Hacker News Reader

Comment by greatgib | Hacker News Reader

The tech world is really becoming a surveillance nightmare.

Always for the same dubious straw men reasons of terrorism and co, they want to control everyone. Like for banks, the excuse is to ensure that no forbidden foreign actor is allowed the use of the service , but just for that the billion legitimate users will all have to provide their complete justificative info, IPs, and support documents to later be used by the org or gov for whatever reason they will want once they will have them.

Like for banks.

Imagine if the same thing was requested in the real world, like forced to prove your identity when you take gas, When you buy a computer, when you buy a condom.

View on HN

https://wallstreetonparade.com/2020/09/3-count-felon-jpmorga...

> ... secret documents leaked from FinCEN, the Financial Crimes Enforcement Network, a unit of the U.S. Treasury. The documents “show that five global banks — JPMorgan, HSBC, Standard Chartered Bank, Deutsche Bank and Bank of New York Mellon — kept profiting from powerful and dangerous players even after U.S. authorities fined these financial institutions for earlier failures to stem flows of dirty money.”

https://insightcrime.org/news/chinese-money-launderers-mexic...

> While the involvement of Chinese money-laundering rings in handling drug proceeds from Mexico is nothing new, a number of recent court cases in the United States have revealed crucial information about how these schemes work ... weekly pick-ups from representatives of Mexican criminal groups, made in cash ranging between $150,000 and $1 million, with an average of $500,000. These were made in large cities including Chicago, New York and Atlanta ... network of Chinese-owned businesses in the United States and Mexico ... transfer a correspondent amount of money through Chinese banking apps. This happened entirely through the Asian country’s domestic banking system ... “It’s the most sophisticated form of money laundering that’s ever existed,” one of the US sources told Reuters.

Netflix series, "The Laundromat", https://youtube.com/watch?v=wuBRcfe4bSo

And yet my super regional bank will only allow me, a customer of over 20 years, to ACH $5000 per day or $25000 per month. I read that Citibank has ACH limits of $2000/$10000.

There are credit unions with higher Zelle limits, nevermind actual ACH limits.

Switch to a credit union that values your business, they are much more motivated to hook you up with high ACH limits, and I've repeatedly seen them issue loans at rates well below market.

I do have investment accounts with much much higher limits but I wonder for how long.

Just checked my Zelle limits are $1,000 day, $2,500 per week, or $10,000 per month

Ha they actually only say it’s for kyc aml or security measures but really it’s because they don’t have the money and can only stem a bankrun by gating withdrawals at all times

First republic bank imploded so fast because their niche was convenience in not having limits

All the banks have the same problem, they’re holding us treasuries with customer deposits at a huge loss right now. the regulations say they don’t have to disclose the current market value of government bonds like us treasuries, so as long as they never need the money they’ll get it all paid by the government over time, but if they ever do need the money sooner they’ll have to liquidate the bonds at their current market value and never have enough to pay everyone.

My advice, have accounts at minimum 2 banks at all times. Doubtful you will lose money, but you can lose access to your funds\paying bills for a short time, plus any bank, at any time can choose not to do business with you.

There’s a liquidity angle, but there are other angles, too. A bank owes no duty to, and thus cannot commit negligence against a non-customer.

How many bank accounts you want depends on you, but two seems awfully few to me.

The strongest incentives for surveillance are actually in the private sector: the need for internal KPIs, selling data, targeted advertising, product and sales funnel optimization, and now AI training data.

The government pushes surveillance too but in my experience it’s the secondary driver, at least in the US. Might be different in other countries.

I’m really pessimistic about privacy online given that every single incentive both public and private encourages maximum privacy invasion and centralization. I mean every single incentive. It’s almost impossible to resist.

We might have a chance if end users cared enough to pay for privacy and avoid things that invade it, but very few do. Most people care about convenience, features, and cost, and that’s it. Nothing else matters.

It's not that people don't care about privacy tbh. But they do indeed care about convenience, so when they're presented with the artificially created choice of corporate surveillance hell vs privacy-enabling options that are by and large put together by a few enthusiasts with meager resources, it's no surprise what the end result is.

