Hacker News Reader

I give my data to Facebook. Facebook tells me what they're going to do with it, and provide me with service in return. This doesn't mean I've given Facebook permission to sell my data to anyone. While Facebook makes extensive use of my data -more than is needed to present a wall to me- that doesn't mean I lose expectations of privacy.

I'd want Facebook to fire people who were looking through my photos without operational reason, as one example.

Perhaps it's a European thing: Companies should only ask for the data they need; they should only keep it for as long as they need it; they need to protect it against loss.

I strongly believe that law enforcement and intelligence agencies should be using validly formed legal documents to get access to cloud (and other) data.

Let's take a simpler situation. Say you tell me that you were with Bob and Jim out on Mill Road last week. Now if a crime has been committed, and a cop is asking questions door to door if anyone knew where you were and who you were with, do you think that the officer should have a signed warrant for me to disclose to them that you said you were out by Mill Road with Bob and Jim? How would the Facebook situation be any different, other than the fact that they make money off you telling them these things?

Strictly speaking they don't "make money off of you telling them these things." They make money from advertising in a well-targeted fashion, which is actually a much more complicated proposition, and one that has far more to do with how much sense they can make of the the data you provide – not just the acquisition of the raw material.

Using a more accurate view of their model, it becomes clear that FB is strongly incentivized to keep their raw data to themselves. Failure to do so means risking that someone will not only beat them at their own game, but will do so at their expense. Same goes for Google, etc. So yes, it is perfectly reasonable to share a lot of very personal data with them while expecting that much of it will be carefully protected. After all, the stratospherically high value of their position depends on the inability of others to connect the very fine-grained demographic profiles they create with the specific individuals behind them.

Given this reasonable expectation of privacy, it makes more sense to see these third-parties more like doctors, priests, or accountants. Yes, they're all third parties too. But they're ones who we absolutely expect to protect our privacy. Given how deeply established the norms of confidentiality are in cases like these, I fail to understand why we we've acquiesced so readily to the fairly radical standard set in 1979.

> Now if a crime has been committed, and a cop is asking questions door to door if anyone knew where you were and who you were with, do you think that the officer should have a signed warrant for me to disclose to them that you said you were out by Mill Road with Bob and Jim?

It's important to distinguish between you being allowed to tell them and them being able to compel you to tell them. I see no problem with requiring a warrant for the second one.

Doesn't withholding potentially pertinent information from a criminal investigation constitute obstruction of justice?

How do you expect the courts to respond if the government prosecuted AT&T for obstruction of justice for refusing to execute a wiretap without a warrant?

A warrant isn't required to compel someone to testify against someone else. Historically,[1] the balance has been struck in favor of the government's right to all relevant evidence.

[1] The subpoena ad testificandum dates back about 800 years.

I get that judges are resistant to changing something that has existed for a long time, but it still seems like a bad policy. If someone has to be compelled to testify it will almost always be either because the witness doesn't want the perpetrator to be punished or the perpetrator is so dangerous that the witness is afraid to testify against them. Compelling testimony in either circumstance (as opposed to, say, negotiating for it in exchange for witness protection) is very likely to produce false testimony. It's hard to see a government interest in false testimony. Moreover, history is not always right. Censorship is as old a practice as the printed word, that's no excuse not to apply the First Amendment to curtail it.

This is also justifying the lack of a warrant requirement based on something that breaks the analogy to the original case. Witness testimony is no one's "papers and effects", unlike stored data.

"Facebook tells me _what they want me to know about_ what they're going to do with it,

FTFY

"Users surely realize that every gmail they send and every Facebook message is both mined for information and also accessible to hundreds of people at these companies."

You're kidding right? My expectations would be that the vast majority of people who use those services have no idea that is happening. The internet is a device now, just like all the other devices in their home that most people have absolutely no idea how they work, they only know how to use them.

For a chap interested in the law, you seem to be rather flexible in your perspective.

An unlocked door on a house doesn't seem to support an objectively reasonable expectation of security, but that doesn't mean it's any less wrong to open it and burgle the place. And I doubt the fact of an unlocked door or window would be supported as a defence in a burglary case.

Data stored with cloud companies are accessible, as though through an open door, for those companies' employees. But that doesn't make it any less wrong for such employees to go trawling for gossip, amateur porn, etc. in such private messages.

