Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

Pros: For years America has disproportionately benefited from post-hoc enforcements (I mean mostly it was New York DAs suing banks for 2008, money collected from around the globe and then put into a single State)

(sane) Tech regulation is a long time coming and it's not coming out of the Five Eyes nations - good to see EU taking a lead

cons:

I wish this had been for a "harder violation. Yes it's bad. yes they are ignoring EU law. But it's you know drawing a social graph.

This leads to a fundamental issue - global capabilities (drawing a graph between all the people you know) should not be limited to arbitrary geographical boundaries. Social graph is fairly obvious - I have friends in US, where do we process the edge between those two nodes? If we cannot sort that one out we are going to struggle with epidemiology and medical inferences across boundaries.

Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?

View on HN

> This leads to a fundamental issue - global capabilities (drawing a graph between all the people you know) should not be limited to arbitrary geographical boundaries.

For me, this hits a more fundamental issue: how do we govern global issues without a global government?

A global government isn't really possible. I think the fundamental issue is that a tribe of "everyone" doesn't really work without a counterpart. I think the solution begins by colonizing Mars, a few moons, maybe some asteroids.

Edit: fine, more Mars land for me!

Global government is only the extension of local, national and regional government. The E.U. already is a kind of "international" government in that it creates de facto laws, rules and regulations that supersede the laws of its member states. Similar constructs (though not as advanced) exist i.e. in West and East Africa.

A global government is an entirely logical next step and could be a very valuable asset when dealing with truly global issues.

If I'm living under a dictatorship, at least I can try to escape and move to a better place. If a global government becomes tyrannical, where do we go?

Such an idea is centuries away in the best case scenario.

How about you stay and work towards changing the government? This is literally how every democracy has developed. It is also the reality for several Billion people today. Most can't just up and leave if they disagree with their governments. Borders are not open for most people.

I'm far from convinced that a global government could possibly be a good thing. I think that a large part of the political problems in the US, for instance, is because its trying to govern too many people of very different and often incompatible cultures and values.

The magic word is "subsidiarity": the principle that political decisions should always be made on the most local level that still enables their resolution. Under that principle, a (democratically legitimized) world government would only be tasked with creating laws pertaining to truly global issues (i.e. setting limits for the emissions of CO2). I agree with other comments here that this is unrealistic in the near future. But that doesn't mean that it is not a good idea.

The trick is coming up with a system where the upper layers of government don't try to take over the matters from the lower ones. The problem, fundamentally, is deciding what "pertains to truly global issues" - in a democracy, it's ultimately the people doing that, so if you can convince them that whatever local problem X is really important, it can become "global" all of a sudden.

This kind of stuff is usually set out in constitutions or basic laws which in turn can be enforced by courts – the usual division of power stuff. You could also introduce some sort of check on the power of a global government. In Germany, parliament has to get approval of the majority of state governments for certain laws to enter into force, for example. Same is true for the E.U.: The E.U. parliament and the council of the national governments of E.U. member states both have to agree to new laws and regulations in most cases, which guarantees that either one can't ride roughshod over the core interests of the other.

It usually is, but long-term there's a trend of, shall we say, creatively reinterpreting what's written to the same effect - just look at US. Some would argue that EU shows the same trend, although it's young enough that this doesn't manifest quite so much.

I’d actually argue that the increasing centralization of power in the U.S. is due to the increasing nationalization of political issues and the requirement for nation-wide resolutions to problems. The way it has expressed itself (strong presidential executive instead of parliamentary democracy) is probably due to the way the U.S. constitution was originally framed and some random events asking the way.

But that's the thing - why are these all suddenly "national issues"? Even healthcare can be done state by state (Canada of all places did it that way, and their system is still fundamentally province-centric), never mind all the culture war stuff. Is it really the most local level on which these matters need to be resolved? Or are they deliberately pushed there for political games?

You can have plenty of tribalism and conflict between people under the same government.

I think a better way to frame this is “Is it possible to use the rule of law across national boundaries?” Clearly the answer is currently a qualified “yes”: Laws, treaties, etc do exist and are commonly used. The areas that are addressed are clearly not uniform, nor can we rely on all nations to participate, and the enforcement of laws across national boundaries are extremely tricky and currently limited. However, that should not stop us as a planet from trying to improve global cooperation through the law, rather we should look at it as “more work to do”.

The UN kind of does that

The UN is not a government. It is a mostly voluntary organization that exists purely so we never end up in a situation like we did in 1914 or 1939 where the countries of the world are just not at table talking to each other.

Yes, the UN does lots of things. But it has no power to do those things without the voluntary buy-in of member states.

Isn't this kind of exactly what the EU is showing us, that a global power isn't needed if countries actually set requirements and regulations. There has been a lack of desire from law makers worldwide to protect consumer data even though it's very obvious that it should be a fundamental right to control who gets to know your personal information and worse, whether they can sell it.

What I believe is happening here is the EU is setting a new standard that the US and UK and others will have to follow if they want to do business in the EU, unless they invest millions in infrastructure and staff.

I believe the same happens in the US, one state such as California will make progressive law changes that force companies to just apply the same standards across other states as it's less legal and regulatory burden, so effectively one state can actually change the system for everyone, no global super government required.

You didn’t answer the question . How do you have a global graph without sending data to every country where your friends are?

This is another example of clueless EU regulators creating laws with no understanding of the implications

> How do you have a global graph without sending data to every country where your friends are?

On-Demand, i.e., if one of your friends actually visited your "node" (profile or whatever) and also by following the law for the country the data originates from, no need to store anything in the target country – i.e., like most of the internet already works (or worked), it's really not _that_ hard.

> This is another example of clueless EU regulators creating laws with no understanding of the implications

Meh, maybe some are clueless, but one sees also a lot head scratching and scapegoating from people that don't bother to even think on solutions or what the actual laws are about (i.e., are themselves clueless about the actual implications).

And what happens when I send a private message from the EU to someone in the US via Messenger?

The message is sent to the EU bureaucrats so they can scan it for X, where X is initially child porno but will surely expand. Your friend just sees a gray box with the text “Displaying this message would violate the GDPR.”

It’s the perfect user experience!

It needs to simultaneously accessible to UK law enforcement and not reachable from another country. Come on Meta, can't you solve that really easy one?

bans UK

Well, a private message sent via Messenger is not personal data (PII), so is not covered by GDPR. This is a very simple concept that critics of GDPR seems to ignore or get wrong over and over again.

It’s not about protecting all data. It’s about protecting personal data.

https://gdpr.eu/eu-gdpr-personal-data/

How is a private message not personal data?

There's literally a definition of PII at the link given above, which could tell you that. So stop asking stupid questions.

So yes you’re right my personal messages attached to my user name doesn’t relate to an identifiable person.

“which is any piece of information that relates to an identifiable person.”

If the message is really private (i.e. end-to-end encrypted) then Facebook can't see it , and if it can't see it, or process it in any way then the GDPR does not apply. And if Facebook does access the message and stores it on their servers in plaintext form then that's their (bad) choice, and they should be held responsible for it.

So now we agree that asking about private messages is not a “stupid” question?

And then if they do e2e encryption where the EU can’t get to it, that runs afoul of another proposed EU regulation.

https://www.politico.eu/article/eu-commission-violation-priv...

No, you are misinterpreting what the law is saying. The purpose of the law is to protect from the collection of data points (height, age, political opinions, etc.) about individuals. Sure, a private message between two individuals can contain such information in a way that can be associated with a specific individual. If Facebook would scan all private messages for such data and store it in unencrypted form, then yes, they would violate GDPR. But a simple text message between two individuals does not by default violate GDPR.

