Senator Wyden Letter Confirms NSA Is Buying US Persons' Data from Data Brokers
techdirt.com
techdirt.com
The information is out there, it's stupid easy to correlate and collate it. It's even easier to use that to do something profitable.
Getting rid of data brokers, making them not exist just makes a gray market for the information, one that is just as lucrative and is going to be untaxed and unregulated.
641a was the moment privacy died. We're not getting it back. We need to come up with a better method/idea...
https://www.healthit.gov/topic/interoperability/how-hipaa-su...
We're talking about the difference in trying to influence arbitrary third parties behaviors and the difference in trying to influence the behavior of your own employees.
sorry guy, saying businesses can just take your data and do the same thing as the government is delusional.
neither should be allowed.
Tragically the 4th amendment is kinda narrow. I would definitely appreciate some additions which enshrine a more specific right to privacy. Protecting against "unlawful" searches (AKA you have to take the case to court afterwards) is far to close to meaningless. Feels like the 4th amendment is about 10% as powerful as it should be.
The fourth amendment is a prohibition on UNREASONABLE searches and seizures. What possible definition of "reasonable" would exclude "legally purchased on the open market"? What other perfectly reasonable techniques would you deny to law enforcement? Should they not be able to look at someone's LinkedIn? Look up their address in a phone book?
No, the constitution isn't going to protect you from the government doing what everyone else can. If we want this stuff not to be available for sale, we should regulate it.
That's actually it's literal intended purpose as far as I can tell. For example, my employer can make certain demands of my speech or otherwise punish me for my expressed opinions, while such behavior is explicitly forbidden from the government by the constitution.
Why do you think the word "unreasonable" is even in the text of the fourth then, if not to clarify that the government IS allowed[1] to do normal/legal/reasonable/whatever research?
I'm not saying you shouldn't be offended that this stuff is being gathered about you. I'm saying the constitution isn't going to protect you and you need to vote for candidates (Wyden's an excellent one!) who will pass laws to do that.
[1] Because of course it is. Again, police work requires information gathering!
Unfortunately many (most?) people on here are in the advertising/data merchant business. You will never convince someone to understand a thing if their livelihood depends on them not understanding it.
- Having enough money to retire into a dystopian hellhole that I spent my younger years creating
- Making some hard decisions now so that I can have an average life in a functioning society later
I'd prefer the latter. But conveniently, it's not HN that we need to convince to reign in advertising, it's the House and the Senate, and their voters are plenty suspicious of "big tech" whatever that is.
And yeah, much more worried about the NSA than terrorists.
In fact, we can remove the government from the equation altogether and have a free market
Or something like that - point is, if it wasn't doing anything wrong, why was it obscuring that fact through classification and NDA's until now - when as you say - it's public data that the government would (in your theory of constitutional law) be entitled to purchase?
"The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans’ privacy are not just unethical, but illegal,"
and refers specifically to an FTC order[2] that prohibits the government buying data from a specific shady broker (X-Mode Social).
He summarizes the letter on his own site without the editorializing that honestly I love so much about Techdirt.[3]
On a side-note, according to Wyden, 'Through this case, the FTC announced that Americans must be told and agree to their data being sold to “government contractors for national security purposes,” for the practice to be allowed.' I don't know how that's enforceable given how many hands user data goes through. Most organizations that suck that data up sell it to several third parties who can then sell it to whoever they want. All the NSA has to do is go a few steps down the chain.
So it doesn't matter. The NSA will continue, as you noted, to lawfully buy this data from third parties who are slightly less sketchy than X-Mode Social (what a name) and the FTC's toothless rule won't change a thing.
[1] https://www.wyden.senate.gov/imo/media/doc/signed_wyden_lett...
[2] https://www.ftc.gov/news-events/news/press-releases/2024/01/...
[3] https://www.wyden.senate.gov/news/press-releases/wyden-relea...
Personally, I would deem such means permissible to investigate someone suspected of having committed a crime. Where I find issue is the widespread use of such techniques to monitor for crimes, since they come at such a large cost to personal privacy, and are searching for a needle in a haystack. Millions will have their privacy compromised so that maybe a single criminal can be caught, and personally, that cost is too high. I understand some folks might disagree that, but I hope Sen. Wyden, and others who join forces with him or follow him, will continue to represent that idea, and pursue legislation to codify it in law.
https://www.nytimes.com/2018/10/15/science/gedmatch-genealog...
• They've got a serious crime, like a serial killer, but no real suspects. They do have some DNA that is almost certainly from the criminal but it does not match any DNA they have on file.
• Years later they compare that DNA to DNA in some large DNA database that is not focused on criminals.
• There are no matches that indicate that the criminal's DNA is in that database, but there are several matches that indicate people who are relatives of the criminal.
• They can then look at assorted public records to find people who are related in the right way to some of those relatives.
• Among those people, some previous person who either never was a suspect originally or a very weak suspect comes up. They then take a thorough look at any records can find about that person's activities at the times of the crime and find that they were actually connected to most of the victims and in the right places at the right times to be the criminal.
