Hacker News Reader

Comment by x1ph0z | Hacker News Reader

What are some ways users can insulate themselves from something like this?

Don't use products from large US tech companies?

Apple has a slightly better track record than Google of fighting this stuff, but ultimately if you're using a product from a US tech company then it's likely ICE can get their grubby little mitts on everything that company knows about you

I'm guessing your constraint is impossible as living in the US pretty much requires banking and working with companies that will gladly give government agencies your information. I severely doubt that tech is the only group doing this.

Is there any evidence that Apple fights administrative subpoenas issued by US federal agencies?

Or is Google just more transparent than Apple about the government orders it complies with?

For example, after the Department of Justice demanded app stores remove apps that people use to track ICE deployments, Apple was the first to comply, followed later by Google.

It's a constitutional right to record them doing their duties, in public. That's clear.

Here's a question: Is making a reporting system around that, for the purpose of/approaches/is realtime tracking, also protected? Maybe related to "non-permanence"?

(references welcome)

Sure it is. The same way it was legal to track and report on CIA "extraordinary rendition" flights using publicly available information.

What is not protected is actual interference or obstruction, and first amendment protections can be lost if the system’s design, stated purpose, or predictable use crosses from observation and reporting into intimidation or operational coordination that materially interferes or obstructs.

Given how these systems are already being used, and the likely intent behind building one, that's a real risk if you're not careful.

> It's a constitutional right to record them doing their duties, in public. That's clear.

Less clear than it used to be https://en.wikipedia.org/wiki/Mario_Guevara_(journalist)

From the wikipedia article: "Guevara was ordered removed from the United States by an immigration judge in 2012"

The removal case was administratively closed on appeal which meant that he was legally authorized to stay in the US while waiting for a green card application to go through.

He was here on a work permit when the police arrested him for filming a protest. Journalism isn't a crime so all the charges connected to his arrest were dropped, but ICE placed a detainer on him to keep him locked up anyway. A judge granted him bond so that he could be released but ICE fought that too and continued to keep him locked up. Finally they reopened the 2012 case and used that to kick him out of the country.

Are they going to stop because a company fights a subpoena? Or perhaps in the case of some touted alternatives, even if a subpoena were acted upon, no data would be intelligible?

Maybe they'll just show up to your house next time. I'm not sure why people complain about US companies complying with US government subpoenas. Isn't that how it is supposed to work? Imagine if the opposite were routine, would you like that?

People want to stop using Gmail to feel agency in a situation where the real problem is their own government. The real answer thus lies in deeply reforming a federal government that really both sides of the aisle (in their own way) agree has gotten too powerful and out of control.

It's more nuanced than "the federal government is too powerful." I feel more like non-law-enforcement agencies like ICE are too powerful right now, but I also believe that the FBI and the DOJ had a good mandate that should be preserved. And I also believe that antitrust needs to be a high priority. Please don't lump me in with people who just want to tear it all down so they can live in a fiefdom. There are good people in the US government, and there are good things about it. It's just not all of it is good and none of us can agree at all times on what's bad here.

If you've had a 100%-tolerance policy to illegal immigration for years then that's the government not being powerful enough, or not using its power to the correct level for its citizens. If there's a better, gentler fix for illegal immigration then everyone would absolutely love that, but it's such a huge thing to tackle due to the previous years' encouraging of illegal migration.

There has not been anything remotely resembling “100%-tolerance policy to illegal immigration” in the US in the last forty years.

The system is clearly breaking. Rather than couching your language in rehashed partisan politics that will only lead to further and more egregious breaks, the best thing you could do is acknowledge these events as a system failure. The safest thing is then to first work to defang the system. This is also bipartisan and more likely to succeed.

Just look at the situation as the founders would. It's amazing a society that came from a generation that engineered their own form of government is now trapped by their forebears' invention. They told us explicitly they were merely men, not gods. When America was founded it was a weak, newborn power of 3 million people who were forced to make awkward compromises mostly to protect the country from being recolonized by European domination. And yet our system of government has remained mostly unchanged from the founding.

Any of you Americans out there worried about a European armada? Or the British burning down the White House again?

America's sister republic - the French - has gone through many more iterations. Your problem is you have no imagination. Regardless of what you think of Trump, he does. He is an avatar for a group of people that understand correctly that what had been the prevailing system was no longer responsive to the times, so they are essentially remaking it on the fly. What is your answer to that, that isn't just lets rewind the clock? You tried that with Biden and the disease became worse.

Do it a second time and I fear the future will bring you someone who makes Trump look like a saint.

ICE is a law enforcement agency.

https://en.wikipedia.org/wiki/United_States_Immigration_and_...

Alternatively, use them pseudonymously? There's little reason any of these companies need to know your real identity. This will both reduce the likelihood of ICE finding your account from a real-life interaction, as well as reduce the likelihood of ICE finding your real-life identity if they do get your account data (they'd at least need to dig through it more than just going by first/last name on the account itself).

> (they'd at least need to dig through it more than just going by first/last name on the account itself).

FYI this is beyond trivial and automated to the nth degree. There is so much more to go off of than some form fields to uniquely identify a person.

For linking activity back to your person? Without name, payment details, photos of face, or IRL social graph the easiest path that comes to mind is IP address. But that's going to involve additional inquiries and is likely ambiguous (unless you live alone, but determining that is again more work).

“allow google to search for devices on your network?”

I’m not trying to be condescending here, but I’m just asking what someone thinks is happening here and what they can do with information scanned on your network.

