Swedish data brokers claim journalists' legal protection to evade EU law | Hacker News Reader

Swedish data brokers claim journalists' legal protection to evade EU law

noyb.eu

72 pointsdotcoma69 comments

Noyb.eu is right here, the (extreme lack of) privacy laws in Sweden is out of tune with modern technology, and the fact that you can pretend to be a journalistic endeavor compounds it.

Moreover, this situation by extension could threaten the vital protection that (real) journalists must have, like protection against having to disclose their sources etc. That is, if the law is misused in this way, someone will surely get the bright idea that the law must be thrown out in its entirety.

> the fact that you can pretend to be a journalistic endeavor

Isn't that the core of the issue? Who decides what is journalism?

MrKoll is mentioned in the article but there are identical databases that originally were used to track the political opposition and are now partly accessible for selected "journalists", among others. Should those databases exist because they make their own rules on who is a journalist? What about a user posting a comment on Reddit or Flashback that used MrKoll for the information? Is that journalism, making MrKoll a journalistic database?

This legal battle might have a major impact on Swedish newspapers.

> Isn't that the core of the issue? Who decides what is journalism?

There are several issues at play here I think, but to take one: Who decides?

As long as journalists enjoy certain judicial privileges it is natural that the democratic state grants these certifications. This is not controversial in Nordic countries as it might be elsewhere.

Journalism has a well defined meaning in language. The concept has been interpreted extremely liberally up to now in Sweden. This can be carefully tightened without trespassing into undemocratic territory. The alternative - that anyone can register as a journalistic business without any certification will likely result in those privileges being removed. This is the real danger here.

I don't know how this would actually fix anything. You can get the same information on a person by simply calling the tax authorities since it's public information in Sweden. MrKoll is just publishing it on a website.

Perhaps this is more security by obscurity but making it easier on criminals to find your personal information is not necessarily a good thing.

Imagine being a criminal and now you want to find your victim's personal information and you directly call Skatteverket...

Less compelling than going to hitta.se from a public, open wifi network

> making it easier on criminals to find your personal information

This can also work to the victim's benefit: any information publicly accessible from these records is automatically unsuitable for identity theft and the likes. If e.g. a tax ID number is in these records (no idea if that's the case), some company asking for that number to establish authenticity/authorization won't have any ground to stand on if it gets called into question.

That said it's probably possible to make inferences, i.e. knowing what company someone works for might make it possible to guess security questions (e.g. "what was your first boss' name?")

Social security number is public information as well and it's never used for authentication so you're right. You normally identify yourself using BankID, which is issued by your bank and tied to your phone.

Identity theft is still possible but requires much more intricate methods.

Having information be public on request (e.g. from courts) is important. But the step from making individual bits of information public via request from authorities, to making it indexed/published/searchable for anyone in the world through a private company is quite a big one. This privacy/security by obscurity you get from having to fill out forms or call a court isn't something one can just argue doesn't mean anything because public-vs-nonpublic is the only measure.

When you call the Swedish tax authority to request information, you are not permitted to retrieve more than a handful of records within a time period. And you are not allowed to search: you can only query records for people that can be directly identified, by e.g. name/address or social security number.

These companies have a copy of the database.

I recently learned address is public information in Sweden so provided you have the name then getting access to tax info would be trivial?

It is. Of course the bank checks my income for the last few years before it gives me a loan. I also recently got a possible employer to admit that he checked my preceding years taxed income before giving me an offer.

The government would have records of such requests, so one assumes a person could request to know who has requested their records. Once they utilize their rights under Article 17 GDPR that data brokers delete their data and notify all recipients of the deletion, one could at least know who is stalking them.

> Personal data used by gangs and criminals. One example of what the public sale of data by companies like MrKoll can lead to is illustrated by a “Guardian” report about rival gangs using data brokers to learn the geographical location of their opponents to carry out attacks.

I remember reading that Guardian report when it was linked here on HN, at https://news.ycombinator.com/item?id=39334413.

As I complained then, it gave no evidence that gangs used data brokers to get this information, only writing "Experts say criminals are being greatly helped by a 248-year-old law, forming part of Sweden’s constitution."

Who are those experts? Where is the evidence that the bombers used a data broker to find their target, or that removing this information from the public would have changed anything?

What I want to know is: who wants those data brokers to exist?

