10 ms·

The law depends on compute power

91 points by Labo333 10y ago

stickfigure 10y ago
Social security numbers are in the uncanny valley between something private enough to be plausibly used as a shared secret and public enough to be exploited widely. There is really only one effective solution to this: Make all SSNs public and therefore useless as a secret key. All the services that are currently (ab)using this number will find alternatives.
- tedunangst 10y ago
  SSN is only one example. All your medical records, your entire genome can be represented as a number. Does that suddenly make it acceptable to publish?
  - lisper 10y ago
    Any information can be rendered as a number. The whole idea that there's something special about numbers that makes them different from other kinds of information (i.e. it's OK to publish this "because it's just a number") missed the point rather badly.
- gioele 10y ago
  > Make all SSNs public and therefore useless as a secret key. An exhaustive list of all US SSNs will be mishandled, intercepted and posted online. It is only a matter of when, rather than if. (For precedents of whole-country database dumps, see the Turkish, Philippines and Qatar cases.)
  - umanwizard 10y ago
    How do you make the leap from "something has happened in three countries" to "it will inevitably happen everywhere" ?
    - Qantourisc 10y ago
      (chance greater then 0) * (a lot of time)
      - jacobush 10y ago
        Right. Reminds me of how to destroy the earth. Just wait until its atoms decay.
      - umanwizard 10y ago
        This is wrong for a lot of reasons. The most obvious one is that it assumes the United States social security number system (and the United States itself) will exist for infinite time.
  - RexM 10y ago
    Isn't the point that it is public? > Make all SSNs public
    - gioele 10y ago
      My (excessively hermetic) message was meant to mean: "All the SSNs will one day be public. Even if the legislator does not make them public, they will leak one day anyway."
chroma 10y ago
I desperately want to read a lawyer's answer to the questions raised by the author. My bet is that most of the gray areas exist simply because no cases involving them have been litigated. If such cases ever go to trial, courts will probably rule in a rather common-sensical way, such as by creating a bright-line rule[1]. 1. https://en.wikipedia.org/wiki/Bright-line_rule https://en.wikipedia.org/wiki/Bright-line_rule
- deleted 10y ago
  [deleted]
- sandworm101 10y ago
  Lawyer answer (in general terms and without citations): All intellectual property rights are limitations on free speech. Courts rule against the publication of exact copies, or identical copies in different media, every day. IP law requires courts to prevent copying else it be meaningless. The flag is not an expression of a new idea, it is a facsimile of a protected number, protected data little different than a copyrighted movie or patented design. Its publication could only be legal as some sort of "fair use", but exact copies that directly impact the financial viability of protected material rarely fall within fair use. They would rule against the flag. If persons want to express themselves using this material, they need to add some form of comment so as to avail themselves of fair use protection. Add a stripe to the flag and get back to us.
  - j2kun 10y ago
    What about the computational power question? At what point does it become illegal to publish an encrypted SSN/illegal number if you know it takes 1 day to break the encryption using current computational power? What about 10 days? a year? ten years? a hundred years? a thousand years? And what if computational power changes, and a thousand years turns into 1 day? Does the action become illegal retroactively?
    - roel_v 10y ago
      Those are meaningless questions. It's trivial to think of 100's of hypos and go 'is this legal? Is that legal?' 1000's of first years do that every year because they think that's what being a lawyer is about, not to mention the amateurs. A judge however considers one specific case, with arguments as to what is the objective reality as presented by the parties. 'What ifs' don't matter. Law is not a closed rule-based system. 'Loopholes' (I loathe thay word) are not like buffer overflows. (have law degree, not practising lawyer)
nl 10y ago
This is the perfect example of what happens when a programmer (or in this case a mathematician) thinks that the law operates like a computer. It doesn't. The law is interpreted by humans, based on case law, and attempts to understand the intentions of the law as written. Many programmers don't like this, but that is how the law operates. (If the author would like to go down another rabbit hole, perhaps he should consider if encrypted information is actually published at all. After all, well designed encryption renders information quite close to random noise in the absence of a key. Perhaps making encrypted information available isn't actually publishing - maybe it is the act of posting how to decrypt it that is the act of publishing. Note that here, the law would answer "it depends", and that is fine.)
- pliny 10y ago
  More on this distinction is available here: "What Colour are your bits?" http://ansuz.sooke.bc.ca/entry/23 http://ansuz.sooke.bc.ca/entry/23
  - Analemma_ 10y ago
    And the follow-up article, which discusses the usual objections that programmers have to the original article: http://ansuz.sooke.bc.ca/entry/24 http://ansuz.sooke.bc.ca/entry/24 . Particularly noteworthy is a comment from a lawyer that a key misunderstanding among programmers is that in law, the humans and their social interactions are the first-class entities of the system, not second-order distractions as they tend to be in engineering. This was a very enlightening moment for me in my journey towards understanding why the law seems so absurd from a mathematical perspective.
    - haasn 10y ago
      Indeed, the only absurd thing about the law is when people try to flirt with it by treating it mathematically.
  - haasn 10y ago
    I think this article does a fantastic job of illustrating why legal problems (determining or enforcing the Colour of something) can never possibly be solved through the use of (colourless) technology - the two are fundamentally incompatible. This is, for example, the reason why DRM has never ever stopped people from sharing copyrighted works - because DRM is trying to solve a legal problem (the Colour of bits) by using a function of those bits (technology), it is destined to fail.
haasn 10y ago
