Hacker News Reader

Comment by hga | Hacker News Reader

"In order for these services to become the main foundation of the Post-PC future, users are utterly justified in demanding binding commitments to security from service providers."

Which, due to the total secrecy of the government's process (e.g. National Security Letters), they cannot provide.

We could, of course, watch ever word we put on the cloud, including the supposed private stuff, but I'd rather not do that for a large class of things (submissions to forums like this are an obvious exception, I am after all submitting it for the whole world to see as it wishes).

The cloud can still be useful for encrypted backup, that's what I do with rsync.net to avoid loss by disaster, and it saved e.g. my email when the Joplin, Mo tornado hit 2 years ago. But put my spreadsheets on the cloud? The one tracking the blood test results of a relative's anemia (fortunately, it looks like it was a "hit and run" virus). No, I think not.

View on HN

Just out of curiosity, what is it about your relative's blood test that you don't want the NSA to know about? Especially since the results are already on a network at the hospital (or testing lab), and the NSA can get it directly from there anyway via an NSL.

I've often wondered about why medical records are such a sensitive topic to most people. The only things I can think of is either the insurance company will find out and raise your rates (they find out anyway, as they pay your bills), or the condition one suffers is due to something they did that was embarrassing (or similar).

That's just a "for instance"; medical records are in theory better protected that most types of data, and I was pointing out a way it might be Hoovered up vs. of course it being specifically accessible through something such as a NSL.

A lot of this has to do with how this data can be abused, e.g. for political purposes; in this case, it's almost certainly nothing to worry about, but there are many cases where there are damn good reasons for privacy.

J. Edgar Hoovered?

The most famous brand name of vacuum cleaners in the US: http://en.wikipedia.org/wiki/The_Hoover_Company, but, yes, it might be good to remember people like J. Edgar.

> Just out of curiosity, what is it about your relative's blood test that you don't want the NSA to know about?

This is the wrong question. The right question is, "what is it about your relative's blood test that you don't want the NSA, or anybody else in the government, or any contractor or lobbyist the government is persuaded to share this data with, now or at any point in the future, essentially in perpetuity, to know about?"

And the answer is, of course, "I don't know".

I don't know if Obamacare will die an ugly death and insurance companies will successfully lobby for absolutely anything establishing genetic prior conditions.

I don't know if, in 50 years, the government will decide to, say, demonize Jews and go hunting for Ashkenazi DNA indicators in their databases and go after the families they can find with them.

I don't know if a genetic predisposition to homosexuality, haemophaelia, a positive test for AIDs or herpes or ginger hair will one day be used against me or my descendants by some future mob.

And that's why privacy is important.

> or any contractor or lobbyist the government is persuaded to share this data with

Or anyone the government is "persuaded" where persuaded may well include security breaches by hostile parties of indeterminate origin... Actually the hell with it, just put it this way, insecure by law is still insecure. Effectively PRISM and its ilk implies that insecure by law is in fact insecure, completely.

I agree with the point you are making. In the spirit of agreement, I would suggest that the right question is "what is it about your relative's blood test that you specifically want to bring to the attention of the NSA, government, contractors, and lobbyists."

Privacy should be the default state and expectation, and disclosure should be by exception when necessary, for exactly the reasons outlined in your post. The argument that privacy only matters if you have something to hide conceals a number of assumptions, and misses the fact that one doesn't know what one might one day wish one had hidden.

I can answer that. I used to wonder the same thing, but medical records are a particularly powerful type of information. Data in your medical record is often associated with major life events (serious illness, risk of illness). Often a medical examination can reveal if you participate in certain sexual acts (tearing in the vagina or anus), whether you are at higher risk for cancer, whether you have an illness or disability that would cause others to treat you differently, or would cause employers to sideline you. A medical examination can sometimes identify where you have traveled, even if it's a secret (why do you have anti-bodies for yellow fever or TB?).

Genetic data can (and has been) taken from the medical records relatives of serial killers without their knowledge (with a warrant) in order to get a confirmation that their relative might be a match to semen samples found at crime scenes. This has at least in once case resulted in a warrant being issued and a case being solved in California. http://abcnews.go.com/Nightline/familys-dna-led-police-grim-...

With genetic tests, you can also uncover family secrets that can turn said family completely dysfunctional (non-biological mother/father, incest, parents are unwittingly cousins).

Additionally, you need not tell your insurer everything. New rules under the HITECH act are coming into effect that mean that so long as you pay cash at the doctor, you can request that the details of the visit not be forwarded to the insurer.

http://news.aapc.com/index.php/2013/02/know-when-hitech-trum...

Reply on news.ycombinator.com