• That gives them enough evidence to compel a DNA sample from that person, or they start watching the person and get a DNA sample from something like a discarded napkin or cup that the person unwisely discarded in a public trashcan. That sample matches the samples from the crime scene.
• It is that latter sample, and the records of the person's activities and relationships with the victims, that form the bases of the conviction.
Although in my opinion, the vast majority of this data collection and use absolutely counts as "searches and seizures" -- just by private corporations rather than the government. Which, in my view, is worse than if it were just the government.
Consider that no matter how evil the corporation, they can't seize your property or freedom. Be careful who you empower.
Their technical control over the signing keys that Apple devices trust also gives them the ability to enjoin shittons of otherwise legal activity (e.g. emulators).
Apple also pays shittons to have Customs & Border Patrol lock down the US border and ban iPhone parts imports that aren't authorized by Apple. Does that count as a fine?
I'm pretty sure that's already two out of three.
Some kind of standardized "label" (something like the standardized nutritional facts on food products) that is easy for consumers to read and comprehend, not buried in pages of paperwork, without needing to read a 20 page TOS / Privacy Policy.
The legal problem is everyone is "consenting" to data collection by accepting a TOS which protects companies and makes it "legally acceptable". The real problem that needs solving is consumers are rarely aware of what they're consenting to. Companies might not hoover up and sell as much data if they were required to clearly tell everyone they're doing it.
Basically, let's get rid of this idea that agreeing to a 20 page TOS / Privacy Policy is legally binding when < 1% of people actually read what they're agreeing to.
Right, which means consent was never actually given. In order for it to be consent, you have to be fully informed of and understand what you're being asked to consent to, and there has to be a realistic and meaningful way to withhold that consent.
Freely Given
Reversible
Informed
Enthusiastic
Specific
This really makes it seem like only a very limited set of contracts would actually be legal.
To me a big problem we have is that we act as if there is a fair "fight" between a mega corporation with a expensive team of lawyers, expert psychologists, and supercomputers against ... my gandma who googles to get to google. I think we all know that nearly no one reads pretty much anything they sign and if they did it is not clear that they are fully informed, understand, or are not under pressure (clear case might be medical consent forms authorizing something like a emergency surgery. I'd find it impossible to convince me the person signing was well informed and not under duress. I'd rather case like that revolve around expert of doctors determining if an action was reasonable to another doctor rather than have anything to do with a patient or surrogate signing a document. Seems to just waste time).
It really would be great if the crack team of lawyers was required to put terms and conditions into text that is understandable by an average person in a reasonable amount of time.
Correct. There is an abject lack of respect and even basic understanding of consent in society, especially in the business world. It's a massive problem that does not receive anywhere near the attention it deserves.
In situations where there isn't an alternative, consent is impossible.
I’ve often heard people talk of a lack of alternatives to certain services, so they use them begrudgingly, or boycott them at large personal cost. But it doesn’t have to be this way. There is nothing that I’m aware of that says banks or digital service providers need to collect any more information than is necessary to provide the service they offer. It seems to me that, at least in a this niche community there is a desire for privacy-respecting products and services. A company that oriented itself around meeting that demand would be, I suspect, very lucrative.
And what about all the information that is necessary to provide the service they offer, like the real-time location of everyone's cell phone and who calls who when and for how long or all the DNS requests? Sure, a company doesn't have to retain this information and market it for resale, but providing these sorts of services necessarily entails access to a lot of information that most people would consider private, but which the third party doctrine says isn't.
Let's be honest here, how many people are "clearly informed?" That's fuzzy definition. I'll give a personal example here[0]. Certainly the implications here are operating through fairly abstract and indirect mechanisms (it's even called "metadata") and most people are not trained to operate within these types of frameworks.
FWIW, no one seems happy with the situation but feel that they have no choice in the matter. It's said that you can choose not to use said service, but often the implication of that means no phone, no internet, no computer (at least non-linux), no bank, etc. There may be a literal choice available, but not a reasonable choice. I think we need to have a clear distinction between these two, because the literal choice is often used to justify something that would have major impacts. I think it is difficult to argue that one could create a reasonable and relatively average modern life with no access to phone, internet, or computer. It also then clearly becomes "well I'm forced to share with x people, so I guess I'll share with y" and often x is "the government" (even if it isn't).
[0] I've on several occasions had conversations with my family where they've been convinced that their phone is listening to every conversation they have (this dates back to 2010 btw but continues today) because they were served ads for something they were talking to about with a friend, in person. They are convinced that is the only way that such an inference could be made rather than through knowledge that the friend made the purchase (recently), that the companies know these two people are standing right next to one another for an extended period of time, and have a decent knowledge of their interests to infer that this product would be likely discussed by these two people. Ironically the recording is more complex, but it appears simpler. Sure, setting is different in 2023+ but we know the compute costs to process every conversation and energy requirements to be always recording and that this would kill phones of the 2010's.
