Hacker News Reader

Comment by Jupe | Hacker News Reader

> LCX and Lead ID were responsible for many of these fake comments, letters, and petition signatures. Across four advocacy campaigns in 2017 and 2018, LCX fabricated consumer responses used in approximately 900,000 public comments submitted to the Environmental Protection Agency (EPA) and the Bureau of Ocean Energy Management (BOEM) at the U.S. Department of the Interior. Similarly, in advocacy campaigns between 2017 and 2019, Lead ID fabricated more than half a million consumer responses. These campaigns targeted a variety of government agencies and officials at the federal and state levels.

Wow. Just wow. How can anyone at these companies be avoiding jail time?

And who hired them? Is there no money trail?

View on HN

This is why, I think, the future is either putting your money (or at least provable identity) where your mouth is, or not being heard (e.g. because everyone will assume a petition without hard proofs of identity fake).

Yes, this is disenfranchising. But not being heard while some company pretends to speak for you is even more disenfranchising.

>This is why, I think, the future is either putting your money (or at least provable identity) where your mouth is

That will become less effective as companies become increasingly centralized, with just a few having many, many brands.

Why would companies becoming more centralized make "putting your money where your mouth is" less effective?

Because it can become hard to pick a different brand since there really aren't any choices at all: it's a monopoly.

You seem to be addressing a related but separate matter, namely boycotting products to influence companies. The topic in hand is companies pretending to be large numbers of anonymous people. This is what would be prevented if submissions to public consultations were tied to real-world identities.

Because they will start to have a monopoly and consumer choice will be so little, that you can’t avoid them.

I think this is a miscommunication. You interpret nine_k's phrase "putting your money where your mouth is" as meaning "buying only from companies you support", but I think nine_k actually meant "having public comments require payment".

Maybe this will come off as cynical, but aren't the customers of these 3 companies doing what you suggest here? "Putting their money where their mouth is", and since they have a lot of money their voice gets heard over the ones of individuals with no money. I don't think it's your goal.

So your second intuition about proof of identity is better, but the minute you invent a foolproof identity system and it gets widly used (by fiat or even voluntarily), you give a tremendous amount of power to the issuer/manager of it, as they basically hold the power of also removing/altering your public identity at their whims. You also make it harder and harder to remain anonymous and preserve your privacy, two things that might seem useless in a functional democracy, but unfortunately democracies are not perfect and they can turn into totalitarian systems where the wet dream of dictators is exactly this: having total control over every individual, especially the ones who would dare signing petitions against them.

This is by far not something humans have solved systemically, we have the technical solutions to build such systems, and governments tend to push to implement them, but as someone who cares about privacy/censorship resistance I do my best to build alternative, opt-in, systems to go around them.

No. Public/private keys can be under the control of the individual. You only need the public key to be signed by a trusted 3rd party. That only gives them the power to revoke it, but even the revoking can't cancel what you already signed while the key was valid.

Imagine your “trusted third party” is or becomes a dictator, who logs all signed keys. This doesn’t solve anything I’m afraid.

Stop trying to solve everything. These complex issues are never solved but we can improve and work on them.

There's value to considering possible points of failure up front.

Think of the inertia that mag stripe only payment cards have in the USA, and think about how long it's taken to get chip cards rolled out. And then consider that we don't have the more secure chip and pin variant that Europe has, and (to the best of my knowledge) don't have any plans to go that route in the future.

A bad solution with broad penetration and huge network effects is one that can't easily be changed in the future. Let's do imagine some worst case scenarios and think about what it would involve to harden a system against them before rolling it out to everyone.

Sorry, but public-private key pair sais nothing about birth or death of individual. Which is an occurrence as common as you would guess. Being living person in some country is the relevant information, holding some cryptographic keys is not.

Anonymity, in the age of cryptography, is not going anywhere.

Between astroturfing, AIs, trolls, and foreign involvement, we are increasingly in need of a countering force. We are currently suffering under the tyranny of the anonymous!

It is astonishing that so many people are still swayed by such outdated cyberpunk ideologies! The arguments of the 1990s do not make sense given the realities of the 2020s.

Don't you think that security-guaranteed-by-strong-goverment model is outdated too? Governments all around the world seem to be incompetent to solve the emerging issues.

> we are increasingly in need of a countering force. We are currently suffering under the tyranny of the anonymous!

Are you? What happens if this "need" isn't filled? Just because you can't probe popular opinion with an open comment system, it doesn't mean it is a requirement for society to work. We have systems to vote that work and don't have these issues. Simple paper ballots work really well.

