Hacker News Reader

Comment by Pannoniae | Hacker News Reader

It depends. Just like it's legal to deposit money into a bank (a legal activity) but it's illegal to structure (a series of legal actions with a specific criminal intent).

Applying Bayes' theorem isn't illegal but making interference from other public information then de-anonymising other data based on cross-matching is an entirely different act, regulated by privacy laws.

Privacy isn't only about the method, it's also about scale and intent. See CCTV which can individually be dumped the footage from and rewatched to identify criminals vs. live feed surveillance with AI face detection to track everyone 24/7. Same data used but very different intents and outcomes.

View on HN

> Privacy isn't only about the method, it's also about scale and intent.

I'm with you about the intent, but I don't follow the scale argument. It's not like it isn't a privacy violation if you only do it to one person.

yes, it is, but if you only cross-match data from a single person, that's called conducting a (private) investigation, which is regularly done, that's absolutely legal...

However, it changes when you do that in an automated way, en masse, both ethically and legally.

The "automated way" is just a matter of perspective. What matters is that the more efficiently you can do it, the fewer resources you need to devote to "investigate" anyone. That can certainly create ethical quandaries. I don't follow how it creates a legal one. AFAIK, the boundaries on privacy laws tend to be tied to access & consent, not scale. Scale just changes the size of the violation. Can you give me an example of a privacy law where the legal line is drawn around scale?

> en masse, both ethically and legally.

I think only problematic ethically. From what i can see, there can't be anything illegal about collecting publicly available information and using any algorithm to analyse and deduce information from it.

The GDPR in Europe doesn’t allow you to use publicly available information without explicit user consent, especially if involves personal data. Even doing some Google Analytics can in theory result in large fines.

The GDPR is really complicated. There's plenty of publicly available information you can use without explicit user consent. What's true is that many of GDPR's rules, particularly the disclosure of data sources and erasure requests, don't get an exemption just because the data is publicly available.

For example, while they can't just divulge my name & age in the news, the captions under pictures in news articles can often still have people's names & ages under them without explicit user consent. Tabloids would likely cease to exist if it were any other way. ;-)

Actors living in other countries with no contacts to Europe don't give two shits about GDPR. If I'm a hacker looking at tracking down particular users and committing phishing/watering hole attacks all the laws on the planet really don't matter. What does matter is the data you leak online and the tools I can use to process it.

Folks who deliberately violate laws are obviously not going to follow the rules, but that doesn't mean the GDPR & other privacy laws don't have teeth (in fact, they have specific rules about mitigations against bad actors). Even when businesses don't have contacts in Europe (and once you are a certain size, that gets less and less likely), GDPR is a thing.

How would you feel about the existence of a website where I could paste into it a text box any Hacker News username, and it would reply with an accurate estimate of the job history, location history, political opinions expressed, net worth, age, marital/family status, other websites/forums frequented and usernames on those sites, etc. of that user?

How would you feel if a browser plugin displayed these details next to every username on Hacker News?

I'm not sure I understand the point of your question.

Reply on news.ycombinator.com