We should have granular control over the permissions we give companies in how they use data. I don't feel it is enough to require clear disclosure of the ways a company uses data, I think they should require explicit and knowing consent from the user, and the user should have a meaningful way to withhold consent other than to abstain entirely from using any online services.
It is hardly fair or equitable, and surely should not be legal that a company can, without any meaningful way for a user to withhold their consent, declare & demand unlimited control and benefit (of/from the user's data) for any purpose whatsoever, including sharing and selling said data for a profit to data brokers who have no contractual obligation to the user once they obtain the data.
Honestly, I think one of the major issues is that the world is exceptionally complex these days (well, always has been, but surely there's more now). Our entire world runs on specialization but we often act as if one needs to be an expert in nearly every domain. Is not the definition of an expert someone who understands the nuances and complexities of said niche? It would then seem de facto unreasonable for people to have a nuanced understanding of practically any given subject.
Because of this, I want to question the common framing about focusing on informing people. I don't want to stop informing people, to be clear. But I think we should look for solutions that are not reliant upon people being informed, as this is clearly not a scalable nor stable mechanism for creatures with finite ̶t̶a̶p̶e̶ ̶ knowledge and finite time.
I mostly trust Mozilla but I still turn off all of their data collection in Firefox. This wasn't always my default but it is now my default in any place where I am given the choice.
It really is difficult to understand all of the implications and it's taken me years of experience to realize that I should just default to presuming that data collection is going to be bad for me in the long run. When there is a complex and nuanced situation involving a binary choice then all you really need to know is which of the two choices is generally more likely to be in your best interest, then always choose that one. For data collection the safe bet is always "no"
It's the premise that once you give up data to a third party, you no longer have any "reasonable expectation of privacy" so therefore it's not a search.
There is similar case law backing up searching your garbage can. While it's up against your house (aka still under your control), you have rights to it.. once you put it on the street for the garbage truck to collect, you've surrendered those rights.
I'm NOT saying this is good or what I like - specifically, I hate it - but it's how it currently works under US case law.
Therefore, to change things, we need Congress to write new laws and/or new Amendments. Our opinions of "how it should be done" are irrelevant unless backed by the law.
This is an arbitrary distinction chosen purely by judicial fiat. There was no democratic movement to strengthen 1A and weaken 4A/5A in this manner. Ergo, we shouldn't necessarily have to get Congress involved just to fix this weird inconsistency in caselaw. The courts have an understandable aversion to "legislating from the bench", but if you've already done so, I think it's fine to at least fix obvious mistakes.
How do you imagine property rights for personal data to work? Even in places like the EU with stronger rights/protections around personal data they don't try to fit those rights/protections into the existing framework of property rights because they are so different.
We continue to "own" the data, but we've given them a worldwide irrevocable unlimited license to do what they want, limited only by local law.. hence why I put "own" in quotation marks.
The State Actors doctrine says that the government can't hire someone to do something on their behalf that they're not allowed to do.
Under the Third Party Doctrine, they aren't searching and seizing your property in this case, as your data is no longer your property since you gave it to that third party already.
If the government was paying Neustar (or whomever) to go acquire this data on their behalf, it would be an issue under current law. But buying something that was handed over willingly* is a different issue.
*the article makes a valid point that many people are unaware they have agreed to hand this data over to a service provider, which is something that should be addressed IMO.
You might not agree with it, but it's not an "obvious mistake" and it's not a "weird inconsistency" in caselaw.
Under the Third Party Doctrine, they aren't searching and seizing your property in this case, as your data is no longer your property since you gave it to that third party already.
Nothing with data collection is "voluntary". To exist in our society there are so many "private institutions" that essentially wield governmental power.
It will absolutely be our undoing as a country that we cannot see the forest from the trees.
No, you aren't (at least in my area), but even if you are that's not the government's problem.
> Nothing with data collection is "voluntary". To exist in our society there are so many "private institutions" that essentially wield governmental power.
It is "voluntary". The quotes are there for a reason because it can be highly inconvenient not to "volunteer", but it is possible (at a cost in most cases).
> It will absolutely be our undoing as a country that we cannot see the forest from the trees.
Third party data access will not be our undoing.
For one, it's not that serious of an issue, and we can ultimately change the law if enough people feel strongly enough about it.
it can be highly inconvenient not to "volunteer"
https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Stored_Communications_Act
It's practically impossible to avoid giving your information to a 3rd party.
Try traveling with a concealed firearm across state lines. Or telling a K-9 police officer they can't search your car after the dog has alerted. Or use your free speech privilege to spread alleged vitriol.
There's no such thing as "rights" - only what individuals can defend in the current place and time they're in.
> There's no such thing as "rights" - only what individuals can defend in the current place and time they're in.
I suppose that is the way it always has been. When the government was small people just didn't care what they were up to. The people became complacent and allowed a beast to grow. If the rights we are supposed to have keep getting trampled on revolution is inevitable. It may take a long hellish time to happen but that is one fork in the path we are on.
