheists by sending them to the afterlife early. But what if the atheist is right and when you die, your last moment alive becomes frozen in your consciousness forever.

>> what if the atheist is right and when you die, your last moment alive becomes frozen in your consciousness forever.

I’m sorry what? Is this the predominant/common belief among other atheists? Pretty much everyone I’ve spoken with is more likely to think you just turn off, everything goes black, back to the void of unlife.

I expect it to be unimaginable, literally, because without a running brain I can't imagine. How do you even reason or predict beyond that.

It's horrible either way but I think void is much better in this case.

I checked: when you die, you rot. Atheist or not.

Where does the speed go when the car stops?

I’m not sure what others believe. But I bet that right before you die, it feels like you are running towards a light at the end of a tunnel. But for each step you take, you shrink by half. Making a moment feel like an eternity.

Yeah, they just made up. :/

> terrorism through public demonstrations of driving while female

Do you think Saudi Arabia is the Taliban or what? Even when it was banned, it wasn't the big of an offense.

And yes its no longer banned, and there are a lot of women drivers now.

> Do you think Saudi Arabia is the Taliban or what?

https://en.wikipedia.org/wiki/Capital_punishment_in_Saudi_Ar...

"In September 2011, a Sudanese migrant worker was beheaded for sorcery"

Was this a rhetorical question?

They executed shia cleric for being... shia cleric. If it would help them catch them they would put him on such a list to get similar persons deported from host countries.

Maybe trucking while unvaccinated is a better example?

I wish we lived in a world where our governments had integrity, prioritized the interests of the masses, and could be trusted to use powers like this in pursuit of those interests. Sadly we don’t.

> (as the EU does for Americans traveling into the EU)

This doesn't seem true unless the US citizen is resident in a Schengen area country or (as a technicality) is also an EU/Schengen area citizen, as the EU seems slightly more in favor of government collection of biometric data for automated immigration purposes. I'm not sure about the reverse, as even the CBP seems to be moving towards facial recognition in place of fingerprint data, but it seems like most non-US/Canadian visitors are required to provide fingerprints.

I didn't have to provide a fingerprint or signature to travel to Europe, only when I applied for residence in a Schengen country.

That's changing from May 2023 with 'ETIAS'. "non-EU visitors to the block, including UK nationals since Brexit, will need to register information about themselves prior to travel. As well as passport details, automated barriers at borders will eventually gather biometric information such as facial image data and fingerprints. ETIAS will be mandatory for citizens of such countries as the UK, United States, Australia, New Zealand and Canada".

Considering that 9/11 was in part a Saudi kingdom operation, I’m not convinced having more US-Saudi cooperation would have helped

Edit: what’s with the downvotes?

>Edit: what’s with the downvotes?

You're pushing a baseless conspiracy theory. There is no evidence that Saudi authorities were involved in 9/11.

https://www.npr.org/2021/09/12/1036389448/biden-declassifies...

You're a better person than myself. Would have suggested the Saudis are behind the downvotes.

We live in interesting times. What was yesterday claimed to be a "baseless conspiracy theory" is a factual truth just the next day.

Welcome to reality.

It might have helped the Saudi terrorists.

I am thankful that the EU is standing up against this threat.

What threat again?

Happen to be from the US of A?

Israel also.

Your thinking seems to be based on the idea that "the government" are the good guys. This is extremely naive - and you even mention an example of a government that does not respect basic human rights.

These tools will be abused and must be rolled backed to save freedom and democracy. Authoritarian states working together on a techno-based total control vision is a very bad development.

Thinking about it, I do not understand how any neutral person would take your position - it reads like astroturfing propaganda work.

> it reads like astroturfing propaganda work

The "but we just do what the others do" claim (which is afaik false) also made this seem fishy to me.

Especially as every hacker knows: When there is data, this data will be abused, sooner or later. There hasn't been any recorded exception to this rule. Anywhere. Ever. It's like a law of nature.

That's why the zeroes rule of data protection reads: Do not produce data. Only not existing data can't be abused.

> It's worth noting that almost all of this is still the output of the 9/11, where US and Saudi systems did not communicate and resulted in known terrorists in Saudi Arabia being able to travel at will into the USA.

> I don't like biometrics, but the hyperbole needs to be tuned down a bit here.

The entire official response to 9/11 is the hyperbole, not the criticism of those measures.

the problem with such treaties is they are very shady in their wording and if there is a possibility to interpret it in this direction it will be interpreted in this direction

That's the purpose of the shady wording in the first place.

Or does anybody really think things get formulated those ways "by chance" or "by incompetence"?

