4 ms·

You know, it's possible to simultaneously be critical of the government request for data, and the very real concerns that of course they won't successfully anon

You know, it's possible to simultaneously be critical of the government request for data, and the very real concerns that of course they won't successfully anonymize location data, and also have a realistic view that Uber wants to "sell" your data, not "protect" it.

skybrian 10y ago
I don't know about this: "of course they won't successfully anonymize location data". Yes, it's well known that they screwed this up. But that doesn't mean that we should therefore distrust them forever. Although it's tricky, figuring out the right level of granularity for revealing taxi ride data to the public seems doable, and we shouldn't let cynicism prevent all attempts at a compromise.
- smallnamespace 10y ago
  The fact that they screwed it up in the past means they demonstrated a lack of ability to get it right. Unless we have strong evidence that they've fixed that deficiency, it seems unwise to repeat the same mistake. Better safe than sorry seems like the right heuristic here given that once private data is released in the wild, it will remain public forever [1]. [1] https://www.reddit.com/r/bigquery/comments/28ialf/173_million_2013_nyc_taxi_rides_shared_on_bigquery/ https://www.reddit.com/r/bigquery/comments/28ialf/173_millio...
  - anigbrowl 10y ago
    Yeah, and companies in the private sector screw up n similar fashion on a regular basis. What strong evidence do you want that they've fixed the deficiency? Government is about as open organizationally as any entity - you can serve FOIA requests asking what government has done to mitigate some past screwup and get back reams of documentation, which is more than you can say for private entities. I seem to remember Uber having its own history of privacy violations.
    - smallnamespace 10y ago
      Easy - propose a process for releasing data, and get it publicly vetted by privacy/security researchers. I'm pretty sure anyone who understands basic crypto would know that MD5 hashing low-entropy text fields is problematic. The fact that they missed this means they just handed this procedure off to a random coder who didn't know any better. That doesn't sound like at all like a sane process for releasing gigabytes of highly personal data. Private companies have their own issues, obviously, but just because A is bad doesn't mean we should lower our standards for B. Also, private companies have your data because consumers interact with them directly, so at least there is some implicit consent involved. But I'm less convinced that they should be forced to hand that data over to public agencies that have only a very tangential relationship with the user. If I take an NYC cab ride, why should the city government get to see that, especially if I don't live there?
      - anigbrowl 10y ago
        As for your cab ride, because the government of NYC is who people turn to when they have problems with their cab ride and don't get satisfaction from the cab company. Honestly, talking to some people it's like they were living in some free market garden of Eden one day and then government came along and ruined everything. People institute governments to 'secure their rights'; it's your choice to take an oppositional attitude rather than a participative one towards government. You are the one saying you want certitude about the security of information held by government; why not propose your preferred standard for how data should be released, maybe get some peer security experts to refine it or agree on a suitable candidate, and then promote its adoption by government with an economic argument? It seems not to have crossed your mind that government failure is often the result of past policy decisions imposed by representatives or the voters themselves on how things should be done, and that they're often mandatory for the people who work in government. They may know a policy or procedure or person's performance is flawed, but lack the legal or budgetary authority to do anything about it. Sometimes inefficient policies are in place as a political payoff to a corporation, union, or individual - corruption is a problem, and legislatures are essentially political marketplaces, and subject to certain failures of markets. Other times inefficiencies are just unintended consequences of well-intended legislation that was poorly crafted, or outlived its usefulness, or conflicting imperatives that lead to legal race conditions. Try thinking of government as the operating system (or platform if you prefer) of society. It's buggy, bloated, nominally open but actually with a bunch of closed-source stuff in it, some people mine it for exploits or sneakily implement their own, and so on. You have this huge codebase written in multiple languages running on all sorts of legacy institutional hardware, all strung together in a giant embedded system that is supposed to operate 24-7, often under difficult conditions. Oh, and there's bitter disagreement between two factions of developers with radically different ideas about, well, everything. Refactoring this isn't an easy undertaking. I suggest to you that the problems of government are similar to the problems of a large software project, and involve many of the same sort of trust problems that operating systems do. Consider that there is a relatively small number of successful operating systems/platforms, none of them were built overnight, and they all suffer from various faults and have interoperability issues - some by design, some by oversight. Your black-box approach to government is of limited utility because it's not like you can easily swap it out for a better one.
maverick_iceman 10y ago
With a private business I can always decide to stop using their services. The problem with government is there is no legal way to escape it.
- deleted 10y ago
  [deleted]

skybrian 10y ago

I don't know about this: "of course they won't successfully anonymize location data". Yes, it's well known that they screwed this up. But that doesn't mean that we should therefore distrust them forever. Although it's tricky, figuring out the right level of granularity for revealing taxi ride data to the public seems doable, and we shouldn't let cynicism prevent all attempts at a compromise.