On the one hand, I fully agree. On the other hand, I also agree with the intuitive argument that it's very strange to let private corporations surveil and gather, buy, and sell information about citizens to exploit for profit, but then say that the government can't buy that same information for law enforcement and national security.
It feels wrong to say that it's fine for someone with only a profit motive to use private data in small, petty ways to extract more profit from someone that's already paid them, but that the duly elected representative government can't use it for big, important things. Or, if law enforcement and national security are too fraught, what about, say, public health policy?
The obvious answer is that corporations shouldn't have access to it either, but that's a much harder sell, and so we're in this weird limbo.
We make this distinction all the time in areas like speech and searches, for good reason. The government is the only entity with near-omnipotent power over you. Corporations may be powerful, but they are ultimately restrained by the government’s monopoly on force; the government has no such restraints because it has the monopoly on force. It’s therefore reasonable and prudent to have different, more stringent rules for the government. If someone working for a corporation doesn’t like you, they can’t kill or imprison you (legally). Not so for the government.
With that being said, whether or not anyone at all should be allowed to collect or use this data is also a totally valid topic for discussion and disagreement.
Someone working for the government can't legally kill or imprison you because they don't like you either.
In developed democracies, if you are a citizen, because of the tight restraints put on government power.
Those restraints are, historically, a very new idea, and they are hardly universal even today: https://en.wikipedia.org/wiki/Enforced_disappearance
It is and always has been legal for other people to volunteer information about you to the police. Doesn't matter if they're operating a business or not.
I can call the police right now and tell them that lumb63 posted a comment on HN at 2024-01-30T14:14:13. If I had more detailed information, I could tell them that too, and they could legally listen to me. I could tell them literally anything that I know about anyone.
Why would that be illegal?
This situation doesn't have anything to do with the 4th amendment. The 4th amendment prevents the government from forcibly taking information.
Times change, so do effects and outcomes. Laws don't have to be fixed for eternity. It would be really dumb if they did. Fortunately a system was designed to update laws in accordance with a dynamic environment.
The problem here is a lack of regulation for the companies that collect this data. Forget the government, data brokers can sell to anyone they want -- a stalker, someone looking to do harm to you, etc. People are harassed, robbed, cheated, scammed, and physically harmed using this information on a regular basis.
> It is and should continue to be legal for people to tell the government whatever they want.
You're right, but that's not what's happening here. What's happening here is one of 2 things. 1) Government initiated: seeks out and requests information from others and in this case, offering payment. 2) Information holder initiated: who is specifically offering information in exchange for compensation. This is more akin to walking into your police station and saying "I have crimes to report, but I will only do so if you pay me first." Obviously this has perverse incentives and I think we can see how this can clearly be abused to circumvent any requirements for warrants or other such due process.
I do agree that this situation is in violation of the __spirit__ of our legal system. Clearly a loophole is de facto not in spirit. Whether that is a 4th Amendment or not, idk, IANAL and neither is the OP and I assume neither are you(?). 4th Amendment seems pretty reasonable to point to considering it mentions warrants and this practice is being done explicitly to circumvent warrant requirements. But clearly we all understand what is trying to be communicated here, and that's the point. I wouldn't have made such a comment if you mentioned explicitly third party doctrine (as casey did an hour before you) or cited some law which added clarity to the situation. But yes, everyone knows you can just freely go tell the police about a crime you witnessed. I'm not sure who does not understand this. I would be extremely surprised if anyone actually believed it was illegal to report crimes to authorities and immediately question their mental capacity. But I guess we disagree at what constitutes basic and obvious knowledge.
> 1) Government initiated: seeks out and requests information from others and in this case, offering payment. 2) Information holder initiated: who is specifically offering information in exchange for compensation.
Like a wanted poster and a bounty for information? These existed when the BoR was written. They weren't prohibited by the writers because the writers didn't have an issue with it. The 4th isn't a "government can't know anything or can't ask anything" rule, it's a "government can't bust down your door for no reason" rule.
> I wouldn't have made such a comment if you mentioned explicitly third party doctrine (as casey did an hour before you) or cited some law which added clarity to the situation. But yes, everyone knows you can just freely go tell the police about a crime you witnessed. I'm not sure who does not understand this.
The example I gave was a practical illustration of how silly reality would be if third-party-doctrine wasn't a thing.
It sounds like we agree that the amount of data being collected on people via the internet is way too much and should be restricted. I think that regardless of whether or not stopping the government and its agencies from purchasing such data is or is not in keeping with the spirit of the fourth amendment, we will need legislation to protect the privacy we want from the government, and definitely from corporations. Let’s work toward that end.
I agree with the latter, but not the former. If you solve the commercial data privacy issue here, the entire problem is solved, because it is the root cause.
We don't need a law that prevents the government from buying records about your internet traffic. We need a law that prevents companies from selling it to anyone.
I think many agree that this is a fundamental part of the problem but the article is about the NSA who has been known to gather a massive amount of information on the public through entirely their own means. But no doubt destroying surveillance capitalism will be a big win for the privacy, security, and safety of the public. From the government, foreign adversaries, and other members of the public alike. But the war will not be won despite victory in a major battle.