A very important aspect of GDPR is a consideration for the purpose of the processing of data. If your company is providing an international messaging service in order to harvest sensitive personal data from private messages, then yes that is very much illegal. But if the purpose is simply to provide a messaging service and you are taking the appropriate steps to secure the data of your users, then it is not illegal.

If you sent that, it's OK to have the data transferred, like I can already send a letter with a USB pen drive to a friend in America without anyone in the chain being liable for handling that, as long as they don't leak to third parties, i.e., anyone I did not choose to give my data.

As said, it's really not that hard.

> You didn’t answer the question . How do you have a global graph without sending data to every country where your friends are?

You do not, but that is not what the ruling is about. This ruling is about Meta using standard contracts (SCC) to achieve mass acceptance for personal data transfers of EU citizens out of the EU. Which you are not allowed to do with the GDPR. If Meta had obtained individual permissions from you on your various personal information, then it would not have been illegal for Meta to share your information globally.

This isn’t really about what you share on FB either, it’s about all the data that Meta applications gather about you (often without your knowledge) that they then send outside the EU with a very generalised permission that you probably auto-accepted when you signed up. It’s exactly because the EU regulators know that people auto-accept those general agreements without ever reading them that the law has been made to make such agreements non-GDPR-compliant. The reasoning is that you cannot sign away your rights without understanding what you are signing away, and if corporations don’t want to make sure you know what you are agreeing to then the corporations are in violations of EU law.

GDPR states, "The storage limitation principles state that you should keep personal data for as long as the purpose is unfulfilled"

Seems like FB was storing a little bit more than just social graph and for a bit longer.

> How do you have a global graph without sending data to every country where your friends are?

Why is it important that this can be done? The "social graph" is for the benefit of the likes of Facebook. You already know who your friends are and how to talk with them. You don't need a third-party social graph for that.

So Facebook and no other social media platform should exist? Or are you saying that a messaging platform shouldn’t store messages between a user in the EU and a group of users in the US?

I just heard Eric Hughes give a talk about this and the non-regulatory solution was pretty simple, flood the field with so much bullshit that the data collected is worthless. Sadly most people happily give away their most personal information for "free" email, chat and search engine. I don't think most people are willing to actually pay for the services provided to them in exchange for their detailed personal information, maybe people's opinions will change but I wouldn't bet on it and meaningful regulation written by lobbyists and voted on by octogenarians probably won't happen either.

Do you have any examples of software that currently accomplishes this for any services that are based around user profiles, often tied to a phone number?

Especially for unilateral users of such software? (if I could convince fellow proprietary service-users to use some obfuscating software that generated/filtered a bunch of fake communications, I could just convince them to use Free software instead of the proprietary service)

Any details on that talk or the venue it was presented in? I don't find any likely recent context from a Web search (and Hughes's name is increasingly colliding with others).

That said, effective chaffing is difficult and does little to mask methods used to surveil or profile. It's also highly ineffective against strong-intent signalling such as purchase behaviours, unless someone is willing to buy items of little interest or purchase-and-return with sufficient aggressiveness to likely provoke not only vendor cancellation but fraud or criminal investigation.

Cory Doctorow from a Reddit AMA a couple of years ago on chaffing's ineffectiveness:

Chaffing turns out to be pretty easy to detect, because people aren't random - generating data that is both plausible and doesn't leak anything is really hard.

The most common solution to this from information theory is to broadcast a steady volume of noise that is sometimes mixed with signal: for example, you start a Twitter feed that tweets out exactly 280 characters of random noise every minute. Sometimes, though, you push ciphertexts into that stream. Your counterparty analyzes EVERYTHING you tweet, looking for data that decrypts with their private key and your public key. Adversaries can't tell who you're talking to, nor can they tell when you're talking.

This is much harder to do with something like your web traffic....

<https://old.reddit.com/r/privacy/comments/j444u4/how_to_dest...>

And it's even harder with purchase history, postal mail, or phone-call activity.

In practice, the method would be unavailable to much of the public, and of and by itself a strong indication of surveillance interest, much as use of, say, PGP is long reported to be.

Likewise you have governments like the UK who are discussing bills that will effectively ban E2E encryption for children’s safety. If passed, companies like WhatsApp would just leave the market.

I believe your comment is somewhat true, but in your examples with the EU and California it’s mostly the case where (one of) the largest market(s) is able to set laws that govern the entire world. Which is great if everyone also happens to agree with the law, but it’s not the most democratic situation.

It is the most democratic situation. Companies can decide between a leave that market, b treat the whole world by the strictest laws or c only follow those laws for those residents. If the cheapest solution is b, and capitalism demands the cheapest solution, then that’s useful information for the shareholders to choose a path. Just because we know what they will always choose doesn’t make it undemocratic.

b might just not be possible as above poster wrote, regulations might be in conflict.

The problem is, what is a democratic global government? Larger states dominate smaller states in democratic governments all over the world simply because of numbers of votes. Having yet another layer of elections over it doesn't really make much of a difference.

Population of a nation doesn't necessarily correspond to influence, though.

In a democracy it does correspond with votes though. Other than one person = one vote, how would you structure a global government?

> how would you structure a global government?

We're not going to structure a global government, such a thing is never going to exist and we're never going to have to worry about it existing. Fortunately.

> Larger states dominate smaller states in democratic governments all over the world simply because of numbers of votes.

At what governance level would this be acceptable for you? The existence of political minorities is invitable. The question is where do you draw the line: street, block, postal code, city, metro, region, state, or nation? When is it ok to dominate others because they got less votes? The same issue is reflected in red states grabbing power from blue cities, with the implication that the state-level domination is A-OK.

I didn't say anything about acceptability. But if grandparent's comment is this

> with the EU and California it’s mostly the case where (one of) the largest market(s) is able to set laws that govern the entire world

this is not likely to be solved by yet another layer of government.

While I like the regulations on who can collect and share your data and preventing all these backdoors to the US Gov I also think these regulations make it impossible for small companies to compete with Meta, Google, etc. You can't hire enough legal and compliance experts to get it 100% right not to mention all the extra code you need to write. Maybe that's OK but my cynical side says Google and Meta lawyers write and practically hand these regs to the legislators with that in mind.

I agree, EU fuels the Corporations and blocks small companies from getting any traction, by increasing the compliance levels, without thinking stuff through.

I dont want to say, that fighting for privacy rights is a bad thing, but as small time entepreneur, they seems to be on same side.

That sort of argument sounds a lot like "Small companies should be allowed to abuse their customers because if they aren't, then they can't compete."

Not to mention if you can't move customer data out of a governance region that means you need a separate data center. Which is prohibitively expensive for a small business, but something a big corporation like Meta or Google would probably do anyway.

A "small company" facing global-scale governance challenges rather sounds like a luxury problem of big companies.

> You can't hire enough legal and compliance experts to get it 100% right not to mention all the extra code you need to write.

You don't need to hire a team, just a company. A lot of companies offer this exact service now and effectively.

For example: Drata.

I think I’m missing your point here. Let’s say Texas passes a law that all Texans data has to be processed in Texas, and because cowboys don’t give a shit there’s no consideration for the EUs law.

What would the appropriate way for meta to handle a friendship between a Texan and a European be? They can’t process the Texans data outside Texas, and they can’t transfer the Europeans data outside of Europe. Disallow them to be friends?

You are misrepresenting this ruling. Any data that the user gives informed consent to share can be moved wherever the user consents. This ruling is about sending user data without any active informed consent.