> It is astonishing that so many people are still swayed by such outdated cyberpunk ideologies

Private companies and governments have never collected as much data as they do now, mostly without real consent, and they are getting the means to exploit this data very efficiently now with AI. The cypherpunk ideology (cyberpunk is a fictional sci-fi genre, although it's kinda related with its themes) applies more than ever in this context, it actually predicted the situation we are living, so I can't agree with you when you claim it is "outdated". Individuals should value their ability to be anonymous if they intend to remain somewhat free, this is the "counter" to mass surveillance.

What happens if this need isn’t filled? Well, the focus of this article for one, more and more astroturfing and fraud. How about riling up another country’s voting public with lies? Various forms of harassment and bullying? And do you think AIs are going to make this better or worse? Should we ignore all of this because we’re worried about the outcome matching the plot of a Gibson or Stephenson story?

I can’t come up with a better argument than I’ve made in these two articles:

https://www.williamcotton.com/articles/the-tyranny-of-the-an...

https://www.williamcotton.com/articles/authentically-human-i...

They are both short reads.

> our second intuition about proof of identity is better, but the minute you invent a foolproof identity system and it gets widly used (by fiat or even voluntarily), you give a tremendous amount of power to the issuer/manager of it, as they basically hold the power of also removing/altering your public identity at their whims.

A decentralized way to issue and authenticate private keys, so as to eliminate the trust requirement- not just transferring it to a certificate issuer- seems needful.

Not only could it help eliminate the manufacture of consensus in OP, such a technology would have broad implications for trust and might lend itself to anti-counterfeiting measures.

Although such a development would also amount to solving the problem of Byzantine consensus so I would feel most fortunate to see it happen in my lifetime.

> This is why, I think, the future is either putting your money (or at least provable identity) where your mouth is, or not being heard

Oh, I assume this will be run by companies. What is stopping them from impersonating you? Or impersonating you after you're dead? How can we trust these companies not to sell access to identities? Further, why not sell/rent your access to your own identity?

It's a good technical question.

Partly it's audit: check some randomly chosen votes, look for anyone not remembering casting their vote.

Partly it could be cryptography: you keep a private key and sign your vote with it. Your public key is stored by a trusted centralized institution, or several (see GitHub and signed commits), so anyone can verify your vote, but nobody can fake it.

Voting is anonymous to make it harder for someone to demand proof that you voted in accordance with their wishes.

I wouldn't want my employer, for instance, to be able to verify that I voted for their preferred candidate for state representative and take retaliatory actions against me if I didn't.

I don't speak of general voting, like for President.

I mean voting for various petitions, etc, the stuff outlined in the article.

Better fraud protection during general elections would be great, too, but it's a different and more complex area.

What makes you think lobbyists and large corporations can't afford the fee to speak?

It's mostly not the fee to speak, even though a mere $1 per vote could be too expensive for some petition-spamming efforts: 100k payments from the same account would trigger suspicion, and creating 100k legal payment accounts (paypal, google / apple / samsung pay, venmo, etc) just to pay $1 per vote may be onerous.

I mostly say about giving a ton of identifying info so that your vote can be reliably tracked back to you: not only email (with a one-time link to confirm the email works), but also a phone number, postal address, maybe even some government ID like SSN or driver license number. It removes any expectation of anonymity from the vote or signature, and this is by design. Fraud of the kind the article mentions would be easily detectable by a random check of 1-2% of the signatures (and more is suspicious patterns are noticed). As a side effect, it would make a vote or a signature a much more conscious, committed decision.

We don't need an ironclad identity system, we need stronger laws making individuals behind companies like this personally and criminally liable with harsh penalties. That is how scenarios like this can be avoided: destroy the cost/benefit ratio of pursuing it.

Yes, fraud can still happen. But if you fake 100,000 comments eventually you will be discovered and held responsible. What this would reduce is systemic fraud at scale.

Can you even function in modern society without a government issued photo ID? It’s required to drive, collect benefits, fly, purchase alcohol, purchase tobacco, or even purchase Sudafed. I just can’t fathom that there are any actual petitioners or voters that requiring photo ID would disenfranchise.

I guess the homeless and poor don't matter

Is there a state where you can sign up for public assistance without proving your identity with government issued ID? I'm not aware of any.

I'm pretty sure the Venn diagram of people without access to government issued ID and legal, eligible voters is two distinct circles.

I'm pretty sure all citizens are eligible voters?

I’m pretty sure all citizens are able to get government issued ID

UK does not issue ID, but you have to have an ID to vote now :D 4D chess

They have a register of random documents issued by 3rd parties that they will accept as proof of ID.

