Who Has Your Back 2014: Protecting Your Data From Government Requests

My understanding is that, as a non US-citizen, I'd be generally considered 'fair game' for a lot of blanket surveillance that would not be applied to Americans. Maybe this is what scrrr is referring to? [Edit: I see this is what harkyns_castle alludes to as well.]

Every citizen of every country is fair game for every government, especially their own.

May be that foreign governments aren't any better (but I bet that no EU government spend as much money as the USA in wiretapping), but if you're not an US citizen (and so no warranties are valid for you) I think it's better to have your data in a jurisdiction where you can defend yourself in court, if the need arises.

Foreign governments are certainly no better. However the government in the USA is certainly more capable and perhaps more motivated than most to act on the information it receives.

There is also familiarity with the government carrying out the surveillance to be taken into account. For most European countries, particularly the one that have been members of the EU for some time there is quite good rule of law and so the consequences of being monitored are potentially less severe. Looking at governments with lots of resources to spare or ones without a good rule of law then surveillance is likely to make people more nervous - which is exactly the intent.

Because there's a significant difference in influence I can assert to MY governmnet and a FOREIGN (which includes US) government.

Consider just a lot of US surveillance laws: we non-US citizens might as well be animals for the rights we have. Significantly different than what our own local/EU privacy laws award us.

Also it is significantly easier to take legal action againsy my own government agencies than US ones.

The difference between "other countries" and the US is that the US puts up a show of "human rights", "scrutiny", and "court battles" in order to show that they "care", whereas the other ones just do not bother.

Where are the results? Better yet, public scrutiny? Everything's a fucking national secret.

> What would make you think that foreign governments would be any better?

The vast majority of them don't have even 1% of the NSA's budget for spying.

I'd like to hope there are some governments out there without that kind of mentality. Even if not, most countries wouldn't or couldn't be pumping in this kind of cash [1] to broad-spectrum warrantless hoovering. I imagine it'd be a lot more than the below figures too if you take into account contractors and creative accounting.

To say its all about 'terrorism' is laughable, and I wonder just how many trade deals etc have fallen foul of this, or how many people manipulated into doing what the likes of George Bush wanted. How could you trust doing business with someone in the US after these revelations? Just blatant lies all over the place, from the top echelons down. They've made it to the point where if you wanted to develop something you don't want them to grab, it means an air-gapped workstation. That probably doesn't have much mileage either.

1. http://www.washingtonpost.com/wp-srv/special/national/black-...

I've been constantly surprised about how little scrutiny that kind of statement has received in the media - American or otherwise. I thought it would've publicly raised more hackles here in New Zealand (but I guess we all ultimately just feel powerless in the face of such determined surveillance might).

If a national spy agency had a rule against spying on non-citizens, it would not be much of a spying agency, would it? Additionally, outside of specific treaties, why should one country have certain obligations to other countries' citizens?

>In particular I find the constant harking back to "Well, we don't spy on US citizens, only everyone else." particularly annoying.

It is annoying, but there is a reason why it is being said. Laws (are supposed to) prohibit (more or less) the US spying on its own citizens without cause. It is written into the constitution (more or less). Foreigners don't have that protection under law. Whether that should be changed or not is a different question than are these programs legal under current laws.

Because if it's against the law, we all know intelligence agencies won't touch it.

> While some people DO get up in arms about the U.S. government's activities, it is always phrased in such a way as, "You can't do this to American citizens!" What about non-citizens?

Non-citizens, presumably, can set up their own governments to secure the blessings of liberty for themselves and their posterity -- but they aren't the people for whom the people of the United States ordained and established the Constitution of the United States to secure the blessings of liberty.

> What happened to "All [people] are created equal?"

All may be created equal, but the United States government wasn't created to serve all.

That's not to say there aren't limitations on the powers that the US government should apply against non-citizens, but from the very beginning citizens and non-citizens have been by design situated differently with respect to the US government.

There are a handful of private services for which the market is both cornered by a handful of participants and a necessity to modern life. Opting out of those is about as easy as opting out of laws, both of which require a form of essentially going off grid or on the lam.

Also, it is important to realize that the consolidation of data by businesses is exactly what makes it so easy for government to show up and say "I'll have some of what he's having."

Businesses leverage their power over people to get at data they otherwise wouldn't like to share.

Governments leverage their power over businesses to get at data they otherwise wouldn't like to share.

You can argue that the power in question is different, and that's an important piece of the conversation to have. But overstating that facet becomes a smokescreen for an "it's OK for me to do, but don't do it to me" argument.

>Focusing on governments seems like a good focus.

They aren't really focusing on governments plural, just government singular: the US government. To comply with US law these American companies must provide information about non-US users to the US government, without any warrants. The 'warrant for content' star is meaningless to non-US citizens.

>opting out of giving info to businesses is much more realistic

This EFF report is only talking about government surveillance through corporations. If you opt out of using Google (note: this isn't possible if you use the web) then it doesn't matter if governments are requesting your data from Google because Google has nothing to tell them.