At some level, laws inherently have to be up for interpretation, and operate on some level of abstraction above the intimate details - because virtually everything in life is a spectrum, including the applicability of a given law. In the “fringe zone” in which it's not clear whether a law applies or not, judges have to resort to individual judgement on a case-by-case basis. This is not something that's new or unique to technology, although technology does a fantastic job of illustrating the difference between a legal problem and a technological problem - as well as the different mindsets you have to approach both with.
Al-Khwarizmi 10y ago
"now that it’s public, you have to wonder whether this will bite me in the ass when I’m 60 (...) and my identity gets stolen" Could someone from the US care to explain why publication of these numbers is such a big deal, and why it can lead to identity theft (an idea that I see often on the internet)? In Spain we have a unique ID number and it is pretty common to see them published all over the place. The government and administrations routinely publish lists of people with their name and ID number, for example if you have applied for a public sector job, a government grant, etc. your ID number will be published in a list that everyone can see and even find on Google. We don't see it as a problem because knowing someone's ID number doesn't mean you can steal their identity - to do that they would need to forge the actual ID card, for in-person procedures, or steal passwords or keys, for online stuff. Knowing the number alone doesn't give you access to anything. In fact, it is publicly known that the current king has the ID number 15 and the former king 10 (number 1 corresponded to dictator Franco who created the system), but it's not that easy to go around impersonating the king :) What can you do if you know a person's social security number in the US?
- jtarrio 10y ago
  I'm Spanish too, so hopefully I can explain. The problem is that everyone treats the SSN as if it were a secret number known only to you, so they use it as both an identifier and an authenticator. In Spain, however, most people know to use the DNI number as just an identifier, using other methods (most typically, physical presentation of the ID card) for authentication.
- LukeShu 10y ago
  A huge number of firms treat the SSN as "private" and having knowledge of an SSN proves that you are that person. It's not what they were designed for, but good luck explaining that to the electric company and the gas company and the credit card company and the bank... "What can you do?" With Duke Energy, the electric provider in my last apartment complex, you would have absolutely no problem registering for electric in someone else's name and having them on the hook for it if you knew their SSN.
- rhino369 10y ago
  For some reason a lot of businesses treat SSN as a secret password. Our numbers aren't supposed to be published, but they are used so often they aren't really secure. You can do stuff like apply for lines of credit using a SSN. If you use my name and my number its presumed to be me applying for the credit.
davidgerard 10y ago
The trouble with this logic - to which I am not entirely unsympathetic - is that under it, a computer program binary would also constitute an "illegal number". "You've copied Microsoft Office!" "Nonono, that's just a very large number in binary." The actual answer is: the law is all about intent.
lisper 10y ago
It is not illegal to publish a social security number. Watch this: 268-91-7112 That is a social security number, but I guarantee you I will not be prosecuted for publishing it. What is illegal is publishing the binding between a particular social security number and a particular person. Geeks get way too hung up on this idea that publishing these things should be OK because "they're just numbers." No, they are not "just numbers". They are numbers with some associated semantics. This number is Bill's SSN, that number is Sony's secret key. It's the semantics that matter, not the number.
- bjornsing 10y ago
  There are interesting paradoxes though when you mix "legalistic" and "geeky" worldviews. :P E.g. let's say somebody publishes the statement "one of the prime factors in Bill's SSN is 7"... and then someone else, independently... ;P You get the point! :)
  - izacus 10y ago
    Then you look at them, determine their intent (to publish Bill's SSN) and punish them or not accordingly. That's the point of the legal system and judges - as opposed to computer code they actually tend to try and determine intent as an important part of a ruling.
    - drdaeman 10y ago
      The problem is, the intent of such action is, most probably, to just fuck with the law (requiring it to solve the task it can't work on, because its from the different realm[1]), not to publish Bill's SSN. Legal system may try to handle the issue - in this particular case, it's possible to just ignore the primary intent and decide whenever an intent to publish did exist instead - but sometimes it just fails. I think that's, for example, how PGP source code was exported, working around munitions export laws. [1] It must be dual. In a same manner formal logic can not be always applied to the realm of legal affairs, laws may malfunction when asked to handle problems from the domains they don't really map to.
    - 10y ago
rayiner 10y ago
Calling an SSN "a number" is reductionist even for a programmer. Does open() return an integer or does it return a file descriptor? Is it okay to do arithmetic on it and expect sensible results because it's just s number? In fact, programmers go out of their way to add a rich set of semantics and behaviors to things that are, under the hood, just numbers.
seanwilson 10y ago
>The case was eventually settled out of court, but the question remains whether it’s illegal to publish a specific number on the internet. The law currently seems to agree with Sony, that free speech doesn’t cover Hotz’s case. > One counterargument is that if a specific number is illegal to publish, then so is anything derived from that number. An excellent example of this is the Free Speech Flag There's obviously a huge difference between publishing a number and publishing a number with a message next to it saying "this number is the password for X". Clearly the intent of the law is to stop the latter.
posterboy 10y ago
The term embedding is hardly confusing. It would be impossible to prove the embedding, unless processing power raises, though.
jwatte 10y ago
The main problem is that parts of our society still treats social security numbers as off they were passwords. However, they are short, uniquely assigned, and not changeable - which means they are user names (identifiers.) (Same thing with finger prints, BTW.) Meanwhile, designing systems that can uniquely identify consumers/customers/employees/suppliers/students with a generally unique ID world lead to a reduction in error rates and increased efficiency. Security must be solved with told designed for it (state issued signing key/device?)