And if those data brokers became owned by Chinese or Russian entities, would that change the answer?

Employers. Not too long ago you could Google my name, the first result was MrKoll and an exclamationmark on my name.

You could then pay 10$ and get access to my legal history involving minor possession of drugs and DUI.

Now all my relatives know...

Yep this is pretty fucked, we also have our taxation calendar available for anyone to look up my declared income.

These systems and laws of openness worked great before the Internet, you'd have to call every court in the country to request access to my full legal history, and call the taxation office about my declared income. Now it's just 10$ away from anyone curious

You get a notification when your data is accessed, and by whom?

No, unless it includes a credit score. These companies are shady and don't follow the law as intended. They would need your permission to store the data in the first place. Hence the journalism "workaround".

Proper background checks for criminality are done by the police, who hands the paper to the person the check is done on, and can only be done for roles for which the police are allowed to do those checks for. Like banking and teachers.

No.

The idea here is that the workings of the public authorities should be open to scrutiny. Hence, all documents (correspondence, working documents, the lot!) are public, except those that are explicitly made secret, and it takes national-security level issues to do that. The authorities are not even allowed to ask who’s asking.

The first problem is that even material on individuals, collected by the authorities, becomes public.

This generally went unnoticed for a couple of hundred years, as you still had to know which documents there were, go around and ask whichever authority held the documents, and probably pay at cost for copies. Now we have the Internet, which has led to the second problem. Several data brokers have started to request all data there is, and then index, repackage, and sell it on the Internet, drastically lowering the threshold to request all the juicy stuff on anyone. Now, that is obviously against the GDPR, but the law allows anyone to become a journalist, who play by different rules, by saying "I am a journalist!" and paying a token fee.

So, to summarize: Openness, intended to keep tabs on those in power, and which has historically been somewhat tamed by practical barriers has, those barriers torn down by the Internet, become uncomfortably open.

Oh right, I get it. As an Italian we always spoke with admiration about this transparency regarding tax, but I always thought the request and the requesting party was also annotated and made available. What you describe is fairly blunt and alarming.

It certainly shouldn't. It's just public data, that anyone from any nation could both access and provide.

I don't mind these services and I think the recent development where they are blamed for enabling the violence is just a stupid distraction. The domestic terrorists we have would certainly still be a problem and would hardly stop their attacks if we got rid of our very useful public data laws.

The current politics are working hard on removing all the fundamental data laws of my country, beginning with making massive energy rebates confidential last spring.

Regarding electricity tax returns, not making the names public was a very good idea because of course some newspapers had headlines like "Look at how high tax returns some rich bastards got, it's a scandal, they could never use that much electricity just in their private homes!" the day after the anonymized sums of the tax returns were made public. Which just showed the ignorance of those journalists, because private taxes are much higher than corporate taxes so why would anyone want to pay privately for electricity used by a company? Nobody applied for tax returns, the sums were based on how much they had paid in electricity taxes. And companies got the tax returns too, just a few months later.

One of those who got high private tax returns came out publicly and explained that his company was of the type "enskild firma" which means that it uses his person number, it's not a limited company. And apparently Skatteverket had treated all companies of that type as if they were private citizens. But of course most people just remember headlines, so if the headline had been "Look at person XX, that rich bastard got this much in tax returns!" you had probably remembered that but not the later explanation that it was his company that got tax returns.

The idea with this temporary relief was to help home-owners keep their homes warm during the first winter of the Russian invasion of Ukraine.

Many mechanisms could have worked for this purpose. A fixed amount for instance. Or an upper limit on a tax cut. Remember, the idea was to keep a typical home warm.

Instead there was a tax cut with no upper limit. So the affluent heating outdoor pools in the middle of winter also got relief, not just home-owners on the brink of ruin trying to heat their old house. In the big scheme of things, probably not a big deal, but interventions by the state should appear (and be) as fair as possible, lest people will loose faith in the system.

If the only idea was to help home-owners keep their homes warm then companies would not have gotten the same tax returns. This page lists the reason for the tax returns as "För att stödja elkunderna ekonomiskt och för att mildra effekterna av de höga elpriserna har EU infört en tillfällig möjlighet att använda de så kallade flaskhalsintäkterna för ekonomiska utbetalningar till elkunderna.". So general stimulation of the economy seems to also have been part of the reason for the tax returns.

https://www.regeringen.se/regeringens-politik/energikrisen/e...