Solving corporate surveillance would solve all of the of government surveillance that this EFF report is concerned with.

The text on the page is pretty misleading as well. It starts off ok:

>We entrust our most sensitive, private, and important information to technology companies like Google, Facebook, and Verizon. Collectively, these companies are privy to the conversations, photos, social connections, and location data of almost everyone online.

But then they ignore what they just said and focus only on government data requests, instead of asking the most relevant question which is what do the companies do with that data that might impact users privacy. Is the company selling a profile about me to health insurers? This page won't tell me, yet the page is giving these companies an EFF badge of approval for 'privacy'.

Further on they say:

>In the face of unbounded surveillance, users of technology need to know which companies are willing to take a stand for the privacy of their users.

Again this is misleading. Standing up to government data requests is not the same as 'taking a stand for the privacy of their users', since the company may also be selling the information to anybody willing to pay for it. Standing up to one type of request (that has no economic benefit to the company) doesn't tell us how the companies act when it comes to protecting the data in other ways (where they have a direct economic incentive to mine the data and to sell the data). The text continues on in a similar way, constantly implying that government data requests are the only thing that could possibly violate privacy.

I can only agree with the other commentators that are calling this report a corporate propaganda exercise. Some people have implied that it's just because these companies are funders of the EFF. I'm not sure it's a simple as that. The EFF has always involved some people with pretty extreme political views that are very pro-corporate. The 'Freedom' in their name has always been as much about freedom for corporations as it was about freedom for individuals. That is probably why this page acts like corporate surveillance can't exist; by definition (according to their politics) only the government can spy on you. Everything else is just 'the market'. I doubt many people reading the page will be aware of the extreme political view behind the design of this report, which is of course the sign of well executed propaganda.

If you believe that an (American style) right to free speech overrides the right to individiual privacy, you are not a privacy campaigner.

If you believe that Google and Facebook deserve full marks on any measure of privacy, and that deserves to be one of your key press releases, you are not a privacy campaigner.

I empathise with these attitudes amongst proponents of free speech, yes, even though I don't agree. If Cory Doctorow supports this, I disagree with him but I am not outraged. However, I don't empathise here: not at all. Here, I am outraged. EFF put 'privacy' as one of their key areas of work and they are amongst the best known privacy campaign groups.

When the European principles of Data Protection are upheld correctly (which rarely happens), the EFF creates a campaign which is against that ruling and in favour of Google's right to ignore the principles. They are speaking out against a fundamental of privacy: a basic principle regarding processing personal data. IMHO that is extremely anti-privacy.

Both of these points significantly harm real privacy campaigning, from a group which places itself as one of the defenders of privacy.

It is wrong.

This is exactly what I object to: they present themselves as privacy campaigners on their front pages, but when push comes to shove they roll in favour of Google and against the individual's right to privacy.

This harms privacy campaigning.

I'm talking about the requests people are concerned about, not nearly all the data requests that are made. I may be way off-base here, but I think that most people are not particularly uncomfortable with the idea that law enforcement could get a warrant to seize their data from a judge based on probable cause and would do so without putting the company under a gag order - that's what we expect from the constitution. I think people are much less comfortable with being caught in a suspicionless surveillance net based on a warrant issued by a FISA "court" with no transparency and no adversarial hearing process, and those are generally issued with national security gag letters.

Pretty intrigued by this! However, if the data is sold by CC companies, is it truly "public"? Regardless, would you even be able to target an individual without spending lots of money to buy a large batch of "anonymized" spending data?

what would a reasonable criteria be? Should the EFF create criteria that could only be met by criminals?

The main issue with the gag orders that people are concerned about is not that they are fundamentally wrong, but that they are ripe for abuse. Many of these companies are publishing some data about these kinds of orders, so within the limits of the law they are doing everything possible.

Dunno, I suspect revolutionary socialism is out of fashion as a solution.

Because the world doesn't want for examples of what civil wars look like, yet still you advocate for them.

It applies equally to non-U.S. nationals. The U.S. just ignores the requirement because those people don't have standing to sue in U.S. courts, and the U.S. has the de facto ability to ignore rulings by other courts.

The Constitution tends not to refer to "nationals" or "citizens" but to "people", as the general intent was to limit the things the government was allowed to do, not to whom they could do those things. The likely argument then, as it would be now, is that if the U.S. can blanket-surveil a foreigner, they could easily convert those same capabilities to a U.S. national.

It's not surprising that Google and Facebook would be huge advocates against government and other use of their databases - I imagine the renewed fervor about end-to-end encryption and the increased skepticism of cloud services is really going to hurt their business model. A secret kept by two people is almost as private as one kept by just one. (Not saying that they'll succeed or even that they have an incentive to succeed 100% of the time, just that I imagine the lack of trust now is going to start hurting soon, if it's not already.)

Reddit has PMs.