Hacker News Reader

Comment by unreal37 | Hacker News Reader

I think this has a strong chance of succeeding, eventually.

It does seem that PRISM is building a list of who people associate with - through email and phone communications, or various chat programs. Through this list of who you associate with, you can certainly start to label people and deny them rights based on their membership in various groups.

Back in the 1950s, the State Department was asking people to promise they weren't communists before granting them a passport so they can travel abroad. The amount of information they can get on people has grown exponentially since then - and that doesn't mean we have to be less careful with it.

First amendment - freedom of assembly - grounds is a brilliant way to argue this.

View on HN

"Back in the 1950s, the State Department was asking people to promise they weren't communists before granting them a passport so they can travel abroad. The amount of information they can get on people has grown exponentially since then - and that doesn't mean we have to be less careful with it."

We do have a disadvantage this time. Prior to the internet era nearly anyone could easily understand exactly what was being done, as wiretapping was the most complex instrument used.

This time, one can attempt to abstract this as far as possible, and bury arguments with technical jargon. "Metadata isn't data", etc.

> "Metadata isn't data", etc.

The argument isn't that metadata isn't data. It's that metadata isn't "yours." It's AT&T's observations and records about your use of their system. That's not "technical jargon." It's a relevant distinction when discussing the scope of a privacy right: whose information is protected? If it's not just information generated by you, but also information relating to you, how closely does it have to relate? Etc.

Even if that's so, there is still the issue of "expectation of privacy". If the customer buys AT&T's service and expects a certain degree of privacy (meaning no one can just try and locate where he is with that data, or with who he is talking to, etc), then I think he deserves that kind of privacy.

Ultimately, the citizens can demand laws that state that fact explicitly. There are countries where collection of metadata by authorities in this way is illegal - and not because they didn't try to collect it. They did. It's just that "the people" won the argument, and now they aren't allowed to use the metadata (or at least not in this sweeping way).

Yep, agree. The courts have so far ruled that you have no "right to privacy" to data that isn't yours to begin with thus email headers and phone records can be collected by law enforcement en masse without a warrant.

But compare this with the Supreme Court ruling in 1958 blocking the Alabama government from obtaining the NAACP's membership lists as a condition to doing business in the state. The lists belong to the NAACP and not the individuals on those lists, but the Supreme Court still held that people had a right to "pursue their lawful private interests privately". [1]

"Immunity from state scrutiny of petitioner's membership lists is here so related to the right of petitioner's members to pursue their lawful private interests privately and to associate freely with others in doing so as to come within the protection of the Fourteenth Amendment"

[1] http://en.wikipedia.org/wiki/National_Association_for_the_Ad...

I've wondered why the businesses from which the government gets this data don't have a right to privacy. It seems like that since corporations were given the right to contribute money to political advertisements on the grounds that they are people then they should be extended the same privacy rights as well.

There is no "right to privacy" per se in the U.S. There is a right to be free of unreasonable searches and seizures (4th amendment), there is a right to refuse to testify against yourself at trial (5th amendment), etc. These protect certain aspects of a right to privacy, but if you read writings from the founding generation, they didn't have the kind of well-developed "right to privacy" concept many people have today.

As a result, these protections exist next to mechanisms that cut in the other direction. One of those mechanisms is the almost unlimited power of common law courts to compel people to furnish information, through subpoenas and warrants. And that power is especially strong when the information is about someone else. So for example, while a court cannot force you to testify against yourself (5th amendment), they can force you to testify against someone else. They can force you to furnish information or copies of documents relevant to an investigation or ongoing litigation. Indeed, in a civil litigation, often one of the lawyers will be able to issue subpoenas forcing parties to turn over documents in the name of the court. In the Anglo-American system, there is really no "right of privacy" as against the right of a court to gather all the evidence necessary in a civil or criminal litigation.

So corporations do have 4th amendment rights. The NSA doesn't come to their offices and take the information. But that doesn't protect them against court orders to furnish information about other people.

Citizens United did not say that corporations are people. If you are starting from that misunderstanding then lots of things won't make sense. Corporate personhood is not mentioned in the decision.

