Comment by kevinpet | Hacker News Reader

Comment by kevinpet | Hacker News Reader

Parent Full thread

This is a good example of why I don't have the enthusiasm most of this community has for Lessig. His single issue lately is money in politics, to the extent that he seems to be blind to anything else.

The criticism which he linked to primarily pointed out that he was speaking well of a company that exists primarily to enable the surveillance state. My reading of the mention of contributions to politicians in the last paragraph was to point out that this company is contributing to people who Lessig almost certainly does not agree with politically.

But Lessig's response is entirely focussed on not being tainted by any contributions.

He seems to get it what the root of the criticism is: " The essence of the criticism is that Palantir is a bad company, or that it has done bad things, or that it has been funded by bad people."

But his response is "I am completely in favor of questions being raised of anyone like me (meaning people trying to push a particular public policy) about whether mentioning a company or their product is done in exchange for money."

No one ever raised this question. It's not a suspicion. I think what we'd like to know from Lessig is:

1. Do you think it's okay to engage in wholesale spying on Americans, as long as it's subject to what you consider the appropriate oversight?

2. If you don't like spying, are you speaking well of Palantir because you don't think they are involved in it, or are you just interested in the one aspect of their technology and not trying to promote the company as a whole?

...are you speaking well of Palantir because...

He is not speaking well of Palantir. He speaks well of two people in Palantir's employ, whom he knows personally, and he cites a piece of Palantir's technology as the kind of thing that the world needs more of — irrespective of whether or not the rest of their oeuvre is good, bad, or indifferent. That's it. Full stop.

He specifically says he's not touching the discussion of whether or not Palantir are good guys or bad guys. He specifically says he's not endorsing them, for compensation or otherwise. He specifically says he thinks that technology that audits every access of a piece of information is a valuable thing to have in the presence of a panopticon. And. Nothing. Else.

Any deeper reading than that is projection or fantasy. Lessig has earned being taken at his word, IMO.

> Any deeper reading than that is projection or fantasy.

Indeed, and it's concerning that Lessig is able to reply to those types of points in very clear and direct language and still have it fly over the heads of people because "PALANTIR".

Even completing ignoring the very concept of the NSA it is clear that the government will be adopting technology to handle the governance of people.

So decide, tech peoples: Should this technology build in audit trails or not? Should this technology record what interface a government employee was using to extract this data, or not?

There are practically no government databases which can be completely innocuous in the face of a determined government insider. Don't throw the baby of technology controls on misuse of data out with the bathwater of... something(?), especially with accusations as specious as "their board member knows a guy who was on the board of... BAE! (oooooh ahhhhhhh)"

> So decide, tech peoples: Should this technology build in audit trails or not? Should this technology record what interface a government employee was using to extract this data, or not?

Yes, use the technology wherever applicable, knowing that the technology does not guarantee correctness. But definitely stop the wiretapping and the collection of (even encrypted) data.

The tech doesn't justify the program.

So decide, tech peoples: Should this technology build in audit trails or not? Should this technology record what interface a government employee was using to extract this data, or not?

It shouldn't be.

So back to OCR paper forms then? No more web forms to fill out my tax data each year? Should I have to go visit the Social Security office in person each year too?

You're attempting to relate unrelated topics and struggling with a straw man here. If your question had been: Should we use technology in disparate areas of government like tax records and social security, clearly the answer from almost everyone would be yes, of course, as the government does already (and with relatively basic access controls which work perfectly fine). Medical records for example are kept on computers in many countries, and access to them is regulated without a sophisticated system to log access, just with fairly basic access controls.

However that has nothing to do with whether we should attempt to control NSA dragnet surveillance with technology after the fact, or help to construct a surveillance state in the first place. Debating whether we should apply controls to access to say phone record data collected by the government ignores the more important question of whether that data should be collected and collated by the NSA in the first place. I'd say that collection of the data is the only point at which adequate safeguards can be put in place, not after consumption of the data - by then it is too late, and any technical safeguards can easily be put aside later.

> However that has nothing to do with whether we should attempt to control NSA dragnet surveillance with technology after the fact

It's almost like there was a reason I explicitly disclaimed NSA when I made the point you responded to.

Even besides the IRS, what about FBI, local law enforcement, ATF, Border Patrol, and all of those other Federal agencies that have arrest powers? Should the local Good ol' Boy sheriff be able to pull up your record in NCIC with no audit trail?

I don't believe you should have a record in NCIC unless there's a very good reason, just as I don't believe the US should be collecting and storing fingerprints of visitors at the border, or collecting the phone records of every American, or the GCHQ collecting almost all the data that passes through the UK and passing it back to the NSA. The mere act of collating all that information and storing it indefinitely is incredibly dangerous, and some logging of access is not going to make it safer. So this is why I reject the premise of your question.

Not collecting all that information in a central record is the best defence against misuse - if you collect it, it will at some point in the future be misused, just as Hoover, Nixon, the GDR etc misused the far more limited powers they were given.

That's not an available choice.

Not that I'm defending Lessig or Palantir (I'm definitely not a fan of Palantir), but I think the point Lessig was making is that of all the options, having one that is accountable and traceable is probably the least bad. That is to say, agencies (both public and private) are going to (and have!) use data gathering technologies; we may not be able to prevent it. The best we may be able to do is ensure that the chain of custody is unbroken, and evidence isn't manufactured, manipulated or otherwise called into doubt. That and start enforcing warrant requirements again.

That and start enforcing warrant requirements again.

I think enforcing the law (or creating new laws) and revoking the Patriot act would be far more effective than any technical measures after collection. The restrictions of the Palantir system sound about as effective as Snapchat (that is, not at all effective for a determined user). If you can read it and see it, you can spread information and use it in an uncontrolled way. That's not even considering other attacks like photographs, duplicates of the memory, hacks etc. - once the information has escaped the system into the brain of one user, there is no way to control access.

The best solution is for that information to be collected only when strictly necessary and deleted after use, not stored. That's inconvenient and less effective for spy agencies, but more effective for the privacy of everyone else. If you want to stop universal surveillance, we have to control the collection of the data - anything else is too late in the process to make any meaningful difference and will be subverted over time, as the NSA abuse of their mandate has demonstrated.

You cannot ensure such a thing.

Isn't this his response to #2?

> In both cases above, I was pointing to a type of technology. The truth or falsity of what I was saying doesn’t depend upon whether Palantir is a good or bad company. About that question, I am not, and don’t purport to be an expert.

It would be interesting to see his response to points 1 & 2, but I think we already got some idea of his answer.

IHMO I interpreted his original reference to Palantir to be "systems used for scanning databases, and datamining, should have an audit trail built into the core of that system"

Edit: Clarified that its my opinion, not a direct quote.

I totally disagree with you. You first question embodies a very non pragmatic mindset - the first question has no "right" answer. However, rejecting corporate funding for research/etc is something that in principle makes very strong sense and transcends the sort of questions you are asking.

He seems to be wise enough to not take a black and white stance on Palantir as a company - really, no one has the right to call a company good or evil and we are ignorant of their intentions. However, his point is regardless of his perception of Palantir, corporate funding biases research and in principle thus should be rejected.

Reply on news.ycombinator.com