> We don't need a law that prevents the government from buying records about your internet traffic.
You're right. We shouldn't need a law and this will likely come down to a court case that would make explicit the spirit part. As government entities are not allowed to obtain evidence via means that an average citizen would. Which is the entire point. If the gov would need a warrant to collect that data themselves, they need a warrant to elicit that evidence (distinctly different from evidence freely and voluntarily being given to them). Meaning they need a warrant to buy the evidence.
> We need a law that prevents companies from selling it to anyone.
We need laws to prevent the collection in the first place.
Agreed, when possible. But the vast majority of this information is just generated from the activities inherent to doing business and it's always possible to prevent it from being collected at all.
I think it's generally okay and expected that businesses have information related to my interactions with them. But I think people don't expect or like the idea of that information being shared with third parties who didn't need to be involved.
> The 4th is about preventing the government from abusing their power to compel.
Let's get the 4th in here to so we actually read it and not from memory
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
The 4th is in part about government abusing its power, and that's true for all amendments. But it is clear that the 4th is about protecting information. I do not think it is hard to read as "The government is not allowed to collect information on people without warrants and without due probable cause." It clearly has a legal setting for this given that it is what is cited to prohibit wiretapping[0] and I'll even quote Justice Potter[1]
> For the Fourth Amendment protects people, not places. What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.
Note that the stress here is on intention to have public and intention to have private. You are protected even if in the public but intending to be private. Surely Potter would believe that were one to walk to a secluded area to hold a phone conversation and the government followed to secretly listen in, that this would be within the protection of the 4th Amendment. Many people incorrectly assume that you cannot have a reasonable expectation of privacy out in public. You sure can and everyone does it. Bathrooms are an uncontestable example.
> Like a wanted poster and a bounty for information?
The government cannot print wanted posters without due process. Yes, I have no problem with this. The due process part is essential.
> The example I gave was a practical illustration of how silly reality would be if third-party-doctrine wasn't a thing.
There is a huge difference between someone coming to the government out of their own free will -- someone who is not under duress nor are they incentivized by payment -- than the government making a request. Action is important. The government here is making an explicit action to seek and gather information. Obviously I do not object to someone reporting a crime and I should not need repeat myself any further.
There's a reason this is different and you need to stop pigeonholing me into a completely irrelevant argument. Here's how this can be abused. The government (or "friend") creates a private corporation. Private corporation does everything that the government cannot do without getting a warrant. Private corporation then gives the information to gov. How is this not a loophole?
That's the thing. The government is __seeking__ information that it would normally require a warrant to obtain. Were companies to freely offer this information to the government, then that's a completely different scenario and precisely the one you keep arguing which no one disagrees with. But if the government takes action to elicit that information, (aka ACTION) then that is not the same thing as information volunteered.
[0] https://www.law.cornell.edu/constitution/fourth_amendment
[1] https://www.nmid.uscourts.gov/documents/civicscontest/2019/b...
So, when the police ask the public for information related to a crime, it should be illegal? I disagree. The police shouldn't be prohibited from asking anyone for help.
> I do not think it is hard to read as "The government is not allowed to collect information on people without warrants and without due probable cause."
It might be easy to read it that way, but that doesn't make your rephrasing a correct characterization of the writers intent. The 4th has never prohibited the government from collecting public information, information volunteered by the public, anything they observe in the course of their duties, or literally anything else that isn't compelled. The government has always collected these types of information, both now and at the time that this was written. The writers were aware that police need to collect information in their own investigations, and from other people, to do their job. This is why they specifically wrote what they did, and did not write your rephrasing.
> What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.
Right, phone booths do not have any rights under the 4th. And if Charles Katz is in a phone booth, he expects the conversation to be as private as speaking in a phone booth is. But if Charles Katz gambling partners at the other end of the phone decided to snitch on him, that's legal for them to do, even if Charles Katz didn't want them to.
Make no mistake, Justice Potter is definitely not saying "if you tell someone about a crime, it's illegal for them to snitch". He's saying that there are situations in public spaces where privacy from direct government surveillance is expected. Phone booths, bathroom stalls, changing rooms, etc. These are public spaces with some expectations of privacy. But there's nowhere, anywhere, that other people are prohibited from talking about you to the police.
> The government (or "friend") creates a private corporation. Private corporation does everything that the government cannot do without getting a warrant. Private corporation then gives the information to gov. How is this not a loophole?
Because the government has a monopoly on the use of force. If people working for a private corporation searched or seized information from others by force, it would be a crime. Data brokers do not use force to obtain their data. There is no search or seizure happening when you volunteer your data to a data broker or their affiliates.
Absolutely not. I'm not sure how you don't get this. It's been explained several times.
Police asking: fine
Police offering bounties: needs oversight
Police sitting in police station and citizen walks in to volunteer information: fine
Police go to private corporation and pay for data: needs oversight
Police compel company to give data: needs oversight
You treat these as if they are all the same, but they are not.