Not so simple. Even with consent you arent really allowed to store in america because america is assumed to be an unsafe country (because govt can at any moment force a US company to show the data)

> because america is assumed to be an unsafe country (because govt can at any moment force a US company to show the data)

I assume here the EU can't do the same?

Well, yes, that's ENTIRETY of the problem, US law pissing on privacy and user consent. Fix that and it's all well.

It never was about "where it is processed" but "who can access it".

I don't think users can consent to ongoing general-purpose data transfers.

This is from the European Data Protection Board FAQ following the Schrems II ruling. Does the text of the new ruling say something different?

> 8) Can I rely on one of the derogations of Article 49 GDPR to transfer data to the U.S.?

> it should be recalled that when transfers are based on the consent of the data subject, it should be ... specific for the particular data transfer or set of transfers (meaning that the data exporter must make sure to obtain specific consent before the transfer is put in place even if this occurs after the collection of the data has been made)

> With regard to transfers necessary for the performance of a contract between the data subject and the controller, it should be borne in mind that personal data may only be transferred when the transfer is occasional. It would have to be established on a case-by-case basis whether data transfers would be determined as “occasional” or “non-occasional”. In any case, this derogation can only be relied upon when the transfer is objectively necessary for the performance of the contract

https://edpb.europa.eu/sites/default/files/files/file1/20200...

This isn't a data localisation issue.

The EU isn't saying that personal data has to be processed only in the EU. They're saying it has to be processed somewhere with adequate standards of data protection.

Where outside of the EU has been certified in this way?

Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom, and Uruguay.

As long as international companies have the option to exclude any local government, they can simply vote by participation. Texas requires something that a Swiss social network cannot abide? Block Texas.

This doesn't work when a law doesn't allow some foreign company to escape, though. Suppose Texas decides that toy makers are liable for toys that hurt children. A Swiss company that makes army knives for kids decides not to sell to Texas, but other people buy some and then resell them in Texas. If the original manufacturer can't avoid the local government, that's more complicated.

Because I don't see anyone downstream agreeing with you, I just wanted to hop in and +1 that I think you're REALLY making good points throughout this thread. I think a lot of folks are having trouble imagining a world beyond "EU laws" and "US laws". If every national or even state/provincial government has its own data laws (we already have 5 states in the US with GDPR-like legislation, and more likely on the way), then we're just accelerating towards a fragmented internet __with no opt-out mechanism for the individual__. When (especially smaller) companies get weighed down by legal interpretations and the fear of violations, they're just gonna start blocking more and more clients from everywhere outside their jurisdiction. (Apologies to the world, but I literally work on software that makes it easier to resolve geolocation for web devs and, among some other reasons, one of the top ones is to block certain georegions.)

Separately, while I'm all for internet privacy and am generally aligned with the _intent_ of GDPR, having had to meet its requirements at the highest level of scale, I have no qualms saying that it's truly a _terrible_ piece of legislation. Clearly whole sections were written without any regard for technical accuracy, and it leaves a number of ambiguities and contradictions within its language that continue to go without clarification. I don't feel like getting in the weeds here, but if you ever want to see people getting in the mud about how to actually comply with it, just go take a peek at the higher-comment threads in /r/GDPR.

Personally, I'd much prefer a cascading set of standards coming from a technically oriented consortium of (ideally OSS) folks that could be enforced from the client side as much as possible, and then independently audited on the server side (like a UL certification, but for your server architecture). Most of us here are probably already using a ton of client extensions to enforce as much privacy as we can without breaking things, and if an OSS auditing standard came along for servers, it'd be sweet if I could e.g. set my browser to "EU data servers only" and have my browser give me an option to explicitly override it if I really need to (like we do today with bad SSL certs).

As for the data export and deletion controls...I get the argument that's only enforceable via regulation and government enforcement. But given the ease of data replication and laundering (made even easier in a post-ML world), I'm not optimistic that you can actually "catch" people violating it except against the absolute largest corps ("yeah, we totallyyyyyy deleted all your data, for sureeee"). Feels like it's enforceable at about the order-of-magnitude of insider trading in the US.

> I believe the same happens in the US, one state such as California will make progressive law changes that force companies to just apply the same standards across other states as it's less legal and regulatory burden, so effectively one state can actually change the system for everyone, no global super government required.

I almost bought a car from Carvana. They had all my info: driver's license images, SSN, etc. At the last minute they required a DocuSign signature, which I told them upfront I wouldn't use, so I canceled the deal.

Afterward, I told them I wanted all of my info deleted since we didn't do a transaction. They said they could only do that for CA residents. A CA law is not going to cause companies to follow that law for all US citizens if it's to the company's advantage not to follow it.

> What I believe is happening here is the EU is setting a new standard that the US and UK and others will have to follow if they want to do business in the EU, unless they invest millions in infrastructure and staff.

That’s called the Brussels effect (https://en.wikipedia.org/wiki/Brussels_effect), and indeed is similar to the California effect (https://en.wikipedia.org/wiki/California_effect)

>> how do we govern global issues without a global government?

By consensus. By willing participation of all. By individual countries actively deciding to operate in the agreed best interests of the whole. And when countries act egregiously badly, subsets of the larger group band together to employ military force against them. Government can exist without rigid structures. The enforcement of norms by the collective is a form of government. This is what they mean when diplomats speak of threats to the "international system" even though we lack any official world government.

Well, governments also can declare wars, send chaps off to die in them, and lock people in boxes for not following rules written down by the governments. They can also collect money from people under same threat of box-locking.

Not every "enforcement of norms by the collective" (what's the collective?) can do that.

World government doesn't mean world peace. Wars and locking people up are all part of legitimate government.

I'm answering your comment! Did you forget the context my friend? : - )

A government by definition has a monopoly on state violence. If constituent members are going to war against each other then the so-called global government is not actually a government, it's more of a voluntary association similar to the UN that doesn't actually have much real power.

Counterpoint: how do we govern global issues with a global government? I’m not sure it’s any easier.

Amazing counterpoint!

I'll try a coding analogy, as I saw your bio says you've done a lot of coding. The analogy may be off, and I assume you've done a lot more coding than me so I'm curious to hear your reaction.

Imagine coding a program and there are no variables or methods with global scope. If you want to know the number of users in the program, you have to add up all the user variables from each object and each object defines a user in a different way. Also, to access the user variables in each object, you need to use different methods. Now imagine there are 190+ different objects. Some are similar, some different, and they are constantly changing in their structure.

How would you be able to run global functions?

I imagine having standardized ways to access the objects (variables and methods within) could really help improve the program.

If those 190+ objects are not objects but libraries with different developers and different API structures and maybe languages, it can get even more complex without some coordination from a higher-level perspective.

How does that analogy land for you?

> Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?

Not with US laws. The whole problem are US laws essentially allowing government to force any company to disclose whatever they need with little reason. That's the problem. That the moment data are processed by US company (not even neccesarily in US), US government have right to violate privacy

Idk if they have the “right” to violate privacy (or whatever) I think that the US government just does it and they don’t care.

It would be great if the US (and Chinese) governments didn’t act in this way (I’m sure the EU would act in the same way if they had tech companies) but it seems to be their nature.

> Idk if they have the “right” to violate privacy (or whatever) I think that the US government just does it and they don’t care.

No, the problem is that the US has specific laws that allows the government to require companies to secretly violate privacy, and punish them if they refuse, or even for just disclosing that the request was made.

I am pretty sure China and Russia have similar laws. Its just if a Chinese company tried putting a canary on their annual report they would find someone explain the difference between "letter" and "spirit" very clearly.

The administrations of china and the USA are different of course, but not so different. The big difference is in the institutions and norms.

