17 ms·

It’s time for a digital protection agency

253 points by adrian_mrd 9y ago

Mononokay 9y ago
What did people really expect would happen with Facebook? It's social media, not a file storage service - of course your data isn't going to be private. It's more or less what you should expect when signing up on any social media platform.
- wu-ikkyu 9y ago
  It's naive of technical minded people to think the average person could imagine the types of things you can do with big data sets and algorithms.
  - Mononokay 9y ago
    The average user's mindset must have changed from when I was younger - mass hysteria over what people and companies online might be doing with your personal information was standard.
    - maksimum 9y ago
      > The average user's mindset must have changed from when I was younger Yes, for a simple reasons: the average web user today is basically the average person. The average web user 20-25 years ago was a technology enthusiast.
      - Mononokay 9y ago
        I was talking moreover of the Myspace-era than the Usenet-era.
      - drak0n1c 9y ago
        My parents have very minimal technical abilities and they’ve always been paranoid about putting any personal info on a paper form and that extended to the internet when things moved online. They always left the birthdate field blank on forms. I was under the impression that most Boomers grew up being wary of privacy whether conservative or liberal, and it was GenX and Millenial who would give their data to anyone.
        Tempest1981 9y ago
        It's good that your parents are informed, and care about privacy. Many are uninformed, so have no idea. Then, like you said, there are those who don't care about privacy, even if informed.
- ggregoire 9y ago
  They have names, phone numbers, locations, calls history and who-knows-what about people who have not signed on Facebook. They just take all these data from your friends' smartphones contacts list.
  - lopmotr 9y ago
    When I was a kid, everybody's name, address, and phone number was published in a phone book. Why does everyone feel like that's private information today? For some special people, yes, but for just about everybody, it's fine for others to be able to contact them. If I wanted to be kept hidden, I'd have to be careful who I gave my secret information to. If I trust my friends, and they carelessly give it to Facebook, that's my fault for carelessly trusting untrustworthy friends.
    - slededit 9y ago
      Back then long distance was expensive so you didn't get scammers outside of the US calling you. Local police are currently unable to deal with the deluge of foreign scams making protecting your private information much more important.
    - e12e 9y ago
      The key difference is how easy it is to correlate different digital datasets. The phonebook gives you name, address and phone number. Call logs give you pairs of phone numbers. Together you know who knows who. Add in the yellow pages and you know who called the suicide hotline. Mix with taxi data and you know who visited who, what time. And who went to an abortion clinic. Or a place of worship. Or who knows more than ten people that regularly worship. Etc. Getting all that for everyone as opposed to a certain targeted someone is much, much easier with digital records. [ed: this is why many countries have had strict rules on digital databases of personal (not just sensitive) data a long time, well before the GDPR. The amount you can learn from "simple" correlations of even public data can be staggering.]
- rickycook 9y ago
  it’s partly that people didn’t even think about it rather than didn’t expect it i guess? “what did people expect” implies that they had enough of an understanding of where their data is stored, and put enough thought into it in order to form an expectation of any kind and that’s before you get to the unintentional tracking in things like like buttons, friends’ data that you have no control over, etc
- e12e 9y ago
  I certainly expect my phone company to not record my calls, or my isp not to mine my email. The problem isn't that fb is social media; or that Google/Gmail is an email provider - it's that both of them are ad agencies and private intelligence agencies (they gather, refine and sell information; ie intelligence). So it really is: Facebook is an intelligence agency and information broker: why would you supply information on yourself and your friends to them. And the answer is likely: I didn't know they were an intelligence company; I thought they were a (social) personal media platform. Like email or a blog, only slightly more modern. And this isn't a wild expectation. Eg the telephone providers are regulated, and can't sell the content of your calls, even if it's "just" if you're talking about a recent pregnancy, or how you're thinking about buying a car...
  - dredmorbius 9y ago
    Your phone company has, in all liklihood, maintained a log of all your calls, dating to the 1980s. https://www.schneier.com/blog/archives/2006/03/atts_19trillion.html https://www.schneier.com/blog/archives/2006/03/atts_19trilli...