> who wants those data brokers to exist?

Some employers and recruiting firms, to do background checks. I think they more or less funds the market.

I’m not sure anybody really wants them to exist (except themselves, obviously). Current law, more or less by accident, allows them to exist, and since this touches on the principle of openness in public administration, which is a bit of a holy cow here, any changes are unthinkable. My guess is that this situation will persist until slightly after it becomes completely unsustainable, at which point everyone will suddenly have been advocating for a change for the last decade.

I found this other article which mentions "Ransomware-as-a-Service Gangs" [1]. I think the meaning of the word is "group of people engaging in criminal behavior", not necessarily "a group of gansters", a.k.a "street criminals".

In addition to that, police uses data brokers information regularly, and there's plenty of evidence of it. Example from the first google search page: [2]. Whether or not you consider them to be "just another gang" is dependent on your personal opinions and how corrupt your local police force is.

[1] https://www.securityweek.com/access-brokers-and-ransomware-s...

[2] https://issues.org/data-brokers-police-surveillance/

... okay, but how is any of that relevant?

The Guardian article was about a bombing of the relative of a gang leader, which also killed a woman living nearby. The implication was that public name->address lookup played an important role in that bombing, so should be curtailed in order to prevent similar future events.

My complaint is the article presented no evidence supporting that implication.

This linked-to page uses the Guardian article to support their position, but I don't think the Guardian article has any substance.

FWIW, Sweden is one of the countries which requires you to register your address with the government. The Swedish police already have the name->address information and don't need a data broker for it.

The Swedish government doesn't check that the registered address is correct, and if someone you don't know chooses to register at your address then you won't know about it, and even if you did there's no way for you to get rid of that registration. There has been cases of police breaking down doors and rushing in to apartments just because some criminal had registered himself on that address, even though the people who lived there had never heard of that person.

The Internet is not only bad — it is now possible to sign up for notifications when somebody registers at your address (it’s on the Skatteverket web, somewhere). However, Sweden being Sweden, I suppose you will still have to prove that they do not in fact live there to get rid of them...

Made me think of the opposite problem - in Spain you have to prove that the people who live in your house shouldn't, really. It can take years to evict squatters.

It's partly a different issue.

In the first one, you have someone registered at your house despite not living there. Getting notified about it doesn't solve it though. You still have to report it as a crime and then they will investigate before fixing it. Due to all the bombings, they implemented a speed track a few years ago when gang members are involved (so they don't blow up your house during the process) but I still believe it takes months to solve.

In your case, you have physical squatters. Then you need to take it to court and prove that they shouldn't have access to your house. It takes many months to sort out and they can claim that they have an agreement with you. This was major news in Sweden about 5-8 years ago when waves of EU beggars were making camps on people's land that cost a ton of money to clean up afterwards.

They don't need the data brokers. You can just call up the tax office on the phone and ask for someones address or person number. You get it, no questions asked.

The article is very confused about this. There are two separate issues:

1. the principle of free information ("freedom of information" in the US is super weak compared do Swedens much older laws)

2. Doing stuff with this data on a large scale and in bulk. This is where data brokers come in. This is also not needed for the gangs.

Well, of course having everyone's address publicly available greatly helps everyone who wants to find out someone's address (for whatever purpose). I don't think you need experts (or evidence) to come to that conclusion...

I mean, this Swedish openness is nice (and I wish some parts, like salaries not being secret, were adopted elsewhere too), but your address being publicly available is an anachronism, like the phone books that used to contain everyone's phone number, and will eventually have to go.

Thing is, the linked-to noyb piece doesn't even characterize the Guardian article correctly. This piece says: "a “Guardian” report about rival gangs using data brokers to learn the geographical location of their opponents to carry out attacks".

The Guardian piece says "reports at the time said it could have been a neighbour related to a gang member."

That's the location of the relative of their opponents. And "could have" indicates uncertainty. Has the investigation since then determined why the bombing took place, and if a data broker or public data was at all relevant?

The Guardian piece only conjectures, yet noyb seems to think it's a solid foundation. This makes me distrust noyb's ability to support their position - making a mountain out of a molehill.

For that matter, how did the bombers know that gang leader had a relative, and that relative's name? Is one's family tree information also public in Sweden, or did the bombers know it from some other means? Like, did the gang members grow up together before joining different gangs, so knew each others' extended family?