I don't follow how that's relevant? In terms of the information yielded by an administrative subpoena of an account will that even appear? I'm not clear how the result of the scan is being used.

Suppose the data is retained in association with your pseudonymous account. So now in addition to my IP they have, what, the internal IPs and device names from my LAN? How does that lead directly to me without significant additional effort? I think their best option is still hitting up my ISP to get the billing info and service address of the account.

use it as a thought experiment i guess. your devices will advertise themselves to your local network and are easily fingerprintable to any device with network permissions and talk back a lot more than they should. The only point I’m trying to make is that you can’t fool this kind of with filling in form that’s wrong.

Just off the top of my head:

Here two other devices, that we know who belongs to, daily connecting to the wifi as yours

You can’t do that. If you think you can, you haven’t tried recently.

They all require phone numbers, and they almost all require phone numbers tied to ID-based names. They require CC even when you aren’t buying stuff. It’s very difficult even for experts to achieve truly pseudonymous use.

A prepaid SIM or burner phone can still be purchased no? I believe the CC requirement can be bypassed if you create your Apple ID from trying to "purchase" a free app (or for the accounts that do require payment, I wonder if a gift card can be used).

You’re leaking your IP+timestamp, which is a physical address. Now try making an account from a VPN IP and a burner number.

It always gets tied back to your ID.

> Don't use products from large US tech companies?

What does large have to do with it? Why do you think smaller companies are any more likely to resist? If anything, they have even less resources to go to court.

And why do you think other countries are any better? If you use a French provider, and they get a French judicial requisition or letters rogatory, then do you think the outcome is going to be any different?

I mean sure if you're avoiding ICE specifically, then using anything non-American is a start. But similarly, in you're in France and want to protect yourself, then using products from American companies without a presence in France is similarly a good strategy.

> Why do you think smaller companies are any more likely to resist? If anything, they have even less resources to go to court

Somehow smaller companies do resiste much more. Examples: Lavabit refused to expose Snowden, Purism offers SIM-cards protecting you from tracking ("AweSIM").

No, some smaller companies do. Plenty don't at all. Apple is a gigantic company and known for being super privacy focused, keeping your information encrypted to protect it from governments wherever they can.

So what makes you think size has any relevance here?

> Apple is a gigantic company and known for being super privacy focused, keeping your information encrypted to protect it from governments wherever they can.

I wouldn't trust this marketing. Companies are on the users' side when the competition is strong. Apple is practically a monopoly. See my other comment with examples how it doesn't care about users.

Wild guess: You like Apple more than Google.

I only guessed that because that is a strange conclusion to draw when Apple was involved in PRISM, they worked with China to black pro- democracy hong kong apps, and I believe they turned over data to China and Russia.

Apple's PR/marketing is best in class, so I can also see this just being a knowledge level error rather than bias.

You don't have to like Apple to recognize that they take a materially different stance from Google when it comes to user privacy.

Take this, for example: https://support.apple.com/en-us/102630

You can trivially disable web access to your data; at that point, Apple literally does not have the keys to your end-to-end encrypted data and cannot read or disclose it.

This is not all so straightforward. I'm afraid Apple's "privacy stance" is just marketing, even if they might be a tiny bit better than Google:

https://appleinsider.com/articles/24/04/10/apple-makes-it-re...

https://news.ycombinator.com/item?id=42014588

https://news.ycombinator.com/item?id=43047952

https://news.ycombinator.com/item?id=34299433

Exactly Apple has and will continue to comply whatever is needed to help authoritarian regimes to crush their citizens while Google refused to. It's hard to look at Apple in any other light.

No they do not. Apple intentionally preserves backdoors in the e2ee of iMessage (via iCloud Backup) to aid the FBI.

https://www.reuters.com/article/world/exclusive-apple-droppe...

(the opt-in e2ee for iCloud Backups is irrelevant - approximately nobody turns it on, so everyone you talk to is leaking all of your chats.)

I don't really understand the point in these cases specifically. If not Google, the government can always ask a bunch of other companies like utilities or stores about your details. It's a fool's errand to protect your payment info, ID, etc from the government, since it's issued or authorized by them in the first place.

With regard to more important info, treat Google and any other company's software as government-accessible. Don't put anything that could be even suspicious, since even if you can win in court, your time gets wasted by government employees getting paid for it. People keep forgetting it, but the cloud is just someone else's computer.

As a rule: don't bother with trying to "opt out" of data collection. Reject the collection entirely either by forcefully blocking it (ublock Origin for instance) or straight up not using the service.

QFT

Privacy crash course (non exhaustive):

- Do not use social media

- Install Linux on your PC/laptop, buy a phone compatible with GrapheneOS

- Self-host any cloud services you may need (file sharing etc.)

- Communicate over Signal or self-hosted Matrix/XMPP

- Use throwaway SIM cards and phone numbers where they make sense

- Unplug the cellular modem in your car (if applicable)

- Pay with cash or crypto

- Use fake identities for anything that isn't government related (paying taxes)

- Use Tor, VPNs, and ad blockers

Vote for politicians who support checks and bounds, demand accountability from those in power, and participate in civics.

how naive to think this current administration will play by the rules in the next general election

Be outside the US and/or don't use products from US companies?

Believe it or not, tech companies must comply with the authorities of countries they operate in. They're also not required to tell you, sometimes they're compelled to not tell you.

The idea that a tech company can outright oppose the state is pure fantasy... They still must operate within laws.

don't use centralized services, especially ones located in USA.

also self hosting (mail, contacts, storage, ...)

Reply on news.ycombinator.com