Hacker News Reader

Comment by caseysoftware | Hacker News Reader

Effectively anyone.

Third Party Doctrine says that once you give your data to someone else, you lose most of your rights to privacy, control, etc. It's why law enforcement doesn't NEED a warrant to go after so many things like cell phone records, bank account info, and so much more. The fact that so many companies want a warrant is usually a courtesy, not a requirement.

Check out the book "Habeas Data" for the (US) legal reasoning on it.

And to be clear, I think Third Party Doctrine should be wiped out and I should be able to say "you can't use, sell, share, etc my data without EXPLICIT PRIOR permission from me."

Ref: https://en.wikipedia.org/wiki/Third-party_doctrine

View on HN

I wish the 2nd amendment movement had a sister group with the same vigor for the 4th amendment. What you proposed is the sensible legislation that we need to ensure our longevity as a “free society”

One could almost say that aggressive opposition to this exposes a true tyrant.

Interestingly enough that group does tends to advocate for 4th amendment protections, at least within limited scope. Although those same concepts and case law could be applied to other areas. So it's possible to piggyback off of it.

Some examples are red flag laws which use the civil system to avoid the protections of the criminal system for the government to seize property (beyond a reasonable doubt, right to representation, ex parte protections, etc). Police stopping, questioning, and sometimes seizing guns (property) without any crime being committed and with some of those guns (property) being destroyed. There is of course pushback on things related to data reporting such as registries (Ring is essentially a registry that allowed police to contact the individual in this article), new credit card merchant codes, and data abuses of carry permit information (disclosing names and addresses of gun owner which is basically a map for thieves).

I've never seen this, but I'll admit some ignorance. Have there been 2A-themed protests following 4A violations (as in, civil asset forfeitures of money, say), similar to those we see when the 2A is challenged in some way? Google searches show only passing references to the fourth amendment on the NRA site. It looks like most arguments against red flag laws rely on the 2A instead.

2A zealots tend to be very protective of their property being unlawfully searched or seized. The whole Sovereign Citizen movement is emblematic of the extremes in this regard, but it's absolutely true overall.

As someone else said, though, the 4A doesn't really give companies and people much to sell to one another in that section of society. They would seriously benefit from password safety products, better choice of hardware, and full-disk encryption, but this group doesn't tend to have a lot of electronics technical chops.

I say this as someone who recreationally shoots long arms and works in a tech/science field. The Venn diagram hardly overlaps. Which is a shame for both sides, I think.

Yeah, like I said, it's usually within the limited scope of 2A issues, but could be expanded to other areas. The red flag laws are something that hasn't been addressed. The thing about that is you can effectively circumvent the 4th amendment by going through the civil court since the protections are so much more limited. That's why TX wanted that civil abortion law and CA wanted to copy it for guns. No reason that can't be expanded to immediately sieze other property without a crime unless the protections are expanded. There are some limits to it's application to civil assest forfeiture since most firearms generally have a paper trail to prove ownership.

One of the big problems is that many of the coverage of the cases focuses on 2A and the 4A part gets hidden. Of course that makes for a bigger headline for the involved groups. Or they can be in specific industries that a normal person doesn't care about (FFL blanket record copies).

Recent case with more prominent 4th amendment angle. https://crescentcitytimes.com/supreme-court-sides-with-goa-i...

General stuff about searches. https://jslawgroup.com/fourth-amendment-gun-rights/

ATF has been performing entire book copies when they're only supposed to copy data related to specific guns/individuals related to a crime or error.

https://fflconsultinggroup.com/firearms-record-books-atf-for...

> One of the big problems is that many of the coverage of the cases focuses on 2A and the 4A part gets hidden.

The cynic in me thinks that the 2A gets more press because it's easy to find commercial and foreign government support for their organizations. 4A proponents don't have much if anything to sell.

There's a financial component to the 2A (and 1A) that doesn't really exist for the 4A. So the 4A will never have the same level of financial support as the other two.

Is that always going to be true though. As data becomes more valuable, being able to search&seize that data from anywhere anytime sure seems suspect to me.

Firearm manufacturers have a financial motivation to promote 2A rights. Who would have a financial motivation for 4A?

Don't they also have incentive to protect the 4th as well so that when "they" come to take those arms that they keep shouting "they" are doing, that a strong 4th would prevent them from search&seizing?

I think their view tends to be that the 2nd amendment alone prevents that. I rarely hear them talk about the 4th. However, I am 100% certain that if they stop viewing the 2nd as being so protective, they would become very vocal about the 4th instead.

I had the impression that the kind of people that go for 2nd also go for 1st, 4th and all rights in general, but because I am living on a different continent my impression may be wrong.

My experience is that the 2nd amendment people are really laser-focused on the second amendment and don't care so much about the other ones. The only time I've heard them express an interest in the other amendments is when they intersect with the second.

This is not as true as it used to be, at least in certain states.

Under CCPA/CPRA in California, you can request that personal information is removed. There are half a dozen other laws around the US that allow for similar requests in different forms.

Enforcement is still hit or miss. Lobbyists are starting to fight back against the most effective laws, for example:

https://www.chicagotribune.com/opinion/commentary/ct-opinion...

I'm involved in the fight to strengthen and expand these laws, and overall I'm hopeful for the future.

>Under CCPA/CPRA in California, you can request that personal information is removed. There are half a dozen other laws around the US that allow for similar requests in different forms.

CCPA/CPRA is a minor start, IMHO.

Telecoms need to collect and store usage information (including call detail) to perform billing functions.

As with most such laws, there are loopholes big enough to drive a column of tanks through.

And many other corporations collect and store data both for billing and because they can [mine|analyse|sell] such data.

Just being able to request removal of "data" isn't nearly enough.