In that case, public access to the data would be irrelevant.

Salaries aren't public I believe. You can see someone's taxable income. If you work one single full time job, the figure would probably be close to the total comp however. But for e.g. someone who works two half time jobs you can't see which employer paid what, only the taxable income (iirc).

I don't know if this is going to help you answer your questions but here is some background information: 1. In Sweden you must be registered at an address for all purposes (taxes, health care, official communications, etc.). 2. On websites like MrKoll's, all you need is a phone number to find someone's home address (you can also find someone's phone number using their home address).

Based on these two facts, all the bomber planning the attack needs is a phone number to find out the address. If the victim is using a burner phone (which, by the way, have become illegal in Sweden since 2023, now all "kontantkort" or anonymous simcards can't be anonymous, they have to be registered to someone's name, and you can only do that with a valid ID), they can otherwise target one of their family members.

> Where is the evidence that the bombers used a data broker to find their target

The writing is on the wall. This is a free service. Why wouldn't they?

> removing this information from the public would have changed anything?

The problem is that these companies (like MrKoll there are others) are abusing the media license they have been granted, not only violating rights that have been well established in the EU (which Sweden is a part of) but also they are making an already vulnerable population even more vulnerable.

Grandmas and Granpas are being targeted by scammers with all sorts of schemes, and where do they get phone numbers and also a quick profile of the target? via these websites.

So yeah, removing this information from the public would change something, perhaps not necessarily to the gang wars, but for sure for the safety of the public in general (gang family members would be harder to find).

Phone number? Heck if you know their first name, city of residence, and approximate age that's already enough in most cases.

Didn't most countries have phone books where peoples names, phone numbers and some times address would be listed? And weren't those phone books usually quite complete? Were they opt in then so that phone book sales people asked you to list your number? (Swedish phonebooks were opt-out). Were you offered any kind of compensation then for allowing your number/address to be listed there?

Let me be clear. These websites list your full name, date of birth, main address (including the exact apartment number if you live in a flat), your flatmates if any, the size of your apartment, and the average salary in your neighbourhood. Comparing this to a phonebook entry is a bit of a stretch. Also, obviously, you only appeared in the phonebook if you had a landline.

Swedish phonebooks were definitely opt out for both mobile and land line.

> > Where is the evidence that the bombers used a data broker to find their target

> The writing is on the wall. This is a free service. Why wouldn't they?

Did they use information at the library to learn how to build the bombs? That's a free service. Why wouldn't they?

Let's shut the libraries down too. Only people with enough money to buy books, and to pay for street informants, should be able to bomb other people. It'll cost you, what, $100 to have someone trail someone else home? There's no way a bomber could afford that.

Now with my tongue out of my cheek - if the bombers knew who to target because some of the gang members grew up on the same neighborhood so knew where the relatives lived, then making this information private wouldn't change a thing.

A site dedicated to strong privacy laws should use strong arguments to support its claims, not a mischaracterized third-hand (a Guardian writer describing Swedish news reports about police and neighbor statements) news report that may actually have nothing to do with the topic.

A thing not mentioned in the article is that most of the example data is also available directly from the authorities. Not as easily accessed perhaps. However, these services also keep data not available like old convictions. There are other lawsuits regarding that.

as a swede, thank you noyb for messing with this

What stood out to me most is the existence of a "media license".

Wouldn't letting the government decide who qualifies as media go against the idea of free press?

Just get rid of that nonsense. No more problems.

It's in the constitution. If you register as a publisher (ansvarig utgivare), a different set of free speech laws are used (freedom of press).

This is probably the "license" they're mentioning.

Ironically, Sweden has the world's first Freedom of the Press Act. It's even been designated a "Memory of the World" by UNESCO: https://unesco.se/tryckfrihetsforordningen-utsedd-till-varld...

What you're asking for will not be easy to enact. In a monarchy, the concept of "natural rights" remains somewhat culturally foreign.

> In a monarchy, the concept of "natural rights" remains somewhat culturally foreign.

How do you figure? The monarch is just a symbolical position. It carries no political power.

> Just get rid of that nonsense. No more problems.

What the license in question does is that it makes the publisher potentially liable for publishing stuff that shouldn't be published rather than the journalist for writing it. That license is not the problem.