> I am pretty sure China and Russia have similar laws.

Transferring the private data of EU citizens to China or Russia would also be a major crime.

> The big difference is in the institutions and norms.

In theory yes; however the US has a strong norm of following the letter of the law, so what the letter of the US law says is important.

" the US has a strong norm of following the letter of the law" The US Government doesnt

Yes they do - why else would they write so many careful loopholes into their laws?

Then they just ignore the law altogether. Like FBI making almost 300k illegal searches. Because they can. https://townhall.com/columnists/kevinmccullough/2023/05/21/f...

There will be no consequences whatsoever to anyone involved. The laws are for you to obey and for them to prosecute you, not the other way around.

"...if [The EU] had tech companies"?

You seem to imply that none of the EU member countries are violating their citizens' internet privacy on a regular basis. I recognize that there are certain countries with _much_ stronger privacy protections in place, and that might not have something on the scale of FISA (from some of the compliance work I've done in the past, Germany comes to mind, but I'm sure there are a strong set of others).

But I'm curious if you explicitly believe that EU/EEA member countries unilaterally _don't_ spy on their citizens. Because I'd be inclined to say that's unlikely (at best) given what we know about the nature of intelligence organizations, namely that they're basically data lake vacuums in the 21st century.

The question is what is legal or not.

The US has laws that give them the legal right to snoop on any data about EU (avd other foreign) citizens.

Those laws make it impossible to follow EU privacy laws as a US company.

One of the two have to give, and the US should make exceptions for EU citizens, or rescind the CLOUD act.

This is the crux of the issue.

It's frustrating how many people are stuck in this loop, where they think any company can "easily" follow GDPR by just swapping data regions with their cloud provider. It's not that simple and never was.

This is a broader political spat between two of the largest government bodies in the world, not about facebook.

The EU is not the global privacy champion everyone makes them out to be. They just don't like that US companies can access EU citizens data specifically (since most of the internet is run by US companies). Whether they're okay snooping on their own citizens themselves is a separate issue--they've also regularly challenged encryption domestically.

I'm also certain the EU is not upset that certain 3 letter agencies in the US have access to Russian's private data when in the context of the war in the Ukraine. Like all governments, the EU only cares about their own interests, not about the philosophical idea of privacy in general.

So you almost had me there. First of all your points are all valid. Where something felt wierd to me was the edges. What is the exact value for customers in this edgeset being maintained and worse harvested, I mean processed? Today we have edges outside the context of a social network - my contacts in email, phone book etc. And those "edges" (not the target node) belong to - you guessed it - me. Nobody should harvest it without consent and/or maliciously. (There is the whole argument about internet ceasing to exist without ads and nobody would pay yada yada which I felt was too reductionist). If somebody needs to harvest it, get consent and let user decide how, where, when why etc.

So in this context is your con really a con?

> And those "edges" (not the target node) belong to - you guessed it - me.

For a contact in an email adress book, that makes sense. But for a "friend" relationship in Facebook, which side owns that edge? Or how about a message sent from someone in the EU to someone in the US, who owns that, the sender or the recipient? And if it is just one, does that mean that different messages for the same conversation have to be stored in different regions?

In this case the problem can be solved with 2 edges :) I am your friend and your are mine. Keep an edge on each side. Heck I could be your friend you may not chose to be my friend and that is fine. This gets even more fun as now both parties have to consent to only share "their" friend status with FB. Americans are forced to share their friendships, Europeans are not. Again total value for users no?

Now is this technically optimised (for the company) - no and irrelevant (IMO) in the context of how much control/power a user has. You could extend this to messages too. What messages I sent, what messages I received. I didnt send it - I dont own it. What about shared documents you say? Here users are explicitly sharing with other users for collaboration (the contents of said documents totally are of no business to the company).

See providers are providing a service(?). If the services needs to harvest data I still question who is benefiting from that harvesting? If the user is not actually seeing value (apart from subsidizing the cost of the internet) are we then not just using technical/UX complexities to justify a low-value (to the user) solution?

> For a contact in an email adress book, that makes sense. But for a "friend" relationship in Facebook, which side owns that edge?

I don't see where there's any ambiguity on this issue. Each individual has the right to not be subjected to spying and monitoring, which includes collecting personal and private information. A social graph is not a data dump where you are a mere drop in the ocean. A social graph is an ocean of personal and private data collected from you. Therefore, it's quite obvious that individuals have the right to not have all this ocean of personal and private data collected on them, specially without their explicit and informed consent, and they should have the right to force anyone to delete this info, both all or subsets, automatically and reliable and verifiably.

Just because I don't mind hearing what my aunt has to say about what she baked or who she chatted with, that does not grant you the right to get my credit score or where I went to highschool with or who I met years ago or where I lived, just because third parties and other edge nodes in a social graph posted that information and data that enabled you to piece it together. What is there to be discussed?

Let’s be clearer about what a Facebook ‘edge’ is. It’s something like:

   Alice tagged you in a photo with Bob
   Bob liked the photo

Now, let’s say Alice and Bob are both EU citizens, and I live in the US.

Can Facebook tell me that Alice tagged Bob in the photo? Can Facebook show me the photo I was tagged in? Can Facebook tell me Bob liked it?

> Where data is processed should not affect the care with which it is processed.

But I think you're pretty clear on the fact that it does. We live in a non-abstracted world of atoms.

I think that's why they said "should."

Is that why they said "should"?

To an extent GDPR already allows this. The fines are only occurring because Facebook is transferring data into a jurisdiction which doesn’t have strong enough data protection laws to satisfy GDPR.

In the U.S. case specifically, it’s issues around laws that allow the U.S. government to force U.S. companies to handover data arbitrarily with very little (if any) due process. If the U.S. modified their draconian laws to ensure that everyone was afforded due process before their data was scooped up by the U.S. government, then there wouldn’t be an issue.

Unfortunately verifiable processes packages don’t solve the fundamental problem that the various three letter U.S. agencies can send a secret order, with effectively zero judicial oversight, to Facebook and compel them to handover data, plus gag Facebook from telling the individuals about the demand.

There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim.

Fining foreign big tech over EU privacy nuances is like taking candy from a baby. The narrative zeitgeist on both sides of the pond is in support (stories of rigged elections for 4 years turned public opinion brilliantly).

While protecting your citizens rights is a noble cause, its hard not to see the moral hazard inherent in this approach.

Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. Especially while the US provides Europe with its extremely expensive military support blanket (NATO) against the angry bear at its door.

> Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO.

There's a simple scenario in which Meta wouldn't have had to pay these fines: Don't break the law. And don't continue breaking the law after being told to stop it. It's not abusive to remind companies that actions have consequences in the language they understand and respect.

who says Meta will pay this fine? they will litigate until the end of times.

Do you honestly believe that Meta's hundreds (possibly thousands) of both full-time and contracted out lawyers would collectively advise them to break the law? Knowing full well the outcome would be $Billions in fines?

EU to US data transfers used to be okay for years, then there was a single ruling that brought that into question. Because government moves slow, there hasn't been a new framework implemented. Ruling for Billions in fines during the interim, while the US government and EU are still negotiating the details of the new framework is not an environment conducive to full compliance. US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant.

Combine this with giant companies which also are slow moving (albeit faster than government) and you have a recipe for never-ending fines no matter how much you try to comply in good faith.

> US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant.

That's exactly what they should've done to not break the law while there was no legal basis for what they were doing.

They didn't. Now they suffer the consequences for breaking the law.

I believe they can still at any point stop operating in the EU and not pay the fine? How would the EU implement the fine if Meta pulled out? I thought their leverage was just the threat of blocking the service in the EU.