But make no mistake - we could, as a society, invest heavily in developing privacy-first platforms and software, and have it all. I can't even say that we choose not to; it's more that representative democracy is not particularly representative in practice, and mostly works as a form of veto.

I don't think the choice is "surveillance vs privacy", but rather "free-with-ads" vs "paid-with-privacy"

People choose to watch youtube with ads rather than pay for youtube premium without ads.

People buy the kindle with ads on the lockscreen over paying $20 or whatever more for an ad-free one.

When given the choice of a $3 app store app with no ads vs an identical free one with ads, users pick the ads.

Picking ads is effectively the same as choosing a lower price (free) over privacy, and people seem to consistently pick in this direction.

Because of that, I don't think it's fair to say that users aren't actually making any choice here. Users are choosing free services over privacy.

People pick ads, it is true. They do not explicitly pick "track you everywhere to build a hyper-accurate profile of you that can then push precisely tuned ads at you", though. That part is buried in the EULAs.

You cannot buy privacy with a credit card. You tie your identity to an account when you pay for it.

Ads are orthogonal to privacy. We've had privacy-preserving ads in physical newspapers for hundreds of years.

There is no reasonable way for a normal person to consistently choose privacy these days.

I have never heard of an ad-free lockscreen on Kindle and I pay for Kindle Unlimited. So I have to pay even more to get ad-free, if that's even possible. And I'm sure that's just for Kindle. Need to cough up a few more dollars for ad-free Prime Video. And ad-free shopping on Amazon. And that's just one service. Can't wait to hear what I'd need to spend for the same if I used Facebook, Instagram, WhatsApp, and a Quest even though Meta owns all of them. And I can just imagine the hellscape Microsoft will create when you have to pay a subscription fee to use Windows 12 Home With Ads, as your baseline option.

The average American isn't exactly awash in cash to spend on privacy, you know.

It's not an artificially created choice. It's a market created choice. People won't pay for software, so the privacy-enabling options are put together by a few volunteers with no funding.

We are not talking about a lot of money in most cases. I usually compare it to coffee shops. People will pay $10 at a coffee shop for a latte and a snack, but they refuse to pay even $5 for a software app or game that they might use every day.

It doesn't have to be left to the market. Given the current state of affairs wrt market oligopolization, especially in tech, it probably shouldn't be, at least not for the kind of basic software and protocols that the majority of people use daily.

One of the leaders in dystopian social engineering, the United Kingdom, wants a KYC for watching porn so you're not far off. Oi mate you can't do that without a loicence!

I mean they already have it for public transport. They don't allow cash, so they can track your movements everywhere.

No need to look across the pond, Louisiana and Utah both require id checks to watch porn.

And soon you may need one for regular old Twitter and Facebook since we want to keep the kids safe right?

> Imagine if the same thing was requested in the real world, like forced to prove your identity when you take gas, When you buy a computer, when you buy a condom.

There's no need, there's fifty security cameras and phone trackers already doing it that may not even require a warrant to access.

> The tech world is really becoming a surveillance nightmare.

Becoming?

Stalkerware, data brokers selling women's information to the Gilead apparatus, Palantir... none of this is new, and present much greater threats on a day to day basis than this.

What do you think central bank digital currencies are about? They can tie your identity to your wallet. Then you have to validate your identity to access the wallet.

(There’s worse stuff, like they could decide only 10% of your budget can be used on gas. Or force you to pay higher taxes as a carbon credit, etc etc)

This also looks like more moat and regulatory capture for existing IAAS providers.

always_has_been.jpg

> The tech world is really becoming a surveillance nightmare.

Most definitely was not.

30 years ago maybe.

KYC/AML is not some made up concept in order to further some conspiracy. There is genuine harm caused by money laundering and the fraudulent use of the financial system by bad actors.

Likewise anonymous use of shared infrastructure is a central part of the scam/spam/malware ecosystem which costs the global economy $10+ trillion a year.

At some point given the impacts to the most vulnerable in society we need to simply ask that people prove who they are.

KYC and AML do very little to actually address any risks related to money laundering. But they’re very powerful tools that banks use to push their customers around and control how they use their money (somehow usually in ways that benefit the banks of course).

Could you offer a few examples of such limitations which banks impose, and how it benefits them?

