Hacker News Reader

Comment by jedberg | Hacker News Reader

We need a law that says if you hold any data about a person, they must be notified when anyone accesses it, including law enforcement.

I used to work in criminal investigations. I understand how this might make investigation of real crime more difficult. But so does the fact that you need a warrant to enter someone's home, and yet we manage to investigate crime anyway.

Your data should be an extension of your home, even if it's held by another company. It should require a warrant and notification. You could even make the notification be 24 hours after the fact. But it should be required.

View on HN

The entities holding the information here are literally police departments. The information itself is evidence, used in active criminal investigations. It's good to want things, though.

I know, that's why I said "including law enforcement" :)

So we're clear, you believe there should be a law that, when a police department collects information about you during a criminal investigation, they should notify you directly that they've done so?

Yes.

It does make sense. Police are absolutely not beyond reproach, and there's screwups all the time. They need to be held to a high standard.

It's also easy to imagine reasonable compromises, like a time delay where they only have to report after e.g. 48 hours, and allowing a system whereby a judge can issue a warrant to extend that delay.

That's more or less what a search warrant is, so yes.

Specifically, I believe that if information that is held by a private 3rd party I accessed by anyone, law enforcement or otherwise, that third party should be required to tell you that it was requested and by whom. Just like they can't put a gag order on a search warrant to your home, this hypothetical search would be exempt from gag orders.

Huh? There absolutely are gagged search warrants. Didn't you ever get one at Reddit? They're the norm, the default even.

Not in your home. They can’t sneak in and search your home and not tell you.

Homes might be an exception, I don't know, but I'm of the impression it's routine for police to get physical search warrants with nondisclosure orders attached.

Yes for sure. Only homes are exempt. Which is why I originally said it should be treated as though it’s still in your home.

Right, and my point was, your proposal would proscribe large classes of common law enforcement searches. I'm stipulating the homestead exemption you're talking about here (obvs. neither of us are lawyers), but, given that, you're saying it should be extended far, far outside of homes.

That’s exactly what I’m saying. :)

Are you a little concerned that by advocating a drastic change in policing extending far past ALPR cameras that you're creating room for proponents of the cameras to say that everyone who opposes them wants broadly to hamstring the police?

I watched ALPR proponents in Oak Park make exactly those kinds of arguments.

The information is not in any way restricted to use in active criminal investigations, and further, has been found to frequently be used for a variety of other purposes.

It's a bit like saying pornography is used in the study of human anatomy.

I don't know what you're talking about. I'm talking about the legislation 'jedberg proposed.

~jedberg is talking about a hypothetical law that would apply to ALPR data. In reply, you said "The information itself is evidence, used in active criminal investigations." ("The information" here referring to ALPR data.) (You also said, "The entities holding the information here are literally police departments.", but I don't see that that's relevant unless we choose to believe that police departments are more deserving of public trust by default than any other organization.)

I was replying to the "used in active criminal investigations" part. Yes, the ALPR data managed by Flock is sometimes used in active criminal investigations. However, it's also used for many other things.

The many other things that it's used for supports ~jedberg's argument.

Trying to understand the position here.

This would be excluding gag orders correct?

And regular orders currently notify the service provider, but they don't necessarily notify the target, they just don't have a prohibition on the service provider notifying the target.

Finally, recordings of public areas actually aren't be impacted by warrants at all, right? But what you are saying is not just that LEA would need warrants to look at public recordings from a willingly cooperating camera owner, and that the warrants can't be gag orders (unless specified), but that the targets must be notified, even if the subject under search were someone else, the fact that I'm included in a recording would compel the LEA to notify me?

And how exactly would I be notified? Wouldn't that necessitate even more privacy invading features like facial recognition and a facial to contact information technology? Not an uncommon paradox.

Again, just want to understand the position, my position might leak as the question being leading, but I can't help it.

> This would be excluding gag orders correct?

Much like you can't gag a search warrant on a home, you wouldn't be able to gag these orders either.

> And regular orders currently notify the service provider, but they don't necessarily notify the target, they just don't have a prohibition on the service provider notifying the target.

True, but my proposal would require that they notify you.

> Finally, recordings of public areas actually aren't be impacted by warrants at all, right?

No, but I'm saying this should apply to any time a 3rd party releases information to anyone, including law enforcement. In this case the Flock cameras feed into a private database. They should disclose when someone looks something up.

> And how exactly would I be notified?

Presumably if they can identify you then there would be a way to notify you. But those details could be left to the author of the bill.

My main point is that your data, when housed with a 3rd party, should be considered an extension of your home and offer the same guarentees and protections as the items actually in your home.

You can kind of circumvent that law by keeping the recordings in house.

What we have in argentina is an Habeas Data law, if someone has data about you, you can ask for it, (or ask it be amended or deleted. Pretty simple right?

The home bit is no go though. Maybe an extension of the self? Too flimsy though, there's enough strong of a case treating it as what it is, an image, a visual representation of a person. A home is a specific of a concept that means something else

> Your data should be an extension of your home, even if it's held by another company.

Nice idea, but at least in the U.S. (with the lone exception of LE obtaining cell phone location records), courts have consistently held that if you give your data to someone else, you are no longer entitled to an expectation of privacy in it. https://en.wikipedia.org/wiki/Third-party_doctrine

If you want your data to be considered an extension of your home, at least for now, keep it at home.

I think the notion that data would be a home is beyond weak, but the explanation you gave for why isn't solid either, since the objects of data do not need to and in this case haven't consented.

That is, recordings of people in public settings (in some jurisdictions) are property of the recorder, but it still isn't a home (just imagine how that would work in some jurisdictions, someone takes a picture of you and it's trespassing? Would you be able to shoot them?)

Nice idea (2), but many companies and govt agencies force one to give lots of data or you will not be receiving services, sometimes very important services.

Alternatively, one could create serious civil damages for those capturing surveillance imagery that causes various harms including false prosecution for any data they collected, even if it was unlawfully taken or used after it was collected. ... then let the liability work out the problem by making it too risky to run non-targeted mass surveillance apparatus.

This would avoid having to define what is and isn't a mass surveillance system. Any camera recording off your property would have a legal risk for the operator-- but if you're just recording locally and only using it to discourage or solve crime you're suffering the risk would be minimal and justified.

We'll sooner get a law that will forbid notifying a person when such data is passed to law enforcement.

Is there not some concept that utilizes cryptography in a way such that information about people is accessible, but if it's accessed, then the access request is added to a ledger (akin to blockchain) such that who made the access, when, and about whom becomes provably public knowledge?

PATRIOT Act & Bank Secrecy laws make it illegal to notify a person that they are being investigated, or that they are a subject in an investigation.

That will never happen in America without a focused political revolution because anarcho-libertarian techbro billionaires profit extensively from personal data trafficking and bought off the majority of politicians to keep it that way.

It sounds good but the implementation would be harder than achieving single payer healthcare that's better than what Medicare is now destroyed by for-profit prior authorizations and fake healthcare with lifetime limits.

Reply on news.ycombinator.com