I guess if no Facebook exec ever wants to touch European soil again, that is an option.

Wouldn’t this have to be a criminal case for execs to be personally liable? I assume it isn’t a criminal case?

It's not, but not paying a fine can quickly become a criminal offense.

Does this apply to foreign companies? I’ve never heard of such a thing.

If it was a domestic company, of course, assets could just be seized to pay the fine plus whatever non payment penalty. Is there a criminal charge after asset seizure? Or does this just never happen because there is no incentive to do it domestically?

Not a lawyer, but shutting down a subsidiary to avoid overwhelming fines is de facto messing with the insolvency laws, isn't it? At least in Germany that is a criminal offense for which the executives of the (parent) company are ultimately liable.

Plus, Meta actually is a domestic company in the E.U. They handle all their E.U. business through an Irish subsidiary (which is why the Irish data protection agency is responsible for all of this) and they also have subsidiaries to manage political and customer relations in many other E.U. countries, as well as presumably data centers, etc. Removing all of this would be a big project and would give government agencies plenty of time to seize assets. These assets could also include non-tangibles, i.e. the .de/.fr domains for their websites.

Meta has plenty of EU-based assets which are not liquid enough to just pull out in a matter of months. The EU and national governments would also likely have options under insolvency laws and criminal statutes to freeze some of Meta's assets in the EU if the company made an attempt to pull out to avoid some fines. Of course Meta won't. The EU is a valuable market and even if Meta would stop making any profit (they won't), it can't just leave that market to the competition.

Corporate lawyering is basically about finding ways to break the spirit or letter of the law without being punished for it. Or to limit the punishment so that it is exceeded by the likely profit of breaking the law. So yes, Meta's thousands of lawyers probably recommend breaking (or "interpreting" certain laws in certain ways all the time because the cost/benefit analysis makes it worth it. And sometimes they miscalculate and the fines are larger than the profit or result in some unexpected political blowback. See also Apple's approach to its App Store and payment policies.

EU to US data transfers were questionable for years, until a whole string of rulings through several levels of national and E.U. courts made clear that they weren't under some circumstances. Other companies have found ways to deal with that, Meta obviously could have, but chose not to (because profits). One obvious way would be for Meta to save E.U. customer data on E.U. servers exclusively, splitting the social graph (and advertising shadow profiles, which likely is what they really care about). Good faith does not enter into the equation, would be my guess.

There was also a grace period during which time Meta made no substantive efforts to come into compliance. If Meta had even a half-baked EU solution they would not be so thoroughly and repeatedly punished.

Yeah, standing up a data center is not trivial, but Meta also hires the best in the world. Move fast and break things. In this case they didn’t even move at a medium speed, so they get no sympathy from me.

> Do you honestly believe that Meta's hundreds (possibly thousands) of both full-time and contracted out lawyers would collectively advise them to break the law? Knowing full well the outcome would be $Billions in fines?

Yes, absolutely. Laws are never clear and require human beings to interpret.

Lawyers jobs are about assessing risk. While they might not have explicitly said "you will get fined $B", they will definitely say "here is the likelihood that the EU fines you" and then meta management would make a strategic (e.g. do we want to risk this based on how much money we can profit) decision based on that.

The law is almost a moving target, based on the whims of the current political zeitgeist and public opinion.

And law isn't binary, yes/no. Much US law is very murky and ambiguous. It takes litigation and court action to actually figure out what the poorly worded laws mean. Congress is really bad at creating law for some reason.

The cost of setting up additional data centers in Europe and re-architecting your application with a different replication strategy is probably 10x-50x the fine. It would also take years and a sizable fraction of the engineering team to make it happen and there will be significant performance and reliability issues throughout the process. Easier to pay the fine and lobby for rules changes for a decade.

$1.3bil is a huge sum of money. To put that into perspective you could pay 260 engineers $500k a year for 10 years with that money.

Or 260 engineers $1mil a year for 5 years with that money.

You honestly think it would take it would 2600-13000 engineers 10 years to do the work needed for compliance?

> There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines.

this will likely be found to be unlawful too in the way the last two were

the EU commission shouldn't be creating frameworks that it knows are unlawful (definition of malfeasance?)

Why not? It keeps bureaucrats employed. Thousands of them.

> Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim.

a new framework passing wouldn't retroactively legalize the transfers happening before that, so this doesn't make sense.

Most likely even that, if and when it will be done will have flaws that sooner or later will cause the fall

Purely from a logical perspective, preventing the data of a company operating in the United States and Europe from contaminating or coming into contact is a pure utopia no matter how much effort it puts into goal or any other company operating in the same or similar field. There will always be a point of contact and a way for European data to be under the lens of some American agency or body.

In addition to Facebook is not really famous for its transparency in data management so any commitment to the contrary I see it as a paper promise

NATO's excuse that because the US finances then anything is allowed is a fallacious argument.

> There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines.

Black Books (S01E01) put it best:

> NICK VOLEUR: This new system, it's very closely modelled on the old system, isn't it?

> BERNARD BLACK: I'd go further than that, Nick, I'd say it was more or less exactly the same[.]

Given the US side of said framework is established by executive order[1] and the “court” it creates is part of the executive (much like the “ombudsperson” office that the CJEU struck down Privacy Shield over), it’s unclear if it will work, or if the Commission (an executive body who can establish these things but is subject to judicial review) is setting itself up for a Schrems III another ten years down the line for foreign-relations reasons. The EU privacy regulator very politely said it was dubious[2], while the relevant parliamentary committee[3] and later the full parliament[4] expressed open scorn.

The US diplomats, for their part, are trying for a “you too” defence[5]—which might well be factually true to some extent, just does not change anything about EU law.

> Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim.

As the legal basis for a transfer is fixed at the time it’s performed, a framework cannot be retroactive (but “the Commission was wrong, the transfers weren’t lawful after all” decisions can be). So while the FUD may be real, the case could just as well have been decided after the new framework had been passed.

[1] EO 14086, https://www.federalregister.gov/d/2022-22531

[2] https://iapp.org/news/a/edpb-welcomes-improvements-to-eu-us-...

[3] https://iapp.org/news/a/meps-urge-european-commission-to-rej...

[4] https://www.europarl.europa.eu/news/en/press-room/20230505IP...

[5] https://www.politico.eu/article/washington-to-brussels-we-wa...

> a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines

What specifically has changed about US law relating to mass surveillance of foreign nationals that is going to make this one work?

>There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines.

Until it's struck down by the court again.

The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law.

> The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law.

Or unless and until the EU changes its laws.

Lets hope not, given that the stances are

US: "we demand the right to spy on anyone for any reason, except US citizens where we absolutely must recognize their constitutional rights"

EU: "we demand basic protections for the rights of our citizens"

Those two views sound the same? Or am I an idiot?

No. For one, even taken literally the way I wrote it it's about two different sets of people -- the EU must defend their citizens (and residents, BTW), of course!

For another, if one looks past my vague wording, the EU (or at least Germany, which I'm most familiar with) doesn't have the dogma that it's required to set up a world spanning total surveillance state, no compromises beyond the ones absolutely necessary with their own constitution (and even those are followed within a rather "liberal" framework for the three-letter-agencies: they do have all possible data they can get their hands on, just pinky-promise to not abuse it, if US citizens are impacted, in the eyes of secret courts).

EU does no require a warrant for taking of data from residents [0] by LE. There is little legal protection from LE in Europe, "law enforcement agencies can access the personal data of citizens of any country as long as they are involved in investigating crimes related to the European Union."