    - e12e 9y ago
      I'm sure Norwegian military intelligence has a semi legal access to meta data and contents of my calls: but at least it's clearly illegal for them. The largest isp/phone provider (telenor) actually fought back against the eu data collection directive because they had to store more data than they currently did (3 months). But yeah, data protection in the private sector in the US is dismal.
Mediumium 9y ago
Silicon valley didn't fail at all. The main business model of a lot of silicon Valley businesses is based upon selling, buying, trading and using people's personal data, so considering this they didn't fail at all. Edit : IMO to solve privacy we need to create another business model which is obviously not based on data / advertising.
manigandham 9y ago
As usual, a bunch of nonsense by people who have no idea about this. The fundamental problem is that digital advertising is a 12-figure global industry with practically 0 oversight and regulation. This is an industry that sells influence at scale. Anyone with a credit card can start changing how people think and act but there are absolutely no real consequences for bad actors. Even the most minimal laws around who can advertise and how would radically change everything. Google has even more data than Facebook. Amazon has just as much. Your ISP has just as much. These silly little projects to chase the latest scandal will do nothing in the long run. The only way to fix anything is to regulate the core, not try and fix every little symptom that occurs. * Before the inevitable comments, yes advertising works, yes it works on you no matter how much you think otherwise, and no adblockers dont magically solve everything.
- BrentOzar 9y ago
  > yes advertising works, yes it works on you no matter how much you think otherwise And even if you think it doesn’t, it works on enough other people to make it a worthwhile spend if you want to win an election or get regulation passed.
  - bloak 9y ago
    I'm sure some advertising "works" on some people, but I've met some of the people who buy the advertising on behalf of big companies that produce consumer goods, the people who decide which advertisers get the big contracts and which campaigns get approved, and those people were not exactly of a scientific bent. I think it would be very easy to con them, and probably they get conned a lot of the time. Also, I can think of a couple of cases in which I was planning to buy a product, but changed my mind because of an advertisement for the product. In one case the advertisement made me consider a particular aspect of the product, which lead to me reevaluating and choosing an alternative product. In the other case the product was an alcoholic beverage, which I liked the taste of, but the advertisement made me embarrassed to be in any way associated with the product. In a way that proves that advertising works, but I would guess it's a lot easier to influence people against something rather than for it, even accidentally. And this is perhaps very relevant to political advertising, which often is "against" something.
tscs37 9y ago
Tbh, I don't trust any corporation in the US to keep my data safe anymore. You can't fix that kind of reputation damage
organsnyder 9y ago
Regardless of how well you feel this article is written whether you agree with it, it's important to not ignore it and others like it. This reflects a growing sentiment among much of the population—address their concerns, or regulation will do it for you (likely in a sub-optimal, if not counterproductive, way).
- domevent 9y ago
  That ball is already rolling downhill, and I don’t think it can be stopped. In addition to the perfectly reasonable concerns of a few billion people, there are also some very wealthy and entrenched media interests who only stand to gain by kicking it along. I don’t think the reputation of tech is salvageable at this point, and the result will be having to live with regulation and oversight like every other industry. Even if everyone shaped up overnight (and they won’t) there is still so much yet to emerge into the public light about what has already happened. Uber and Facebook alone have almost certainly only just begun to bleed scandal.
  - laen 9y ago
    > the result will be having to live with regulation and oversight like every other industry. The only other industry I think could be comparable to this, from a privacy standpoint, would be the banking industry. They are largely flying under the radar during all of this, any hypothesis why? Is it because their regulation and oversight is working like you are alluding to? Or is it because the banking industry has not been caught...yet?
- jeoeo8383 9y ago
  Anyone that can build a project from a “build a web app in 24hrs!” is capable of building a private replacement for these things These svcs just strike me as so worthless that we should be spending the resources on the data centers. I share family moments via some raspberry pi’s running sync thing Just copy photos from phone over to a Samba share, and grandparents, aunts, uncles get a refresh Facebook especially is utter novelty. Twitter I use for local alerts. Cause rss couldn’t raise a bunch of IPO dollars This social thing needs to drop off a bit. A Facebook implosion might be a good thing
mlb_hn 9y ago
The author's suggested fix is "Let’s make a digital Environmental Protection Agency. Call it the Digital Protection Agency. Its job would be to clean up toxic data spills, educate the public, and calibrate and levy fines." A couple upfront issues with this: 1) "cleaning up toxic data spills" - this doesn't seem well worked out, unless the author suggests going and deleting the stolen data off others' computers 2) "educate the public" - the author suggests explaining how to deal with identify theft. That's great, but doesn't address the secondary issues of advertising/propaganda/other clever unintended uses of data.