91 points by Labo333 10y ago

Social security numbers are in the uncanny valley between something private enough to be plausibly used as a shared secret and public enough to be exploited widely. There is really only one effective solution to this: Make all SSNs public and therefore useless as a secret key. All the services that are currently (ab)using this number will find alternatives.

tedunangst 10y ago
SSN is only one example. All your medical records, your entire genome can be represented as a number. Does that suddenly make it acceptable to publish?
- lisper 10y ago
  Any information can be rendered as a number. The whole idea that there's something special about numbers that makes them different from other kinds of information (i.e. it's OK to publish this "because it's just a number") missed the point rather badly.
gioele 10y ago
> Make all SSNs public and therefore useless as a secret key. An exhaustive list of all US SSNs will be mishandled, intercepted and posted online. It is only a matter of when, rather than if. (For precedents of whole-country database dumps, see the Turkish, Philippines and Qatar cases.)
- umanwizard 10y ago
  How do you make the leap from "something has happened in three countries" to "it will inevitably happen everywhere" ?
  - Qantourisc 10y ago
    (chance greater then 0) * (a lot of time)
    - jacobush 10y ago
      Right. Reminds me of how to destroy the earth. Just wait until its atoms decay.
    - umanwizard 10y ago
      This is wrong for a lot of reasons. The most obvious one is that it assumes the United States social security number system (and the United States itself) will exist for infinite time.
- RexM 10y ago
  Isn't the point that it is public? > Make all SSNs public
  - gioele 10y ago
    My (excessively hermetic) message was meant to mean: "All the SSNs will one day be public. Even if the legislator does not make them public, they will leak one day anyway."