A year after Citizens the court ruled unanimously in FCC v ATT that corporations fail to meet the "personal" part of "personal privacy." That decision is fun to read if only for the last paragraph.

Hey, that's great that you understand this to the extent of articulating why metadata gathering is a problem - but I assure you that the "metadata isn't data" rhetoric GP mentions is, in fact, the tactic I see most often in the wild.

So calling it "technical jargon" is pretty accurate - people encounter this confusing word "metadata" and have no idea what it means or how to reason about it.

HIPAA (privacy portion) covers more than just your data, so I could see the same thing here. What if "your" medical data was private, but all the metadata about where you are treated could be recorded.

Can you imagine if they decided HIPAA didn't consider "metadata" private? Sure, the doctor's notes are private, but the list of every procedure you've had and every drug you've taken doesn't count.

An interesting example of how through correlation and context, metadata can reveal more than you'd think....

http://www.securityweek.com/how-metadata-reveals-more-about-...

Except that in what way is PRISM preventing you from being able to assemble ?

There is NO evidence that the NSA et al are using this information to target anything other than the most serious of terrorists. Until we evidence of the contrary I fail to see how these lawsuits will be able to stick.

One way for them to stick is if "collect it all" surveillance is judged to violate the Fourth Amendment regardless of whom the agencies are currently targeting.

The 1958 Supreme Court ruling struck down a law that required groups to provide their membership lists to the State of Alabama. They don't have to "prevent" people from being able to assemble, but building lists of which groups people belongs to still violates their "right to pursue their private interests privately". So in large part, the right to assemble also includes the right to be part of any group (even communists!) without the government needing to know.

But again what evidence is there that the NSA is creating these list of groups ? They could just be simply looking at which individuals a person is speaking to. It is a subtle distinction but legally a significant one.

I just seem to see a lot of conjecture but no actual evidence.

The no fly lists? They are generated somehow, and if there isn't transparency we have a right to be suspicious.

I think especially in light of recent events, it'd be foolish to give them the benefit of the doubt.

You don't see evidence because these programs are hidden from the populous. Maybe you're right - we don't know.

It might be legally significant, but technically, there is no real difference.

Given your social network, and training data consisting of the public members of a group you can use a semi-supervised learning algorithm to determine group membership. Since social networks have a small diameter and the public members are typically well connected, you would expect this approach to be fairly accurate. Or rather, accurate enough to act on, if you do not need to provide legal justification for your decision.

What's the required legal justification for putting someone on a no-fly list?

If you want to give some real world basis to the legal distinction you need oversight and transparency. In particular, global analysis of the whole dataset must be illegal, since it pretty much corresponds to total surveillance. Your results might not be completely accurate, but they don't need to be if you can act once you have something like 51% confidence.

It is a subtle distinction but legally a significant one.

Not subtle. No distinction.

I just seem to see a lot of conjecture but no actual evidence.

All data about every one. Including everyone's social network.

Hard to be more clear than that.

The Main Core database is reported to contain a list of 8 million people. You probably want to avoid associating with them.

While I disagree with this position from a policy stance, it may have legal weight. Courts are loathe to rule on things based on hypothetical future harm.

You are absolutely correct.

There are a number of possible interpretations as to what thety are doing and some interpretation of what we have seen and read regarding the NSA data collection probably exists that would probably make most of us pretty happy.

The problems are: (a) we dont know what they are actually doing and (b) we cannot trust them not to lie to us about what they are doing, one way or another.

The other problem is that the NSA has made it clear that in its opinion collecting metadata on a call is fine at any time, for anyone/everyone.

Metadata on a cell phone clearly includes time and location of cellphone/receiver checkins.

It is absolutely reasonable to assume that, if they want, the NSA can track the location of any person carrying a cellphone; or - given that they are storing this data - reach into the past and know exactly where you were, and when.

that is a remarkable power, IMO.

Hook that data up to a computer display and holy cow, that is a powerful tool.

Frankly, it would be awesome. if it wasn't for the fact that you, specifically and personally, appear on that display.

Reply on news.ycombinator.com