- Mononokay 9y ago
  It also only really works for things that happen domestically - watch as every social media company moved overseas. Social media companies are in the wonderful position as to where they don't have to take money outright from users to operate, so they can claim they don't operate in any country they'd like to claim they don't, and can move to a foreign country with a lower tax rate without harming themselves at all really. With no users exchanging currency and no (retail) physical presence they're incredibly free as far as mobility goes. Unless I'm missing something about this all, it's surprising that it's not common for them to.
  - JumpCrisscross 9y ago
    > It also only really works for things that happen domestically - watch as every social media company moved overseas A limited solution is better than no solution.
    - Mononokay 9y ago
      In some cases, it isn't. This would be one of those cases - tax increase because of the spending increase required for a new department, little benefit in practice, anti-free market, etc. It's a culture issue, not particularly a regulation issue. Fining companies for doing with data exactly what they say will be done with data in their ToS (Granted, ToSs are a terrible concept - they are legal and enforcable depending on how the government is feeling for the day, though) would allow the government to effectively shut down platforms it didn't like by fee. Proposing a department to "Calibrate and Levy Fines" upon media is bizarre. The proper thing to do would be solely focusing on educating the populus, or alternatively funding the EFF to do it for them.
ig1 9y ago
Most developed countries have an agency dedicated to data protection. The UK has the ICO, Japan has the Personal Information Protection Commission, Canada has the Office of the Privacy Commissioner, Switzerland has the FDPIC, etc. Their exact role varies from country-to-country but the US is one of the few modern countries to not have a national body dedicated to the field.
- wooter 9y ago
  I've never found "everybody's doing it" to be compelling.
  - r3bl 9y ago
    How about "everybody's doing it for a good reason"?
    - rickycook 9y ago
      like the metric system which is to say, i think momentum is the issue
- ggregoire 9y ago
  The CNIL in France, created in 1980.
- walterbell 9y ago
  FTC in the US.
  - e12e 9y ago
    Indeed. I came across this, which should probably be of interest to readers in the US: https://www.ftc.gov/public-statements/2016/01/two-way-street-us-eu-parallels-under-general-data-protection-regulation https://www.ftc.gov/public-statements/2016/01/two-way-street... However, I seem to recall, that last time I checked (several years ago) there appeared to be very slim data protection in the US. Or rather, somewhat strict rules for the federal government, few or no rules for private business. To the point of federal agencies contracting out databases to firms, so as to dodge legislation...
dictum 9y ago
I can't wait for the 2023 thinkpieces on how the Digital Homeland Protection Agency or some such has been taken over by purveyors of ungood ethics and we must do something about it.
marknadal 9y ago
Oh my goodness, the solution is to spend billions on a government agency? Seriously, you can just use encryption for free. People are building entire apps around E2E P2P tools that exist today: https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-with-e2e-encryption-f90505b2ff8 https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi...
jeoeo8383 9y ago
General public does its usual thing; ignores the reality Eventually freaks out and demands everyone be held accountable for their past indifference Let’s fix a thing we don’t need! Cause private IM and chat are lame. The world must know I exist! (Or at least I must feel that’s the case) and watch me go about doing things people been doing forever! Oh those sunset shots and cat pics! Oh those pop culture references! TV 2.0 is right
jaequery 9y ago
Regardless of regulations, I feel you can’t really stop what the employees do with the data. For every company, there is an employee who have the key to your data just doing their jobs, be it devs verifying data to sysadmins managing the backups. Sure you can have better auditing procedures and analyzing logs, but if its the group of guys especially at the head, its hard to prevent that. Social hacking is happening without us knowing it and that is what worries me more.