Hi, I'm a journalist. I’ve found your passwords and social security number. No need to ask how. Do I have the right to sell those to anyone who wants?

I don't think you'll get much for my personal number (the equivalent of the US social security number). Anyone, including you, can call the tax office at +46 8 564 851 60 and get it for free.

Profiting off a secret password is not intrinsically illegal.

The journalists David Leigh and Luke Harding famously made the WikiLeaks password "SplinterItIntoAThousandPiecesAndScatterItIntoTheWinds" public when they included it in a book. https://en.wikipedia.org/wiki/WikiLeaks:_Inside_Julian_Assan...

They didn't get special permission to sell that manuscript to the publisher.

Besides, all of my passwords contain secret information concerning Swedish defense installations, making them illegal for you to publish. /wink

Why should journalists have different legal protections than non-journalists anyway when all a journalist is in 2024 is someone with a twitter or substack account

I actually think this is a beautiful thing with GDPR. Because technically platforms like Facebook could just consider themself a Publisher and then they wouldn't have to bother with the GDPR. But that would also mean that they would need to have a chief editor personally responsible for all the racism, hate and abuse on the platform. So the reason they they have to deal with the GDPR is because they don't want to take responsibility for all the shit published. So how much they may hate GDPR – they hate taking responsibility for their content even more.

Not that you said it, and maybe I'm wrong but I don't think they have any philosophical preference, this is probably a calculation between the cost of implementing features to make existing systems GDPR compatible vs hiring a magnitude more content moderators plus whatever perceived impact they think they'd have on user retention if there was way more moderation which will also have loads of false positives.

I think when historians look back on this period of history, they will have interesting things to say about journalists, their extra rights that other citizens are not afforded, their immense power, and their complete lack of accountability.

This is absolutely appalling. I can't believe such blatant violation of privacy and human rights is happening in Sweden.

The article is quite confused about how Swedish law has worked for hundreds of years. Address, person numbers (which encode birthday), income, these are all public records. Have been for over a hundred years. It's not a big deal or scandal. In combination with our freedom of information laws (which actually are that, unlike the ones in the US that are super weak), these make it quite easy for journalists to find and expose corruption. For en example read https://en.wikipedia.org/wiki/Jan_Guillou#The_IB_affair

The problem I see is companies harvesting these records and profiting from making them available over the Internet. Maybe just add a rate limit to how many such requests a single entity may apply for?

That's how the state does it yea.

The word "Stockholm syndrome" has never been more appropriate.

Open information makes societies more efficient, it isn't only a bad thing. There isn't much bad you can do with that information since every system assumes it is open, most of the bad things that can happen with such information comes from the assumption that it is private so companies starts to use it as proof that you are you.

Can I have your home address and payslips for the last 20 years? Please respond with this information directly below.

Neither are public information. The current registered address is, amount of taxes paid - yes, these are public (although for the latter you have to pay some very small fee, IIRC).

I don't know about you, but for the vast majority of people their "current registered address" also happens to be their home.

I believe it varies between countries. Where I live the actual address does not really matter for most intents and purposes, what matters is one's registered address because that's where paper post goes, and more and more people use e-post even for government communications. Where my parents live it is actually quite common to _not_ live where one is registered, especially among younger generations, this is because police first comes after you to the registered address, and police in that country is often more dangerous than "no police". So I do not speak for the "vast majority" but for the people around me.

Case in point: if you are well off enough to rent or own multiple properties you have the privilege of not being doxxed by these brokers.

Tell me again how knowing 18 year old Sven Svensson earning $10k a year at a part time job and renting in flat B69 is oh so essential for an open society again.

Yes, I wouldn't mind. But i also won't take the time for it. Go look it up yourself. My id: 8202192491

That reminded me that person's data can be hidden if the person asks for it. Does not happen often, but my ex-neighbours did it.

You can look it up yourself you know. Quite easily in fact.

I don't think the public nature of these figures (like, my address, or taxable income) is even contested here. Or, that would be a different discussion.

The question is rather whether pieces of information which is public from authorities (Some which are common in many countries such as court records, others which are more unique to Sweden such as addresses) should be legal to index and make searchable, at third parties. This is where the GDPR is an issue.

And I agree strongly with noyb here. I can't see how any of these companies have any journalistic goals.

Reply on news.ycombinator.com