That's not it. I think it is perfectly reasonable to set up a government with constraints and a culture of respect for the citizenry. It isn't about trust or no trust in 'government', because government is made up of individuals, and individuals have all kinds of motivations. I generally trust the government, but I am aware that any specific policy or decision can be a corrupt action for the benefit of some individual within the beurocracy.
Your household size and firearm preferences data can tell a rapist how easy of a target you will be.
Your genetic information can be used by insurance companies to secretly deny you coverage for pre-existing conditions, even though this is illegal.
Your genetic information could also cause you to be targeted by racists.
Your sexual preferences could be used against you as blackmail if the government or cultural moment shifts away from tolerance and they become unacceptable.
Your purchasing habits could cause you to become a prime suspect for a terrorist who used those same items in your area for a recent attack, like if your wife was buying a pressure cooker while you were buying backpacks for your kids doing back to school shopping.
I know a lot of these sound crazy, but consider this: the fact that they sound so crazy would itself make you sound less believable to others if anyone ever did victimize you any of these ways, furthering their odds of being able to perform that successfully without repercussions.
>> "Just Pretend"-privacy
>> Or so I can tell myself.
I am perfectly aware of every fact you noted. Repeating those facts on HN educates no one, and does nothing whatever to address the question in the prior comment.
> Your "anonymized" cell phone GPS data can be used pretty easily to determine when you're not home for purposes of burglary.
Please - PLEASE - find me ONE example of a home burglary occuring under these circumstances.
> Your purchasing habits could cause you to become a prime suspect for a terrorist who used those same items in your area for a recent attack, like if your wife was buying a pressure cooker while you were buying backpacks for your kids doing back to school shopping.
This is just beyond nuts. Stop watching so much television, it's not good for your mental health.
Likely not possible. By definition, these would be successful burglaries that happened when owner was not home and perpetrator was likely never caught.
Remember, the close rate on burglaries in the US is in the low teens - 13% as of 2022[1], and by definition, these were the dumb perpetrators that got caught - the 13% least competent||lucky of all home burglars.
Buying a pressure cooker and a backpack causing you to be suspected of terrorism is nuts?
Oh, you sweet, sweet, naïve summer child. This isn't fiction, it's a story from real life that's happened many times. A cursory search engine query shows numerous examples of this, e.g. this one[2] that happened over a decade ago!
I can't force you to be rationally worried about entirely plausible risks, just keep in mind that your irrational lack of concern for such possibilities only puts yourself at risk.
If I had to hazard a guess, I'd guess you're politically likely to be progressive/left wing. Do you know that's empirically correlated[3] with having less mass in your amygdala, the part of the brain responsible for evaluating threats and risks?
[1] https://www.statista.com/statistics/194213/crime-clearance-r...
[2] https://www.nydailynews.com/2013/08/01/pressure-cooker-and-b...
[3] https://www.scientificamerican.com/article/conservative-and-...
Several personal insults and as for evidence, a single "Long Island woman claims" allegation from ten years ago. Plus a political derangement twist - how exciting!
It is fascinating how insecure a person like you is capable of being degraded to by the same systems you so vehemently decry. It's analogous to being afraid of everyone on the street because they might have a black belt in martial arts.
The government can do anything that is legal.
I people believe purchasing data is a violation of the 4th amendment and it may not yet be illegal but it should be.
That's true, but the federal government has a limited number of things it can do, as specified in our memorandum of understanding between the people of the united states and the federal government. That ought to be the framing under which all federal actions are seen.
To put it another way, for individuals, unless something is illegal, you are entitled to do it. Whereas for the federal government, everything is illegal except that which was made legal.
> CONCEALING A TIP
> One current federal prosecutor learned how agents were using SOD tips after a drug agent misled him, the prosecutor told Reuters. In a Florida drug case he was handling, the prosecutor said, a DEA agent told him the investigation of a U.S. citizen began with a tip from an informant. When the prosecutor pressed for more information, he said, a DEA supervisor intervened and revealed that the tip had actually come through the SOD and from an NSA intercept.
Sure. Easy to object to something secret, which has a carefully crafted cover story. My defense attorney is psychic too. /s
> no judge, jury or trial
> try to live in America
I'd argue corporations persecute people far more often than the government does. e.g. when credit bureaus find out you have cancer your credit score drops at least 100pts.
Government has been evicting people as collective punishment for crimes: https://www.youtube.com/watch?v=3FMZFwnBCbU
Not to mention the government is the one licensing the banks to create money through fractional reserves/the reserve ratio. That's why you're on an inflation treadmill where assets are constantly inflating in price to the point where you need a loan to make big purchases.
source?
I disagree with this assessment. I think it's the other way around -- corporations are held much less accountable than the government.
But neither are being good actors here.
I don't know what the legality of the NSA buying private data is, but it feels like it violates the spirit of the law that says they shouldn't be spying on their citizens.
I don't think this is true. These guys are still around[0] even after garnering their bad reputation.