There are areas that you have to pay for ID which disenfranchises the voters who can't afford it

Where are these places where potential voters can't afford ID and how do they do any of the other things that typically require photo ID?

https://www.washingtonexaminer.com/24-things-that-require-a-...

>how do they do any of the other things that typically require photo ID?

When they are poor enough they either don't or have incredibly limited funds. I'm not sure what you don't understand about this

I just have a really hard time believing there is a large group of individuals without ID when it is essentially mandatory for modern life as an adult. I also am having difficulty believing that the usually less than $25 fee for government issued ID is an obstacle to anyone.

Personally I think a verified voter ID should be both required (so as to prevent voter fraud) and provided freely to everyone.

All that means is that you have an incredibly limited perspective shaped by your personal experiences. I would urge you to talk to people who are living on the streets or who work one or more minimum wage jobs to raise a family

How do you invent a system where the websites instituting the identity proof (KYC/ Know Your Customer) systems don’t just become honeypots for collecting the necessary data to impersonate the millions of people that used it?

Others have commented on your point about money already

I found this: https://www.nytimes.com/2021/05/06/technology/internet-provi...

Says a bunch of companies received millions in fines a few years ago and it names AT&T, Charter, Comcast and some lobbying group.

Imagine if your water pipe decided to only serve you water occasionally, and when it did threw some random bull-crap in there?

Who would vote for that system?

Imagine if your television only showed you ads and propaganda.

I don't have to imagine that

I assume that's what he meant.

It works so well too. Was on a r/visible, a Verizon subsidiary and they claim unlimited but it's really 1TB or less otherwise they threaten you. The thing is there are laws in place that bar carriers from doing this and the guy pointing this out is downvoted to hell because everyone there are all corporate defenders. Blow my mind that the phone consumer market are so gullible. When Comcast was pulling this shit, people were pissed. Nowadays people are falling in line.

> defenders

I read your comment as “…corporate defrauders…” and it made just as much sense in context.

In reality we haven't seen the worst case at all. In fact, we have companies like cloudflare arguing that they are obligated as an infrastructure provider to serve neonazi websites.

They hire ad / "lead" companies to collect emails of people who have clicked on an ad, or entered their email saying they support A, B, or C and give them permission to post a comment on their behalf. So in theory each comment has someone who gave the company permission to post a comment for them. BUT if you tell an ad company "hey here is $2 million, get us X number of emails" they're going to produce X emails even if there are not X amount of people. The actual fake profiles come from "publisher" websites that generate fake clicks or leads. Usually the ad or lead companies will have some sort of system to detect fake / spam responses... but $2 million is a decent incentive to maybe loosen their standards a bit.

> emails of people who have clicked on an ad, or entered their email saying they support A, B, or C and give them permission to post a comment on their behalf

Even supposing they did it this way, and people gave their informed consent (fat chance, but for the sake of the hypothetical), that's still fraud. Unless every single comment had a "written and submitted on behalf of X by firm Y" disclaimer, it's still misrepresenting the comments as coming directly from individuals.

Regardless of what fine print unwary consumers agreed to, the agencies being deceived didn't agree to any of it.

I’m curious if prosecutors could try someone for 900k counts of a crime.

I don’t believe there’s a limit to the number of charges in an indictment… I know I have seen 100+ count charging instruments (for credit card fraud).

Not only no jail, but the fine is laughable as well …

Yeah this, setting the price to $100k to guide core laws around $B businesses in a way to override public feedback is cheap. Sounds like it is now officially open season.

Why is it that a STATE AG is pressing for money while US AG does nothing?

STATE AG used Federal IG investigation to extract money from these crooks.

Why didn't FBI raid these companies?

They raided a ex-Presidents private residence for papers.

Identity Theft x 1 Million counts

> Why didn't FBI raid these companies?

> They raided a ex-Presidents private residence for papers.

Because that's not really how the FBI works. Recovering classified material from someone not entitled to be in possession of it is totally different. You probably want to read more, you seem to be speaking only at a very surface level, probably more than just Facebook too.

That said, while your rational for why they should be raided by the FBI is insane. I'm with you on the underlying idea. It seems crazy to me too that no federal agency is seeking charges under 18 USC 1001. How'd they avoid that?

> And who hired them? Is there no money trail?

This is the most galling aspect of that article - crickets on who paid them to do the deed. The companies named are obviously front company for hire. The clients are telecomms that require FCC licenses to operate. They should get their licenses revoked.

So we know they manipulated the net neutrality debate, but what are the EPA and the BOEM processes that they attacked?

That bit friendly fraud must stay profitable. Otherwise the enemy would do it for half the price! And besides, they just protected their jobs. That reasonable and everybody would have done this!!

Reply on news.ycombinator.com