Never blame on stupidity what you can be blamed on malice, in case of institutions…

Yeah, we should 'trust' them after they lost the biometric data for all of the Afghanis they fingerprinted. I was going to have my visa application but I guess I'll defer it.

> […] but it's probably worth nothing that the USA currently collects this information for foreign nationals coming into the USA (as the EU does for Americans traveling into the EU).

The EU does? That's news.

Can someone bake this claim by some source?

Nope, hyperbole needs to be strengthened.

Such legislation would basically allow syphoning off all the data of everyone from the EU databases. They could (and would) just go through all possible name combination an see if it's a hit (I'm sure there will be no safeguards in place for that; oh, whoops, the British did this already when Brexit happened).

The precious data will then be stored in a "commercial cloud" service. What could possibly go wrong here?...

The intelligence community missed a lot of clues right at their finger tips that could have prevented 9/11. Do you think biometric tracking would have prevented 9/11? Because it sure sounds like it.

You can miss anything you want to miss, when it suits you.

You think the US is going to limit itself to travelers? They're going to read a lot more entries than just travelers.

> where US and Saudi systems did not communicate and resulted in known terrorists in Saudi Arabia being able to travel at will into the USA.

I'm not even sure how to classify this sentence...

Naive.

I'm leaning more towards deliberately obtuse.

You mean USA won't misuse this data?

We have had the Five Eyes and ECHELON for decades. Since before the Snowden revelations. How is this different?

They don’t spy on their own citizens but they exchange info with the other spy agencies, so…

> They don’t spy on their own citizens

They sure do; whatever gave you the impression they don’t?

From what I get, countries ask friendly countries to spy on their behalf.

That's the parallel construction.

Their mandate doesnt allow it

https://www.aclu.org/other/nsa-spying-americans-illegal

And yet, part of what Snowden leaked was that they were storing all Americans' data, somehow making the internal legal argument that searching their databases was when it became an actual search, not when they stored that information about Americans in their db.

I know that wasn't a serious comment, saying that federal government agencies follow their mandates and never break the law.

PS I see that you have edited your comment to add a link, https://www.aclu.org/other/nsa-spying-americans-illegal. That link shows that the government illegally spys on citizens, which is the opposite of what you meant to show.

Why break the law to spy on Americans? We give all our private information out to any website that asks and shout out political opinions out into the void on Twitter. Just buy the list of people really interested in fertilizer and not farming from some data broker. Totally legal private sector transaction!

I'm not sure what you are asking or why. See the start of this thread, where the Snowden revelations were mentioned.

You’re right! I meant to say they can’t legally do it but Five Eyes helps them do it legally:

In other words, the NSA can only spy where it is explicitly granted permission to do so by statute. Citizens concerned about surveillance do not have to answer the question, "what law restricts the NSA's spying?" Rather, the government is required to supply an answer to the question "what law permits the NSA to spy?"

Thanks so much for the clarification!

Yeah, like the siblings I can’t be sure whether you’re joking or not.

In the off chance that you’re not, remember that Gitmo exists so they can do things that their mandates wouldn’t allow.

> Gitmo exists so they can do things that their mandates wouldn’t allow.

No, Gitmo exists so they can do things openly and shamelessly that their mandates wouldn't allow.

Otherwise they can use black sites, or just lie about it.

yes an unaccountable agency that does not have to report to anyone, and can classify all of their actions under national security directives would never violate their mandate. Never..

Let me tell you about this new crypto investment I have...

Funniest thing I've read all week.

>We have had the Five Eyes and ECHELON for decades. Since before the Snowden revelations. How is this different?

Because the EU is not part of either?

Well one of the countries in the Five Eyes (UK) used to be a part of the EU, until fairly recently.

Note for those in the thread who haven't heard of ECHELON until now (just like me) - it is the exact same list of countries as for the Five Eyes.

> [...] Australia, Canada, New Zealand, the United Kingdom and the United States, also known as the Five Eyes. [0]

0. https://en.wikipedia.org/wiki/ECHELON

Maybe this is the reason they started demanding this now, that before they could just ask Britain but because of Brexit, Britain has lost access to European biometric data?

> They don’t spy on their own citizens

Correct, that would be illegal.

When NSA need to spy on an american, they ask GCHQ to do it for them and buy the data. Or buy it off a private company.

That’s what I meant. But the sibling thread somehow devolved into making fun of this idea!

It's different in that it doesn't require misuse to get certain data about citizens.

What difference does it make? They already lost it and it fell into the hands of not-so-nice people like the Taliban.

Reply on news.ycombinator.com