How is this relevant when the government is purchasing the data on the open market?
>but it feels like it violates the spirit of the law that says they shouldn't be spying on their citizens.
No, the spirit of the law is that the government can't use its monopoly on violence to gather evidence.
But that's not what was discussed. The comment I replied to was talking about "the spirit of the law", which is separate from what the law ought be today.
well, first, companies having this information is inherently not ok to the average person
Second, agencies are purchasing this information with taxpayer money. So we're feeding a market that we may not agree with
Third, government agencies have rules, and when these agencies skirt around the rules or find loopholes, it has a negative effect on that agency. Generally, a population wants their government to have a good reputation and agents of the government are following the rules.
Fourth, and I think this may be the most important: government agencies have the authority and power to do things private companies cannot. government agencies can launch investigations, get legal advice from prosecutors, indite, get warrants, supena, arrest, detain, etc. All are invasive, expensive, and may result in a range of bad things (from paying lawyer costs all the way up to prison).
I sincerely disagree. The average person doesn't care. They should, but they absolutely do not. Don't fall into the hn-bubble trap.
> Second, agencies are purchasing this information with taxpayer money. So we're feeding a market that we may not agree with
If I had a nickel for everything the government did with my money that I disagree with I could quit my day job.
> Third, government agencies have rules, and when these agencies skirt around the rules or find loopholes, it has a negative effect on that agency. Generally, a population wants their government to have a good reputation and agents of the government are following the rules.
Generally, a population just wants to be "fat and happy" and secure. You're falling into the HN bubble trap again.
> Fourth, and I think this may be the most important: government agencies have the authority and power to do things private companies cannot. government agencies can launch investigations, get legal advice from prosecutors, indite, get warrants, supena, arrest, detain, etc. All are invasive, expensive, and may result in a range of bad things (from paying lawyer costs all the way up to prison).
Sure. Otherwise what's the point?
Another way to put it...the government is the only entity in society with a monopoly on the use of force. With great power there should also be a great degree of responsibility.
Personally, I think that if data brokers have it then it is essentially public information. What makes the public information from data brokers different from other public information like your address?
That would be a bit creepy but I wouldn’t be surprised at all if NSA had the data to build this capability. Money seems like a decent but exploitable way to keep all this data from being stitched together privately
But I do agree with your premise: it's a travesty that this data is collected and made commercially available without informed consent in the first place.
> It’s completely capable of engaging in domestic surveillance. And, indeed, it often does! So why would it need to purchase something it can obtain (more legitimately[?]) from its own dragnets and risk having part of its collection techniques exposed?
I don’t think the NSA needs to worry about adversaries learning the technique of exchanging money for information. Hacking the data brokers would cause more potential exposure of proprietary techniques.
My understanding is that one man, Senator Chuck Schumer, blocks any meaningful privacy legislation in his committee. A one man privacy wrecking ball. I read somewhere that his two daughters have high paying jobs at, I think, Meta and Microsoft.
EDIT: my point is that if we had better privacy, then corporations would have less information to sell.
If only because they should be able estimate risk of and prevent criminal activity on home soil.
That’s a feature haha. The largest lobbies are banks and organizations using those data brokers. The government leaves them alone, so they too can use them. It’s a way around laws.
I’d fully expect the FBI or CIA to do this. I’m not even sure it’s wrong for them to do that. At least no more wrong than anyone else that buys it in order to advertise you.
There is no excuse to be surprised by it in 2024.
The NSA is chartered to collect data on communications entering and leaving the US. Decades ago that was completely unambiguous but less so now. Their collection of data on Americans is not illegal depending upon what they do with it. That was the most revealing part of the Snowden releases: insider threats misusing NSA data collected on Americans for personal use.
* Your prior comment never described any malicious depth of data collection.
* I never said anything to the contrary.
* Data collected upon individuals is not the same as data collected against individuals as the later provides intent.
This is just plain false. It is a long-held idea in American jurisprudence that information given to law enforcement by third parties can be used so long as that information was not collected under the direction of the government. https://en.wikipedia.org/wiki/Third-party_doctrine
Why would buying information you have no right to privacy for require a warrant? Police do not need warrants for generally publicly available information, and if anyone can buy this information why not police? Similar to how police do not require a warrant when they ask a phone company for records and the company just gives it to them without question.
If police ask you to search your house, you could let them or you could tell them to come back with a warrant but if you let them they can use what they find.
I don't think they are, by and large. At least, not "consent" in any meaningful sense.
NSA are not law enforcement, so comparing the NSA to law enforcement results in absurd conclusions.
It is perfectly valid for the NSA to buy that data, because the NSA cannot use that data in a way that violates the fourth amendment without breaking other laws.
If the FBI buys that data they need to have probable cause prior to that purchase else all the purchased information and everything resulting from that information cannot be used to prosecute cases. The reason is because defendants have a legally established expectation of privacy on certain electronic communications such as email.
I think we both agree that the law needs to change.