The factual difference is that those companies don't just have the ability to trawl through your data, they actually do it.

Imagine you allowed Facebook to send people into your house to take pictures, so they could see what cleaning products and the like you buy and sell that information to advertisers. The government wouldn't need a warrant to subpoena those pictures in Facebook's possession of what's in your house.

I think your general argument is a reasonable one if read in isolation. Unfortunately it seems quite possible that rayiner's characterisation of the law is correct, and that the law just happens to be bad and/or anachronistic in this area.

In general, I don't think privacy and data protection laws are anything like strong enough in most jurisdictions today, and I think the data mining industries (and governments) are pushing the boundaries of acceptable behaviour as far as they can as fast as they can so they can then claim that their behaviour is normal and accepted and therefore "OK" before those laws catch up.

The difficulty is that privacy is something of a Pandora's box situation -- once lost, it is almost impossible to truly restore -- with the added twist that it's mostly important to protect against "it would never happen to me" situations, which means the average person doesn't realise or doesn't care what they're losing until it is too late. I'm afraid the data miners will win (or already have won) and for at least one generation the safeguards that privacy should bring them have been lost for life.

Realistically, most people probably won't suffer great hardship as a result. The worst they'll get is some spammy advertising. The people we should worry for are the innocent ones who will nevertheless spend months trying to fix their credit after identity theft, or paying a fortune to accountants when they are investigated for (negligently) suspected tax fraud, or going through a hellish legal process for months to defend themselves against false accusations, or trying to get permission to travel on holiday after being put on some list because something they said was taken out of context, or having their candidacy for public office undermined by character assassination, or in the ultimate worst case who are dead because the SWAT raid/drone strike/other severe and immediate action left them no chance to set the record straight. These are among the reasons privacy and data protection really matter, but to the extent that anyone is really questioning laws and practices today they seem more hung up on Facebook and Google mining data to serve ads.

> trying to get permission to travel on holiday after being put on some list because something they said was taken out of context, or having their candidacy for public office undermined by character assassination, or in the ultimate worst case who are dead because the SWAT raid/drone strike/other severe and immediate action left them no chance to set the record straight. These are among the reasons privacy and data protection really matter, but to the extent that anyone is really questioning laws and practices today they seem more hung up on Facebook and Google mining data to serve ads.

It is rational to worry about something proportionally to the product of how bad it would be and the probability of it happening to you. Getting drone-striked would be worse than losing a job because of data mined from your online presence, but the latter is orders of magnitude more likely to happen to you.

Privacy does matter. To me, the way forward on privacy is real privacy. Encrypted everything and laws against tracking people on the internet except with explicit consent construed narrowly. I don't think the way forward is trying to paint the government as the bad guy while giving private companies carte blanche to do all the same things.

For whatever it's worth, I couldn't agree more.

My personal experience has been that privacy and data protection (not the same thing, but of course closely related in practice) are issues that are very hard to advocate for. This is mainly due to a combination of "it would never happen to me" (which it probably won't, if we consider only a limited range of "it" and what is happening right now, today) and the stable-door-horse-bolted nature of the problem.

Of course, this doesn't mean it's any less worth defending the principle and advocating for change. It just means it's sometimes hard to get past "I don't care what Facebook uses to advertise to me" or "If you've got nothing to hide then you've got nothing to fear" as the default response even from quite smart and rational people if they haven't spent much time thinking about the issue and/or don't fully understand the technology involved and its potential applications.

In the UK I am petfectly legally able to open your unlocked door walk in, sit down and not burgle you.

You can ask me to leave but cannot have me arrested until I refuse to do so.

> Users surely realize that every gmail they send and every Facebook message is both mined for information and also accessible to hundreds of people at these companies.

Well it's not like they ever offered users a choice or educated them....

Privacy isn't a matter of what's technically possible.

It's a matter of what is socially and legally acceptable.

I will argue, absolutely, that the present state of exposure given email and other electronic communications is largely unacceptable.

But haven't federal courts ruled that the government does need a warrant to access the content of emails? Which would imply that users do have an expectation of privacy.

edit: forgot a word

But it's not just GMail and Facebook stuff, right? The government is collecting everything. Specific sites don't matter.