smallnamespace 10y ago
The fact that they screwed it up in the past means they demonstrated a lack of ability to get it right. Unless we have strong evidence that they've fixed that deficiency, it seems unwise to repeat the same mistake. Better safe than sorry seems like the right heuristic here given that once private data is released in the wild, it will remain public forever [1]. [1] https://www.reddit.com/r/bigquery/comments/28ialf/173_million_2013_nyc_taxi_rides_shared_on_bigquery/ https://www.reddit.com/r/bigquery/comments/28ialf/173_millio...
- anigbrowl 10y ago
  Yeah, and companies in the private sector screw up n similar fashion on a regular basis. What strong evidence do you want that they've fixed the deficiency? Government is about as open organizationally as any entity - you can serve FOIA requests asking what government has done to mitigate some past screwup and get back reams of documentation, which is more than you can say for private entities. I seem to remember Uber having its own history of privacy violations.
  - smallnamespace 10y ago
    Easy - propose a process for releasing data, and get it publicly vetted by privacy/security researchers. I'm pretty sure anyone who understands basic crypto would know that MD5 hashing low-entropy text fields is problematic. The fact that they missed this means they just handed this procedure off to a random coder who didn't know any better. That doesn't sound like at all like a sane process for releasing gigabytes of highly personal data. Private companies have their own issues, obviously, but just because A is bad doesn't mean we should lower our standards for B. Also, private companies have your data because consumers interact with them directly, so at least there is some implicit consent involved. But I'm less convinced that they should be forced to hand that data over to public agencies that have only a very tangential relationship with the user. If I take an NYC cab ride, why should the city government get to see that, especially if I don't live there?
    - anigbrowl 10y ago
      As for your cab ride, because the government of NYC is who people turn to when they have problems with their cab ride and don't get satisfaction from the cab company. Honestly, talking to some people it's like they were living in some free market garden of Eden one day and then government came along and ruined everything. People institute governments to 'secure their rights'; it's your choice to take an oppositional attitude rather than a participative one towards government. You are the one saying you want certitude about the security of information held by government; why not propose your preferred standard for how data should be released, maybe get some peer security experts to refine it or agree on a suitable candidate, and then promote its adoption by government with an economic argument? It seems not to have crossed your mind that government failure is often the result of past policy decisions imposed by representatives or the voters themselves on how things should be done, and that they're often mandatory for the people who work in government. They may know a policy or procedure or person's performance is flawed, but lack the legal or budgetary authority to do anything about it. Sometimes inefficient policies are in place as a political payoff to a corporation, union, or individual - corruption is a problem, and legislatures are essentially political marketplaces, and subject to certain failures of markets. Other times inefficiencies are just unintended consequences of well-intended legislation that was poorly crafted, or outlived its usefulness, or conflicting imperatives that lead to legal race conditions. Try thinking of government as the operating system (or platform if you prefer) of society. It's buggy, bloated, nominally open but actually with a bunch of closed-source stuff in it, some people mine it for exploits or sneakily implement their own, and so on. You have this huge codebase written in multiple languages running on all sorts of legacy institutional hardware, all strung together in a giant embedded system that is supposed to operate 24-7, often under difficult conditions. Oh, and there's bitter disagreement between two factions of developers with radically different ideas about, well, everything. Refactoring this isn't an easy undertaking. I suggest to you that the problems of government are similar to the problems of a large software project, and involve many of the same sort of trust problems that operating systems do. Consider that there is a relatively small number of successful operating systems/platforms, none of them were built overnight, and they all suffer from various faults and have interoperability issues - some by design, some by oversight. Your black-box approach to government is of limited utility because it's not like you can easily swap it out for a better one.

maverick_iceman 10y ago

With a private business I can always decide to stop using their services. The problem with government is there is no legal way to escape it.

deleted 10y ago
[deleted]