[0]: https://law.yale.edu/sites/default/files/area/center/china/d...

Why would the EU change laws about how business is supposed to be conducted in the EU?

Because 10s of millions of Europeans benefit from US services and making it easier for US services to operate benefits their citizens.

> making it easier for US services to operate benefits their citizens.

The reason we have regulations is that the opposite proved to be true.

GDPR (and the national laws it replaced) does not exist in a vacuum, but is an implementation of ECHR art. 8, and CFREU art. 7 and 8. If it is changed, odds are it will become stronger, not weaker. And it is quite foolish to think the CFR will be changed to accommodate companies like Meta.

Why not do the data processing in the EU till the new framework comes into place?

How do you process data about an international social graph only in the EU? When a friend in the EU posts something, should their post not be seen in the US? What happens when I have a group conversation between friends in the US and EU?

Well, if the US and other countries don't have equivalent laws, you can move everything to the EU.

Of course, this doesn't work if another country has such a law. But if it's a smaller country, then it doesn't have as much leverage (e.g. Facebook could accept the smaller fine or pull out).

How do you move “everything” to the EU including messages sent to US citizens? What if the messages are in a group of people in the US and the EU?

What is your better suggestion: The world follows lax US law? Or anything goes, no law?

These are not acceptable options to the EU.

I don’t know, maybe let adults make their own informed decisions and weigh the tradeoffs versus benefits based on their own priorities instead of depending on the government?

You seem to have picked " Or anything goes, no law" which as stated above, is not acceptable to the EU.

Naïve libertarian takes like "let adults make their own informed decisions" are all fine and well, but when there's a track record of their harm that can be pointed to already, it is, as stated, a non-starter.

You do know how that worked out so far, right?

https://www.nytimes.com/2018/10/15/technology/myanmar-facebo...

https://www.amnesty.org/en/latest/news/2022/09/myanmar-faceb...

Your position is an ideology, and it is one with a poor track record; you're welcome to it, but thankfully you're not going to force it on Europe.

So should we now pass laws that outlaw everything that can cause you harm - cigarettes? Alcohol? Gambling? Sugar? Do you also support the “war on drugs”?

How much power do you want to give the government because you are incapable of making your own decisions?

This is a very silly straw man argument, and I'm getting whiplash from the continual changes of topic in search of a valid point.

How so? The contention was that the government should protect intelligent adults because they are too dumb to use their own judgment. But adults are intelligent enough to use alcohol in responsible way (which statistically is clearly not the case), but not intelligent enough to use a social media platform?

>"Abusing your position as a desirable market"

Sounds like something that the US does routinely.

>"Especially while the US provides Europe with its extremely expensive military support blanket"

1) I think it is more than compensating by Europe agreeing to use USD as the reserve currency. The US gets enormous benefits as the result.

2) Angry bear seems not to be able to win over a single country. Beside the US does it for self serving reasons. It is not a charity. And if it did not I think the Europe is quite capable to create and maintain their own army and weapons.

> There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines.

There’s already been two attempts at this, both of which were ratified, then struck down by the ECJ.

There’s already clear indications that attempt there isn’t much better than attempt one and two, and the smart money is betting on it not being ratified, or being struck down if it is.

In the meantime it’s been illegal for a years to transfer EU data to the U.S. So even if it did suddenly become legal, those laws aren’t going to retrospect, and Facebook still engaged in blatantly illegal behaviour.

Note that you are wrong on zero Judicial oversight...as it has originally been reviewed by the courts numerous times.

And, the 5-eyes(my term) still do collect some data behind the scenes that has minimal court oversight including GDPR.

Yes it’s not like the EU isn’t also trying to pass laws that force every encrypted communication to have a backdoor so they can spy….

There's two parts:

1. Hitting the big companies for the minor violations is a bit like arresting the mob boss for tax evasion. It's a lot more black and white than arguing whether they performed the right balancing test for legitimate interests (though actually they have previously been hammered for that one too).

> Where data is processed should not affect the care with which it is processed.

This is true, but it does affect the conflicting requirements it may be subject to. After all the Snowden revelations, it's clear the US data privacy regime is not sufficient, as the US government will take what it wants, and that's why transfers regimes to the US are repeatedly struck down.

The difference is that everybody agrees what the crime of the mob boss is, even if they can't prove it, whereas on Facebook people critique but there does not appear to be a consistent critique that makes sense to me.

Data privacy? That is definitely not what most people are talking about when they critique facebook. The free speech & misinformation lines of thought are directly in conflict.

Data privacy is linked to misinformation however in that by tricking you to give up all your data, they know you down to a t. They then sell that info on to propaganda/misinformation outfits and ad firms who can then target too much more efficiently.

Most of the misinformation concerns have to do with what other people are posting, but then people try to contort it into a critique of the platform without saying the quiet part out loud ("we should have a mechanism for deciding on 'truths' and have platforms censor things outside of those 'truths'") because the quiet part is actually unpopular.

Schrems I was 2013, which you'll note is 3 years before the US 2016 election and the covid-19 pandemic which are the two factors that really raised the tempo around the misinformation discussion. It's also 3 years before GDPR was passed, relying on earlier european privacy law and being largely driven by private citizen campaigns (including Europe vs Facebook).

So while the contemporary US discussion is far more dominated by elderly consuming political content, that doesn't mean nobody cared about privacy. You just need to see the furor about Cambridge Analytica or the Snowden leaks to see that that is a concern.

> That is definitely not what most people are talking about when they critique facebook.

A whole lot of people are talking more about data privacy than free speech on Facebook, though. Is one discussed more than the other? I don't know -- but I suspect most are talking about neither, and which group appears to be the majority depends on which group you tend to hang around more.

I'm not fan of barriers but this is coming down to "ban or regulate".

Whatever TikTok is to the USA, Meta and the rest is the same for EU. TikTok has known links to the Chinese Communist Party and the American social media and tech in general has proven links to US intelligence and mass surveillance programs. You may say that CCP is adversary and US-EU are ally but then again the US has proven to be able to elect anti European government, so EU can't afford to rely on not having Trump or similar once again in power.

The Americans are considering to ban TikTok, do you want EU to adopt the same approach and ban TikTok along with Meta and the rest?

I like the EU approach better, even if it's not ideal its better than complete ban. Honestly, I'm terrified from banning becoming the norm because this will mean completely fragmented internet and this will mean the end of global society because the countries will be able to shape their society the way it suits them for internal politics.

> do you want EU to adopt the same approach and ban TikTok along with Meta and the rest?

if only...

i think the worse part of all this is that it won't be a real ban. you will immediately see the news apparatus telling stories about how teenagers get long prison sentences for downloading tiktok illegally. Real people will be punished for the theatrics of global politics.

I don't know of good solutions. I'm deep in the "ban on regulate" camp, but I don't know what those bans or regulations should be. Honestly, I'm less concerned about Chinese and Russian agents than simple, capitalist free market forces.

Web sites which grab eyeballs grab dollars. There is no connection to truth, integrity, or honesty there. Right now, even with humans and Facebook-grade algorithms, that's leading to polarizing hatred. Things will get worse once LLM-style algorithms start generating content to optimize engagement.

We need individual free speech, but I'm much less sold on corporate free speech (or speech from algorithms optimized to a capitalist markets).

> I'm less concerned about Chinese and Russian agents than simple, capitalist free market forces.

it should be the other way around.

More afraid of US agents than Chinese capitalists?

The big and critical difference between TikTok connections to CCP and Meta connections to three letter agencies is that US and EU are military allies while US and China are strategic adversaries with chance of real hot war in the next 5 years.