The bigger problem is that cars are required by law to have unique identifiers prominently displayed (ie. license plates), so you had very little expectation of privacy to begin with. Even if your car wasn't connecting to cell towers, a network of license plate readers can figure out your location, and it's unclear why consent would be needed in that case.
I'm not asking whether it is legal but rather should it be.
That being said, one of these is the culmination of tens of thousands of tiny consent violations made by hundreds or thousands of immoral, largely anonymous villians.
The other is one enormous and brazen violation of the constitution, made by a government organization which is funded by citizens to protect and serve them.
Both violations warrant the strictest repercussions.
But with data - sure this post is from a meatspace device registered in my name / but does not indicate I am the actual meatspace person using it.
> According to one landmark study, these three characteristics are enough to uniquely identify 87% of the U.S. population. A different study showed that 63% of the U.S. population can be uniquely identified from these three facts.
If you have a significant online presence, your gender or age might be revealed by the way other users address you on some website. If a website happens to collect gender or birthday, then the website might share/sell the info to data brokers.
If police manage to narrow down the location of a potentially incriminating online action to a household, then the police could physically show up with a warrant and ask about who was using which computer in the house at that time.
[1] https://www.eff.org/deeplinks/2023/11/debunking-myth-anonymo...
https://restoreprivacy[.]com/rtb-data-leveraged-for-user-sur...
If the US govt, if intelligence agencies are doing the same, are we calling this "illegal" or wrong? If so, why? If the US govt were to be doing this with a healthy dose of govt reach, then it would be a violation of law. But they are buying what is already available.
Our country is ostensibly different than theirs precisely because we don't treat our citizens like enemies... as much.
Last week's news: https://news.ycombinator.com/item?id=39136770
Are we really still this naive?
Some highly classified CIA/NSA project needs $10M for data collection, and no one bats an eye.
Snowden revealed that CIA spent $10Bs on "data collection" per year.
2. How would one go about creating fake data that gets collected and sold?
2) This is a wonderful "Hacker-ish" approach to the problem: Pollute the Database! My fear is that in the real (ie non tech-hacker) world, whatever false data my dbPollution script put into the table dedicated to me would be used to target me, and that the argument "No, I didn't make [suspicious searches 1, 2, and 3] - this tool designed to make Law Enforcement's job harder did!" would not be a winning argument with a) Judges, and b) a jury of my normie "peers".
In theory I love it; in practice, it scares the shit out of me.
Maybe it would be easy to sort through, but maybe not
Wyden's demand that companies stop selling our data "without consent" is political bullshit. It just means the companies have to stuff a "you consent to X" in their ToS. Which nobody reads, so nobody will push back on. Business as usual.
Pentest firms do this to show their clients the concerns around data brokers.
Something something US citizens something something unaccountable governments something something secretly breaking laws.
The US State department Exchange Online hack is an example of where "NetFlow" being purchased could be more interesting as an example. IP addresses such as those registered in Russia and to OVH data centres logging into State Department executive mailboxes at 3:00AM in US time zones should be laughably easy to detect.[4] Rented US virtual servers and AWS/Azure/GCP servers outside federal government availability zones would also be trivial to detect as suspicious source locations. The question that purchased "NetFlow" would help answer is what is connecting to those suspicious IP addresses, what is connected to those, what else do the chain of IP addresses found communicate with, etc.[5]
- Worst case there was no one was watching that attack as it occurred over ~4 months through use of "NetFlow" that may have been available and useful to use.
- Controversial case is someone was watching (possibly including attacker's use, if any, of US servers) and decided that it was better to keep watching and following the attackers than to immediately prevent a few State Department emails being leaked.
- Best case (not implemented) would seemingly be to fix terribly configured government systems so they can only be accessed from trusted locations and not random rented virtual server IPs, and "NetFlow" analysis is then probably not required. Security features such as "We've noticed your account is accessing this system from a new ISP--confirm this is really you?" aren't new.
[1] https://en.wikipedia.org/wiki/NetFlow
[2] https://en.wikipedia.org/wiki/DShield
[3] https://web.archive.org/web/20010205010100/http://dshield.or...
[4] https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...
[5] https://blog.torproject.org/traffic-correlation-using-netflo...
If the data is available for purchase, they should buy and analyze it, if for no other reason than to know what everyone else knows.
Making the NSA intentionally blind to available data, seems like a bad thing.
Also, if anyone ever wonders how insidious the government is here’s food for thought — why does the US have such a crazy tax code? Quite literally all your life’s details give you small breaks on taxes - who you donated to, when you donated, why you donated. What property you own, what you did with it, new car? Is it an EV? Does it have power steering? Etc.
It would be far far easier to pass a flat tax or remove most breaks. Interesting enough, they want to track all transactions now to increase tax revenue
https://www.npr.org/2021/10/25/1048485043/irs-banks-taxes-fi...
https://www.cnbc.com/select/irs-600-reporting-rule-delayed/
But again, you don’t keep some of these $50 savings on taxes, then monitor all transactions. Unless it’s for something else