1) Float. Every dollar that is held in limbo 'for checking' is interest income to the bank. 2) Rabid identification requirements lower the risk of new account fraud (which is paid by the bank). 3) Information on who you're sending payments to is usable by the bank for prospecting and risk analysis. 4) If you read anything about regulatory capture, it explains how regulation is used by incumbents to discourage competition. i.e. No new banks have opened in the U.S. since 2009, when new regulations to prevent banks from getting bigger were passed. <- And now, the biggest banks are MUCH larger.

> No new banks have opened in the U.S. since 2009

From 2009 to 2013 only 7 new banks were formed, fewer than 2 per year.

Many industry observers have suggested that the decline is primarily due to regulatory burden, including new FDIC regulations and the 2010 Dodd‐Frank Act. But other influences could have played a role, in particular, the current weak economy.

https://www.federalreserve.gov/econresdata/feds/2014/files/2...

Banks don’t want you to do anything that reduces their deposits, because they directly lose money when that happens. If you had $1 billion in deposits at a bank that was getting 5% returns on investing its deposits, and you wanted to spend that money on buying some securities or something, then that bank would generate approx $1,000,000 in returns for every week that the AML process takes to complete.

Due to how fractional banking works, in reality they would be earning some multiple of that return rate, but that’s a bit more abstract and hard to quantify.

Because AML processes are completely opaque, often made up on the fly and operate without any due process, banks can and routinely do delay transactions worth multiple billions of dollars for many weeks or longer by asking lots of irrelevant questions, requesting new documents or minor changes, and taking their time in getting back to you about anything, ect... In the world of high value transactions these kafkaesque processes and delays are completely routine.

> KYC and AML do very little

This reminds me of when people say, "those stories of street crime are exaggerated." It's content-free. And "any risks related to money laundering" is rather dismissive, isn't it?

Are you denying that actual criminals have a problem with moving money around except in $100 bills and other tangible assets?

I would say that PETTY criminals have difficulty moving money around electronically. Criminals with LOTS of money do not have any difficulty finding an investment bank to handle money movement. i.e. Epstein JPMorgan, WireCard, Lloyds https://www.reuters.com/world/uk/lloyds-says-it-faces-money-...

AML laws are just a compliance cost of actual money launderers. All they do is increase the number of intermediaries involved in a transaction (who each collect their fees).

Even if that were to be granted for the sake of argument:

why is it a bad thing to make criminals expend more effort and money?

Embedded within our justice system and the values of our society we have the concept of the protection of the innocent. See William Blackstone's famous quotation: "It is better that ten guilty persons escape than that one innocent suffer."

If you want to imprison all the murderers, you can accomplish that goal by imprisoning everyone but we don't do this and most people would recognize that the idea is mad.

So the test here for any regulating authority should be, is your regulation harming the innocent in some way? If so, the imperative is on you to find a better way to go after the guilty, if you don't you have become an enemy of the public good and your moral authority is lost. We can get into specific regulations but I think with modern KYC and AML we are absolutely at the point where they contribute to the suppression of economic growth and individual liberties and need to be dialed back.

Very well said. It should also be said that criminals that want to launder money only exist because of government regulation. Sometimes that's totally justified, say with human trafficking, and sometimes not so much, like maybe a marijuana dispensary.

The point being, sometimes undercutting criminal activity can be done be legalizing the activity rather than introducing more types of illegal activities to try and detect the original ones. The cure is sometimes worse than the disease.

That parts fine, it's the collateral damage that's the problem. Laws don't know who're the bad guys and who are the good guys, and sometimes everyone else gets caught up in the dragnet. By all means, stop the bad guys, but unfortunately, they don't easily identify themselves, so we pass laws and apply them to everyone (in theory), but they can end up doing more harm than good.

The $10k rule by the Bank Secrecy Act wasn't indexed to inflation and would be closer to $80k today. So it should be amounts up to $80k that aren't considered worth monitoring, but instead, if you deal with, say, buying and selling cars, you get tripped up by that all the time. It's regulatory red tape overhead that costs a legitimate business extra time money that they could be better spent elsewhere.

For the every criminal there are thousands of people getting.. KYC'ed over minutiae.