chroma 10y ago

I desperately want to read a lawyer's answer to the questions raised by the author. My bet is that most of the gray areas exist simply because no cases involving them have been litigated. If such cases ever go to trial, courts will probably rule in a rather common-sensical way, such as by creating a bright-line rule[1]. 1. https://en.wikipedia.org/wiki/Bright-line_rule https://en.wikipedia.org/wiki/Bright-line_rule

deleted 10y ago
[deleted]
sandworm101 10y ago
Lawyer answer (in general terms and without citations): All intellectual property rights are limitations on free speech. Courts rule against the publication of exact copies, or identical copies in different media, every day. IP law requires courts to prevent copying else it be meaningless. The flag is not an expression of a new idea, it is a facsimile of a protected number, protected data little different than a copyrighted movie or patented design. Its publication could only be legal as some sort of "fair use", but exact copies that directly impact the financial viability of protected material rarely fall within fair use. They would rule against the flag. If persons want to express themselves using this material, they need to add some form of comment so as to avail themselves of fair use protection. Add a stripe to the flag and get back to us.
- j2kun 10y ago
  What about the computational power question? At what point does it become illegal to publish an encrypted SSN/illegal number if you know it takes 1 day to break the encryption using current computational power? What about 10 days? a year? ten years? a hundred years? a thousand years? And what if computational power changes, and a thousand years turns into 1 day? Does the action become illegal retroactively?
  - roel_v 10y ago
    Those are meaningless questions. It's trivial to think of 100's of hypos and go 'is this legal? Is that legal?' 1000's of first years do that every year because they think that's what being a lawyer is about, not to mention the amateurs. A judge however considers one specific case, with arguments as to what is the objective reality as presented by the parties. 'What ifs' don't matter. Law is not a closed rule-based system. 'Loopholes' (I loathe thay word) are not like buffer overflows. (have law degree, not practising lawyer)

nl 10y ago

This is the perfect example of what happens when a programmer (or in this case a mathematician) thinks that the law operates like a computer. It doesn't. The law is interpreted by humans, based on case law, and attempts to understand the intentions of the law as written. Many programmers don't like this, but that is how the law operates. (If the author would like to go down another rabbit hole, perhaps he should consider if encrypted information is actually published at all. After all, well designed encryption renders information quite close to random noise in the absence of a key. Perhaps making encrypted information available isn't actually publishing - maybe it is the act of posting how to decrypt it that is the act of publishing. Note that here, the law would answer "it depends", and that is fine.)

pliny 10y ago
More on this distinction is available here: "What Colour are your bits?" http://ansuz.sooke.bc.ca/entry/23 http://ansuz.sooke.bc.ca/entry/23
- Analemma_ 10y ago
  And the follow-up article, which discusses the usual objections that programmers have to the original article: http://ansuz.sooke.bc.ca/entry/24 http://ansuz.sooke.bc.ca/entry/24 . Particularly noteworthy is a comment from a lawyer that a key misunderstanding among programmers is that in law, the humans and their social interactions are the first-class entities of the system, not second-order distractions as they tend to be in engineering. This was a very enlightening moment for me in my journey towards understanding why the law seems so absurd from a mathematical perspective.
  - haasn 10y ago
    Indeed, the only absurd thing about the law is when people try to flirt with it by treating it mathematically.
- haasn 10y ago
  I think this article does a fantastic job of illustrating why legal problems (determining or enforcing the Colour of something) can never possibly be solved through the use of (colourless) technology - the two are fundamentally incompatible. This is, for example, the reason why DRM has never ever stopped people from sharing copyrighted works - because DRM is trying to solve a legal problem (the Colour of bits) by using a function of those bits (technology), it is destined to fail.

haasn 10y ago

At some level, laws inherently have to be up for interpretation, and operate on some level of abstraction above the intimate details - because virtually everything in life is a spectrum, including the applicability of a given law. In the “fringe zone” in which it's not clear whether a law applies or not, judges have to resort to individual judgement on a case-by-case basis. This is not something that's new or unique to technology, although technology does a fantastic job of illustrating the difference between a legal problem and a technological problem - as well as the different mindsets you have to approach both with.

Al-Khwarizmi 10y ago

"now that it’s public, you have to wonder whether this will bite me in the ass when I’m 60 (...) and my identity gets stolen" Could someone from the US care to explain why publication of these numbers is such a big deal, and why it can lead to identity theft (an idea that I see often on the internet)? In Spain we have a unique ID number and it is pretty common to see them published all over the place. The government and administrations routinely publish lists of people with their name and ID number, for example if you have applied for a public sector job, a government grant, etc. your ID number will be published in a list that everyone can see and even find on Google. We don't see it as a problem because knowing someone's ID number doesn't mean you can steal their identity - to do that they would need to forge the actual ID card, for in-person procedures, or steal passwords or keys, for online stuff. Knowing the number alone doesn't give you access to anything. In fact, it is publicly known that the current king has the ID number 15 and the former king 10 (number 1 corresponded to dictator Franco who created the system), but it's not that easy to go around impersonating the king :) What can you do if you know a person's social security number in the US?