Unless there are unambiguous opt-in data collection/retention policies, with clear, concise language about how such data could be used.

What's more, such policies should apply to any and all third parties providing services to corporations with such data.

Further, as another comment[0] in this discussion pointed out, the Third-Party Doctrine should be gutted and a requirement that all government agencies collect data for law enforcement purposes through the issuance of warrants by judges that specify the "probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."[1]

This is (unfortunately) a wide-ranging issue, with a growing number of industries (autos, electronics, "cloud" services, etc., etc., etc.) collecting, storing, using and selling all sorts of PII.

From a privacy perspective, this is a nightmare, the CCPA notwithstanding -- even in California.

[0] https://news.ycombinator.com/item?id=35073264

[1] https://www.law.cornell.edu/constitution/fourth_amendment

> CCPA/CPRA is a minor start, IMHO.

That's a real understatement. When I see how much effort is being put into neutering even the minor protections that has, I wonder how we'll ever get anything like reasonable protection.

If you're interested in advancing more effective privacy legislation (or just curious in general about what's going on out there), drop me an email and I can loop you into some interesting (and real-world-productive, not academic or theoretical) discussions with folks at the forefront of the effort.

Thank you. I may contact you. I'm already pretty active on this front.

I don't view the move to opt-in as a meaningful one because it's trivial to content-lock certain features to the point where the vast majority of users will opt-in even if they don't understand what is going on. At that point, the company collecting the data is in an even stronger position.

The solution is to allow the user to easily and in real-time access and control (port, delete) all of their data or data about them that a company holds.

>The solution is to allow the user to easily and in real-time access and control (port, delete) all of their data or data about them that a company holds.

You won't get an argument about that from me.

But I'd say that not collecting such information in the first place (which will require reversing a variety of perverse incentives) is the best solution.

There are exceptions for LEO in each of the relevant laws - cited in the article - but thanks for fighting this battle.

We didn't get this way overnight so while I'd love my idea to fly immediately, I appreciate people pushing things the right direction.

As a rule, if law enforcement has a warrant then it's going to be difficult to prevent them from gaining access. You can self-host and encrypt but that's difficult for mainstream users to do, and even for experts, it limits the tools you have access to. You can also be prosecuted for refusal to decrypt a device since SCOTUS hasn't yet ruled on the scope of the 5th amendment's protections with respect to encrypted personal devices.

I think the best solution is to set content to auto-delete (unless flagged) after some period of time. You can't turn over what you don't have.

"I think the best solution is to set content to auto-delete (unless flagged) after some period of time."

This is basically a necessity in on-site systems to free up space for additonal recordings anyways. Run a few cameras at decent resolution even at a fairly low framerate and you're looking at a couple TB per month.

Most systems (I think -- at least the ones I've seen) let you set it up so video is only recorded when the camera sees movement. Depending on what's in the field of view, that seriously cuts down on the memory requirement. Even inexpensive commercial systems will also allow you to specify areas in the field of view to ignore motion in, so that swaying trees and the like won't constantly trigger recording.

I have three cameras recording at a decent resolution and framerate, and together, about two weeks of video takes up less than 32Gb, because most of the time nothing is moving in the fields of view.

True, depending on the circumstances that works. It doesn't work great from some angles or other environmental factors. It works great for a door bell shot though.

> You can self-host and encrypt but that's difficult for mainstream users to do

It's really not. You can buy off-the-shelf systems from Amazon right now for around $500 that your grandmother could set up and have running without difficulty.

The real problem is the perception that this is a difficult thing for non-techy people to do.

> Third Party Doctrine says that once you give your data to someone else, you lose most of your rights to privacy, control, etc.

This is what I wish more people could understand about "the cloud".

The moment your private data is sent to a third party, it's game over in terms of having any privacy control on that data (unless it's encrypted with keys only you control and only you can ever access, but that's rare, intentionally).

So many people will argue "Oh but I trust company Foo" without realizing that is completely irrelevant. Company Foo might be trustworty, today. But management can change in the blink of an eye and they now still have your data. Or most importantly, regardless of how honorable management is, they can receive government orders (up to including NSLs) which force them to leak the data no matter what.

The real issue is that the vendors don't care.

If they did, they could set it up like AWS where you hit a button to spin up a pre-configured image that is considered yours. They don't want to do it this way because they want your data.

Also whether they need a warrant or not seems to be moot since it seems the judges are more than willing to sign them. We would also have to address the lax views on "probable cause" that seem to be rampant with warrant approval.

Further..

If the police get a warrant to search my home, they can see what I HAVE in my physical possession at that moment not what I DID have, have DONE, or SAID.

With video (or audio) data, someone could review every action, conversation, item, or facial expression my family has had within sight (or hearing) of the camera.

When someone can construct a complete record of everything that happened, it gets ripe for abuse.

I would have to ask why you have cameras recording inside the home when you're actively at home like this? Shouldn't the cameras only on when at night typical when you would arm the alarm type of situation?

I've been thinking that the US might be going about the whole Tik Tok thing in a nonconstructive way. If, instead, the federal government locked down what could be done with user data in a way that made Tik Tok not a threat, then we wouldn't have to say "these are fine, but that one's too spooky for us."

But then, the federal government would have to acknowledge that Tik Tok is just a different nation state doing what American companies are doing...

> Third Party Doctrine says that once you give your data to someone else, you lose most of your rights to privacy, control, etc.

It's useful to think of this not as you losing your rights, but you transferring your rights to that third party. The end result is the same, but that emphasizes that someone else has gained what you lost.

Law enforcement does need a warrant to go after most cell phone records, per the Stored Communications Act and Electronic Communications Privacy Act

Reply on news.ycombinator.com