Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

Ok, so its a bit snarky, but I wish Google would invest as much cleverness in evading the letter of these non-disclosure rules as they do in evading the letter of the tax laws in their various jurisdictions. Perhaps they could create Google Panama Ltd which is the official entity to petition for all FISA and NSL requests which is an independently operating subsidiary based in Panama and outside the jurisdiction of the disclosure rules or something. There are a lot of smart people there, you can figure this out.

View on HN

It's not just snarky, it's preposterously unreasonable.

How much work do you, personally, put into making money? At least 40 hours a week, I'm guessing, plus the time you spend on managing your investments, doing your taxes, and so on? How much work do you put into maintaining your own privacy? Is it even 1 hour per week, on average? Really?

Note that Google has, allegedly, already put a LOT of work into pushing back on ensuring that due process is followed. Many engineers, many lawyers, lots of executive-decision-effort.

Maybe you don't believe anything Drummond or Page say? Maybe you think google.com/transparencyreport is purely fabricated? Maybe you think Google should violate the law and get shut down (that's what you said, actually, with "evade the letter of the law", but I find that position so laughable that I assume I misunderstood you)? Maybe you yourself actually DO spend the same time on privacy that you spend on pecuniary gain, or maybe you expect Google to hew to a higher standard than you yourself do?

On your last point, I would argue that the more power and information an organization or individual has, the higher the standard should be.

Not precisely a rebuttal (you missed my point) but an interesting point in it's own right which I read was "Can you evaluate dollar value of privacy using the dollar value of your income stream?" And doing a sort of solve for X thing where you end up with hours invested in maintaining privacy becoming valued at hours invested in generating income. If I misunderstood please let me know, but assuming that I got the gist of it...

For me, I don't believe there is even a piece wise approximation between time investment and privacy value because the tools are so much different and the available actions being constrained. To illustrate where I get hung up on that reasoning, if you build a phishing page setup and contract a botnet to spam few hundred million people with phone phish-spam, you might get a lot of "income" for a relatively small time investment, similarly you can get greatly increase your privacy by investing in forged identity documents. So at the least we would have to constrain the hours invested in legitimate ways to enhance ones privacy and legitimate ways to enhance one's income.

Next there is an issue of facilitating the effort, so when company A sells me raw materials at a modest markup they facilitate my ability to make a living using them to provide said raw materials.If instead they were to charge an extortionate mark up, I might still be able to make a living but I might find the effort to do so requiring many many more hours of time investment. So at what point do the actions of my raw materials supplier work for or against my efforts at generating income. Similarly the provider of my tools can make it easier or less easy for me to maintain my privacy, so for example a Google Drive plugin which let me keep everything on their servers encrypted. If Google provides that then its a small number of hours invested to enhance my privacy, but if I have to rely on a third party who is acting without support from Google, then it takes many more hours for the same level of enhancement.

Given these built in and essentially intractable forces which affect the efficiency of hours invested needed to achieve the desired result, I am not persuaded by your claim that I can evaluate the 'worth' of privacy using your proposed reasoning.

Google can, and apparently does, to things like warrant notices where if you are suddenly asked to reconfirm your acceptance of their terms of service it's a signal that a warrant was served to them that they had to turn over your data. I think these sorts of things help them in the eyes of their users and are not illegal. They meet the letter of the law and so are not actionable, just as their transferring of rights around amongst their national subsidiaries is a completely legal way of not paying more tax.

My call to action was to try to think of ways that would make things like the PRISM data not useful to the NSA and yet meet their obligations under the law. I mentioned one (in cloud encryption with client side decryption) but I am sure there are others.

Okay, 80% of your comment is replying to a framing that you chose earlier. You said Google should spend comparable amounts of effort on X and Y. In that context, I pointed out that no one spends even 10% as much effort on X as on Y, so why would you ask Google to, and you're being completely unfair. YOU chose this context.

And I am _highly_ skeptical about this "reconfirm your TOS, as a hint that there's an NSL on you". (I have no inside knowledge of this, and if I did I would lie to you about it.) But if any engineer did that, and got caught, they'd go to jail. Given that 99.9% of users who're NSLed will not have read that blogpost (the crazy tinfoil-hat wild-speculation one that started this rumour), what would be the benefit? No benefit, but one conscientious engineer goes to jail. Yay.

Law, in general, is just as concerned with the spirit of the law as the letter.

My whole reply is that Google is already working harder on privacy, as a fraction of total resources, than nearly anyone you've ever met, and certainly more than nearly any corporation. (Unless Google is lying about basically everything, which I can't/won't prove they/we are not). Your expectations, as originally stated, are unreasonable.

Disclaimer: And yes, I have a vested interest. Hopefully my argument stands on its own merits. Your call to action is insulting.

Fair enough, we've spent a lot of effort at Blekko (also a search engine) at being conscientious designing ways that we can dis-associate data from users in order to protect our users from data that can be tied back to them. Since our taxes are reasonably straight-forward at this point it is entirely possible that we've invested more time in keeping peoples identities protected in our data than we have in minimizing our tax burden. We are a prima facie example of "someone" who has spent more effort on X than Y. But arguing exemplars misses the point.

I am sure that Google is a much different place than when I left it, hell it was different between the time I joined and left. That said ...

The comparison I was trying to make, and I grant you that it is imperfect, is that Google, like Apple, has billions of dollars in free cash flow and in legal testimony lately they have shown great creativity in ways to shuffle that cash around so as to avoid being required to hand it over to various revenue agencies. Google is also has billions of data points about all of the individuals that use its services. If those data points were dollars, and the revenue agencies were intelligence agencies, what creative ways might they come up with to disassociate which data point belongs to which user such that they could still use the data but not be compelled to hand it over. Just like they use those free cash dollars rather than hand some percentage over as tax.

I've got nothing but respect for the smart people at Google, and still have friends that work there (and folks who used to work here and are now working there :-). Perhaps I'm misreading your tone but it sounds like you want to pick a fight.

The US needs to close its tax loopholes and stop blaming people for taking advantage of its own terrible laws. As long as the loopholes exist its in everyones best interests to take advantage of everything they can.

Reply on news.ycombinator.com