Military umbrella that US provides to EU that includes military bases, transfer of military technology and freedom of navigation for middle east oil forces all parties to play much nicer. Fines to tech companies are fine (and often are supported by US regulators) but drastic steps like even seriously proposing banning big US tech companies are obviously over the line and are unacceptable.

Even beyond alliance, EU can start trade war but do not be surprised if then BMW and Mercedes cars surprising develop safety issues that requires full recall and compensation to all car buyers for harm.

The argument is that the EU cannot and should not even attempt to prevent unaccountable spying on its citizens by foreign states, or it will have its legs broken?

No, that's the approach in South America. In Europe it would be a bit more subtle.

I'm assuming "having its legs" broken refers to having german car companies treated by the US like silicon valley tech companies are treated by the EU?

Are the German car companies spying in the United States?

(OK, that's snarky, but the car companies did actually have to pay out .. because they defrauded US consumers! Not all "crime" committed by companies is made up to sell trade restrictions!)

Is that much different from the current foreign car import quotas and financial aids to categories dominated by US makers ?

So... like they already do? EU car and airplane manufacturers already produce their US models in the US due to tariffs rendering importing EU models uncompetitive.

The trade wars have already begun with the Inflation Reduction Act - the US is already turning protectionist and subsidising its own industry to the detriment of its allies' industry. I wouldn't put it past a future government to take more drastic action, whether or not the EU takes a hard stance on US tech.

The US is still a vital ally of Europe and I'm optimistic that this relationship will continue. But Trump and the alignment of factions of the Republican Party with Russian interests have demonstrated that this relationship is no longer rock-solid. Even the Democrats are shakier than they used to be, and orienting for a more self-reliant US.

The US is preparing itself for the end of the post-Cold War liberal global order. The European-American alliance may survive this shift or it may not. Drastic action against US tech is absolutely still premature, but we should be prepared for European interests to no longer necessarily be the same as American interests.

>>But Trump and the alignment of factions of the Republican Party with Russian interests

hmmm

>>> already begun with the Inflation Reduction Act - the US is already turning protectionist

you do know that was a Democratic supported, passed and celebrated law right? Not republican.

I have no love loss for the republicans, but this idea that all the problems with US politics are because of Republicans (or worse the Trump bogey man) is moronic and ignorant.

>The European-American alliance may survive this shift or it may not.

This shift has to take place with Europe advancing more of it national defense itself, America simply can not afford to be the world police anymore. The American People are demanding ever increasing social programs, EU Style Social programs, which the EU has been able to have due to the protection umbrella the US as provided at great cost since WWII, to date almost none of the NATO Nations have ever honored their miniscule treaty requirements of 3% GDP defense spending, when they should be closer to 10-15%, but most are at 1-2% (or less)

@32 Trillion Dollars in debt, the US Bank is collapsing, and closed...

> you do know that was a Democratic supported, passed and celebrated law right? Not republican.

I addressed this - the Democrats are also orienting towards a more protectionist, isolated US. The European-American relationship is also deteriorating under the current administration. But it's not Democrats that are arguing for abandoning Ukraine and acquiescing to Russia, it's factions of the Republican Party.

The reality of which party does what is frankly irrelevant though - the perception of people and governments of Europe is that the US is not as reliably staunch of an ally as they once were, and this kicked off under the Trump administration. Europeans believe that a Republican administration is less supportive of a strong alliance, and this perception of flakiness is driving a push for European self-reliance.

> to date almost none of the NATO Nations have ever honored their miniscule treaty requirements of 3% GDP

This is already happening. Several of the biggest freeloading countries have promised massive increases in spending in response to the Russian invasion of Ukraine, most notably Germany. They haven't met their targets yet, but an era of European self-reliance in defence is coming, in spite of current struggles with inflation and supply issues. Things are moving slowly, but European governments largely no longer believe they are safe without playing an active role in their defence.

> when they should be closer to 10-15%

That'd be an insane spending on defence - for reference the US spends 3.5% and Russia spends 4.1%. Ukraine spends 34% and they're currently locked in a desperate struggle for survival.

>>the perception of people and governments of Europe is that the US is not as reliably staunch of an ally as they once were,

It is not a perception, it is reality and people need to understand that. The US can not afford it any more.

>>But it's not Democrats that are arguing for abandoning Ukraine and acquiescing to Russia,

I dont know about "acquiescing to Russia" but some member of the republican party have long understood the fiscal reality, where the Democrats, (and other members of the Republican party) live in the fantasy land where money, and debt do not matter and the government can just spend spend spend, with no limit.

>>most notably Germany

I will believe it when they actually do it, they have been promising that for almost a decade now. They still have not promised 3%, only 2%, and they will IMO never get there.

I hope Poland emerges in EU leadership taking it from Germany

>> Russia spends 4.1%. Ukraine spends 34%

Now lets talk about corruption...

>That'd be an insane spending on defence

Maybe, but the US has been spending between 3-6% for decades building up the military to what is today, while the EU has been spending sub1% for those same decades, just matching US Spending is not going to cut it IMO.

Current US Military spending is at a all time low since WWII in % of GDP numbers, largely because the growth in the US Economy, in real numbers we still spend an INSANE amount of money.

Saying Republicans understand fiscal reality when Bush pissed away unimaginable amounts of wealth in the middle east is ludicrous. I'd like some of what you're smoking.

There's currently some noise about costs because the president isn't Republican and it's an easy way to score asinine political points. None of that is coming from any sort of principled belief system, though.

You might want to take a reading comp class...

I clearly said

>>*some* members of the republican party have long understood the fiscal reality, where the Democrats, (and other members of the Republican party) live in the fantasy land where money

See that second part, where "other members of the republican party" i.e the Bush "republicans"... the ones many refer to as "RINO's" in common political rhetoric today...

:eye_roll: I can already tell this would be a silly conversation, with you just repeatedly shouting "RINO! RINO!"

Republicans objecting to helping Ukraine because of cost are either blithering morons, compromised by Russian propaganda, or both. Take your pick.

So you believe in spending with no limits, no controls, and no accountability

Because that is what is happening today..

Or they do not care about ethnic war on periphery of Europe that affects none of US vital interests? Making irrelevant war in far remote country existential good vs evil struggle is how US got into Vietnam. The fact that there were zero negative consequences for US after fall of South Vietnam tells you that it was bullshit from beginning.

The same with Afghanistan. I disagree with Biden on many points but getting out of that country was the best possible course. Same situation as with Vietnam - with Taliban in power in Afghanistan there are zero negative consequences for US. What's more Taliban is apparently better than US or former "Afghan" government in suppressing actual terrorist activities that can threaten US.

Not every war is WW2 and struggle for world domination.

>"but this idea that all the problems with US politics are because of Republicans"

Maybe the problem is for people not realizing that they are dealing with 2 buttocks of the same butt. And it does not look like said butt is by the people / for the people. Instead of fighting between each other people could be better off doing something productive about it.

"2 buttocks of the same butt."

How is this possibly the case when there are vastly different laws and rhetoric from both sides? I get you are implying that both are there are too benefit the wealthy, which is true, but they also do other things that affect people. Abortion, gay rights, spending, taxation, gun laws. How are they the same???

Then you ask people to do something productive, what? Revolution? That will likely destroy the US economy and possibly the global economy for years. It will also lead to a large loss of life. There's also no guarantee what happens after will be positive. Look at France, post revolution they had a bunch of shitty governments/dictators and then the king came back.

So what are you suggesting?