jtarrio 10y ago
I'm Spanish too, so hopefully I can explain. The problem is that everyone treats the SSN as if it were a secret number known only to you, so they use it as both an identifier and an authenticator. In Spain, however, most people know to use the DNI number as just an identifier, using other methods (most typically, physical presentation of the ID card) for authentication.
LukeShu 10y ago
A huge number of firms treat the SSN as "private" and having knowledge of an SSN proves that you are that person. It's not what they were designed for, but good luck explaining that to the electric company and the gas company and the credit card company and the bank... "What can you do?" With Duke Energy, the electric provider in my last apartment complex, you would have absolutely no problem registering for electric in someone else's name and having them on the hook for it if you knew their SSN.
rhino369 10y ago
For some reason a lot of businesses treat SSN as a secret password. Our numbers aren't supposed to be published, but they are used so often they aren't really secure. You can do stuff like apply for lines of credit using a SSN. If you use my name and my number its presumed to be me applying for the credit.

davidgerard 10y ago

The trouble with this logic - to which I am not entirely unsympathetic - is that under it, a computer program binary would also constitute an "illegal number". "You've copied Microsoft Office!" "Nonono, that's just a very large number in binary." The actual answer is: the law is all about intent.

lisper 10y ago

It is not illegal to publish a social security number. Watch this: 268-91-7112 That is a social security number, but I guarantee you I will not be prosecuted for publishing it. What is illegal is publishing the binding between a particular social security number and a particular person. Geeks get way too hung up on this idea that publishing these things should be OK because "they're just numbers." No, they are not "just numbers". They are numbers with some associated semantics. This number is Bill's SSN, that number is Sony's secret key. It's the semantics that matter, not the number.

bjornsing 10y ago
There are interesting paradoxes though when you mix "legalistic" and "geeky" worldviews. :P E.g. let's say somebody publishes the statement "one of the prime factors in Bill's SSN is 7"... and then someone else, independently... ;P You get the point! :)
- izacus 10y ago
  Then you look at them, determine their intent (to publish Bill's SSN) and punish them or not accordingly. That's the point of the legal system and judges - as opposed to computer code they actually tend to try and determine intent as an important part of a ruling.
  - drdaeman 10y ago
    The problem is, the intent of such action is, most probably, to just fuck with the law (requiring it to solve the task it can't work on, because its from the different realm[1]), not to publish Bill's SSN. Legal system may try to handle the issue - in this particular case, it's possible to just ignore the primary intent and decide whenever an intent to publish did exist instead - but sometimes it just fails. I think that's, for example, how PGP source code was exported, working around munitions export laws. [1] It must be dual. In a same manner formal logic can not be always applied to the realm of legal affairs, laws may malfunction when asked to handle problems from the domains they don't really map to.
  - 10y ago

rayiner 10y ago

Calling an SSN "a number" is reductionist even for a programmer. Does open() return an integer or does it return a file descriptor? Is it okay to do arithmetic on it and expect sensible results because it's just s number? In fact, programmers go out of their way to add a rich set of semantics and behaviors to things that are, under the hood, just numbers.

seanwilson 10y ago

>The case was eventually settled out of court, but the question remains whether it’s illegal to publish a specific number on the internet. The law currently seems to agree with Sony, that free speech doesn’t cover Hotz’s case. > One counterargument is that if a specific number is illegal to publish, then so is anything derived from that number. An excellent example of this is the Free Speech Flag There's obviously a huge difference between publishing a number and publishing a number with a message next to it saying "this number is the password for X". Clearly the intent of the law is to stop the latter.

posterboy 10y ago

The term embedding is hardly confusing. It would be impossible to prove the embedding, unless processing power raises, though.

jwatte 10y ago

The main problem is that parts of our society still treats social security numbers as off they were passwords. However, they are short, uniquely assigned, and not changeable - which means they are user names (identifiers.) (Same thing with finger prints, BTW.) Meanwhile, designing systems that can uniquely identify consumers/customers/employees/suppliers/students with a generally unique ID world lead to a reduction in error rates and increased efficiency. Security must be solved with told designed for it (state issued signing key/device?)