And even you yourself answer the main question - it doesn't stop criminals. Just makes it more expensive.

what is that link supposed to demonstrate? Lloyds is facing an investigation. So?

As for "Criminals with LOTS of money do not have any difficulty finding an investment bank to handle money movement" what is your evidence for that? And what's the line between "petty" and "LOTS of money" ?

I have multiple ACAMS certifications (the trade group that certifies all of us Anti-Money Laundering personnel who work at banks). And no, the public can't apply for membership. 1) Search WallStreetOnParade.com and read all of the articles about laundering. 2) Read the Mary Erdoes and Jamie Dimon depositions about Epstein involvement. JPM was putting Epstein's bribes through to the Governor of USVI. JPM was 'forgetting' to file the mandatory SAR notices on the $5MM in cash that Epstein was withdrawing each year for victim payments. 3) The Yakuza (as written in Tokyo Vice - the book) use privacy laws to prevent any of their businesses from being tied to them. 4) Read Butler to the World: How Britain Helps the world's worst people launder money.

Where I live there isn't just one bank.

So customers can very easily move their money and business elsewhere if they feel like they are being somehow controlled. And as someone who has worked at two banks almost all of those restrictions derive from the government.

> So customers can very easily move their money

For retail and SME customers this is true. But for any customer that deals with large sums of money it is not. If you’ve never heard of an MT730, then you probably have good reason to think that moving money around is easy.

You're dealing with large sums of money and you want to remain anonymous.

Sounds like exactly the sort of entities that the government should be investigating.

Where did I say anything about anonymous? I do some work with an AML consultancy, and I’ve never even heard of a customer who wanted to be anonymous.

But your reaction of “must be a criminal, let’s investigate you” to my complaints of banks abusing your power leads me to 100% believe your claim of having worked in banks before.

Ah yes, "if you want to be anonymous while doing X, you're probably a criminal". That's reductive.

This is about KYC for servers. There are plenty of reasons to think that this will be completely ineffective because foreign providers are under no such obligation. It's also incredibly misguided because the providers that generally harbor abuse are overwhelmingly in foreign countries - no one is starting a bulletproof host in the US. And given that providers will likely only implement the minimum required KYC, it is not even going to be as sophisticated as selfie verification. Which means in the event criminals do want to use a US hosting provider, they will use a $5 fake ID Photoshop template like they always have or pay $15 for a premade account. Even if more sophisticated verification like Onfido is used, that will raise the cost of getting an account with a fake ID to about $150 (that's the price of most crypto exchange accounts on fraud forums).

Also, little barriers to entry like this are the kind of things that discourage initiative and make our economy slightly less competitive. When I was a teenager I wrote Linux tutorials on vultr.com for $50 each to be credited to my account, which I used to pay for hosting before I had a debit card. I had no drivers license so if I encountered some dialog asking for an ID I would've just clicked away and been disappointed. There are 17 year olds running hosting businesses on lowendtalk.com - should their $1000 a month in revenue business be expected to consult with a lawyer to write a 40 page customer identification plan?

You need a local business license, but most people doing stuff on the internet don't know or bother.

People in Los Angeles get a shock when they find out the city wants it percent of global sales.

The penalties for violating that are also not very high at the scale of small internet businesses. Violations of the proposed rule are treated as violations of IEEPA which is far more serious.

> foreign providers are under no such obligation

What happens with foreign financial institutions which don't implement KYC or otherwise play nice? I'm really asking; I remember when I was young that "swiss bank accounts" were famous for shielding account owners, but my understanding is that's no longer the case.

My first thought here was, what happens when the US decides that network providers doing business in the US must blackhole Hetzner or whatever because they aren't implementing KYC.

I mean, it's conceivable that could happen down the line but it would break most of the current Internet. Also the rule explicitly says its for US providers. However, the government really loves the extraterritorial enforcement angle as of late so I get the feeling they'll eventually try to apply it to foreign subsidiaries of US companies.

It’s typical native tech thinking that legal issues can be solved by technology.

USA has a lot of experience how they can influence foreign providers by making it increasingly difficult for them to do business with any USA entities. It’s not bulletproof, but nothing is. As long as USA has dominant position in the world, their influence is huge.

Reply on news.ycombinator.com