The whole point of "both sides the same" rhetoric is to discourage people from doing anything political, that's why it never has any actionable suggestions. The only option to get something done in the US is to shack up with one of the political parties and hope you can get enough altruistic people elected to dismantle the broken two party system. "Both sides the same" wants to preempt you from thinking there is a "less bad" side to choose, so that you don't choose a side, so that nothing ever happens.

Both sides are OBJECTIVELY not the same. You can easily look at voting history and see that, even if you don't believe anything you hear on the news.

Think long and hard whenever someone tells you this fallacy.

"The whole point of "both sides the same" rhetoric is to discourage people from doing anything political, that's why it never has any actionable suggestions. "

I also believe this is the goal of many of the "both sides" people. Since not voting benefits Republicans[1] I believe those people have an ulterior motive to help them win

https://www.nbcnews.com/politics/elections/supreme-court-gop...

Your link is completely different argument to the one being made here about "non-voters"

Non-voters are people disgruntled with the current 2 party system, the largest voting block in that group are libertarian leaning people who do not break democrat.

Your link it talking about various voting laws, which largely impact densely populated cities, things like ballot harvesting, out-of-precinct ballot disqualification, and other such rules that have an outside impact on voters in urban cities which are largely democrat.

Very very different things / topics

> Non-voters are people disgruntled with the current 2 party system, the largest voting block in that group

There are no “voting blocks” in the group of non-voters.

Lol. Poor terminology. I should have said "largest group of eligible/ potential voters"

But still clear what I was getting at

"things like ballot harvesting, out-of-precinct ballot disqualification, and other such rules that have an outside impact on voters in urban cities which are largely democrat."

What about local elections, most elections are isolated to a particular area? The reason the Republican lawyer made that statement was to show standing. Meaning , why would the Republican party be effected by the various voter restriction laws. They said because it benefits them if voting rights are restricted.

If you are saying that the laws in question reduce the ability of democrats to vote vs republican (as in reduces the numbers more in cities vs rural?) What's the difference? I'm connecting turnout to their success.

Here's a more clear analysis though it is an opinion piece showing that young voter turnout is important for the democrats.

https://www.cnn.com/2022/03/22/politics/young-voters-democra...

The reason I used the Republican party's lawyer is because he was under oath and they wouldn't fight this case if it didn't benefit them

>"productive, what? Revolution?"

Since when productive means Revolution? Productive in my book means forming new party with the proper platform and winning the election. Meanwhile protests against most egregious actions will do.

>"It will also lead to a large loss of life. There's also no guarantee what happens after will be positive."

That had never stopped the US from instigating and supporting numerous revolutions and coups.

As for your last comment first - that's something the US government has done in the past and I'm talking about what the population might do. Completely unrelated.

I mentioned revolution as an example. Forming a third party will cause one of the main parties, probably the one whose voters are least fundamentalist, to lose. That's what happened in the past.

>"That's something the US government has done in the past"

Very recent past and they will do it again no doubts.

>"Forming a third party will cause one of the main parties, probably the one whose voters are least fundamentalist, to lose."

Well it is you country and you are free to maintain status quo.

> Then you ask people to do something productive, what?

Use direct democracy at the state level, where state constitutions provide for this, to replace single-member FPTP systems with multimember proportional systems, creating multiparty democracy, and then advance it state by state until it becomes a national norm.

>>Abortion, gay rights, spending, taxation, gun laws. How are they the same???

None of those things are constitutionally in the power of the federal government, nor should they be. Those are state level issues.

Gay rights are freedom of expression

> Military umbrella that US provides to EU that includes […]

…and also includes spying on EU citizens on EU (and the Five Eyes) leaders' behalf (aka "sharing intelligence"). Don't forget that data transfer to the US also provides European leaders a way to circumvent their own privacy regulations, which is unacceptable.

> Even beyond alliance, EU can start trade war

That's how European leaders saw IRA. They didn't retaliate because of the current context, but I find it surprising that US technologists are so oblivious to this kind of context, while resenting so acutely when US companies are asked to respect EU law.

Facebook being banned in the EU has no justifiable bearing on NATO obligations. NATO is not a trade agreement.

Thanks for reminding me of the book “War is a racket”. American farm boys being brainwashed into Americana,and send off to die to prop up American Businesses.

From the Banana Wars for the American Standard Fruit company, to getting PTSD in Iraq to make Dick Cheney wealthier, to who knows where next to defend Meta.

Nothing has changed in America. The military umbrella is watered with blood of lower and middle class boys and girls, but only to project Tycoons and Billionaires.

They could repel NATO, but if Europe slides with China then things will look very shitty for the Western Hemisphere.

Same logic was used for the Nordstream by Germany.

> The Americans are considering to ban TikTok, do you want EU to adopt the same approach and ban TikTok along with Meta and the rest?

Yes, of course.

Imagine the countries as a set of microservices, each exposing the data they want to. You can get all kinds of dystopian with this, and from technical perspective (although being a cool solution) somewhat twitchy eye inducing. Unless you make an OpenCountryAI standard that everyone confirms to - it'll get NASTY.

Now imagine micromonoliths with shared data. Much more soothing IMO.

I want microservices where appropriate, and I want my world global. Geographic boundires outlived themselves.

You ask consent from both users to store it wherever you'd like.

is it that easy? in which case what’s all the hubbub about?

No. You also have to take adequate technical and organisational steps to protect data privacy.

In particular, the EU believes that by transferring personal data to the US, it could potentially be accessed by law enforcement/three-letter agencies without 'adequate' process.

More here: https://www.osano.com/articles/privacy-shield-invalidated#:~....

In short, the US does not have "a level of protection essentially equivalent to that guaranteed within the EU".

Has to be meaningfully informed consent, IIRC, and a set of T&C the length of a Shakespeare play isn't that, not even when it's the shortest Shakespeare.

And I think we should get rid of the pop-ups.

Let the service do what it does with least permissions. If something doesn't work there should be a settings where you opt-in. Don't block my view, hoping I will click the dark pattern as you want me to, believing I don't get anything if I say no.

That's not informed consent. That's consent under duress.

I agree.

There will be some cases where you need to explain what's going on to a customer before they should be allowed to do stuff — medical, financial, probably some others too — but I think the whole thing is getting abused so much it can't stand, and the exceptions probably need a specific license already anyway, and that license can just also say "and you not only get to have the popup, you are required to".

Would you settle for Rodgers and Hammerstein provided that the piece is largely a series of musical numbers?

IMO anything more than one page of A4 in 12 point Times New Roman, is too much for a website where you connect with people and groups, chat with them, and share status updates and pictures.

Preferably half that.

(Advertisers are allowed longer agreements because they can be expected to hire a lawyer to explain stuff to them).

you _are_ aware that you can pretty easily tell sexual orientation, political positions and other personal, private and non-obvious personality traits from an individual's interaction in FB (likes, shares, comments)?

and you are aware the NSA has far reaching access into the FB data pool?

this possibility to filter out "the gays" or "the trans" mixes very poorly with say, DeSantis or Trump concepts of a clean and neat and ordered country.

_that_ is the concern of the EU.

the perfectly legal processing of personal data in the US, which is meeting all US regulations. "Kleinman. ls that with an ''ei'' or an ''ie''?"

we may agree to disagree but I think this is orders of magnitude more concerning than microtargeting political campaigns (brexit & co)

and _that_ already is bad.

https://policyreview.info/articles/analysis/regulation-onlin...

The EU bureaucrats have a solution: If you are in the EU then all your friends outside the EU see a generic icon representation of you. If they click the icon a window with the text “Displaying personal data related to this individual would violate the GDPR” appears. Your name is also redacted.

The perfect user experience!

Reply on news.ycombinator.com