zmix 9y ago
I thought you guys are "Silicon Valley"?!
gerash 9y ago
Perhaps one solution could be to keep your personal data encrypted but then if you need an online service you'll need to somehow let the services access it. That's the part where it gets tricky. Either the code working on your data is sandboxed from the outside world which sounds impractical. What if needs to talk to other backends. Alternatively the operating system ACL framework is super granular so you can give the service the minimum amount of data it needs. Or another solution could be a way to easily see which entities/apps have access to your data and the time they accessed them. Like some sort of an audit log with accessible UI. A non-profit agency is nice and all but doesn't give much guarantee.
dqpb 9y ago
It's been interesting to see how much press Facebook, and to a lesser degree Google, silicon valley, and "tech" have been getting lately. I look forward to when the press seriously talks about the truly evil organizations that are physically drugging, poisoning, and killing people and our environment.
sqdbps 9y ago
The US must not introduce any laws detrimental to US companies especially when China is bolstering their tech firms (and stealing our IP) and the EU is trying everything short of altogether outlawing US tech companies out of their market. Just ride out this silly populist convulsion and we'll all be the better for it.
- llukas 9y ago
  Protect US companies but screw US people? Did you forget about Equifax leak? Why everybody else can have their data protected by not US people?
  - sqdbps 9y ago
    Generally what's good for US companies is good for the US and its people, I'm fine with a legislative response to the equifax breach, something along the line of mandated disclosure and penalties for lax security but we are in the midst of a global battle and so our tech firms must be protected and not assailed by our gov't.
    - sparkie 9y ago
      The same lack of regulation over what Google, Facebook et al can collect about you is also lack of regulation over what Huawei, Xiaomi et al can collect about you. It's not giving US companies any competitive advantage. The Chinese companies have the advantage that they're also collecting the data on Chinese citizens, which is out of bounds of US companies unless they're conducting shady deals with the Chinese government.
- sparkie 9y ago
  China isn't just "stealing IP", they're also innovating in means of production. It's not just "cheap labor" that people get things produced in China for anymore - it's because China is way ahead of anyone else in production capabilities, costs and speed US companies can't compete with China when they're sending all of their production over to China. You've placed too much emphasis on ideas and not enough on actually making them, because the attitude "China can make it at lower cost." IP laws are really what are stifling US companies. They're exhausting huge amounts of resources on building up IP portfolios for the sake of entering (or avoiding) legal battles over "I thought of that first." You have zero chance of competing against China when you're fighting among yourselves over who gets the biggest piece of the shrinking pie.
tedwilliamshock 9y ago
Protect it yourself. -> https://spreadprivacy.com/duckduckgo-privacy-challenge-2018/ https://spreadprivacy.com/duckduckgo-privacy-challenge-2018/
johnnyOnTheSpot 9y ago
This is all a very new problem only seen under the new POTUS.
- johnnyOnTheSpot 9y ago
  Given the massive uptick in stories around Facebook, it would seem this statement would be true.
cowmix 9y ago
As a side note. In the past 5 years of doing serious contracting work in every industry you can think of (pharma, banking, manufacturing, etc) the places where I have seen info sec taken the most seriously are two: gaming studios (any) and Bloomberg.
riazrizvi 9y ago
Google built an algorithm that promoted Alex Jones 15 billion times to vulnerable people. I wonder are they systematizing established marketing influences, or are they creating a new era of conspiracy theory prone populations because those types of articles have better click-through rates for ads?
duncan_bayne 9y ago
Silicon Valley, huh? I wonder how many trackers appear on the Bloomberg page. Let's see ... 14, according to Ghostery: * Doubleclick * Lotame * Scorecard Research * Taboola * SailThrough Horizon ... and nine more. In the unlikely event anyone from Bloomberg is reading this: fuck you, you hypocrites.
arez 9y ago
...They pay taxes... wtf :'D
shmerl 9y ago
> Silicon Valley Has Failed to Protect Our Data. They are joking, right? FB was never about protecting data, it was always about profiting from selling it.
ausjke 9y ago
that's indeed scary, but I saw no way out, but I will do the followings: 1. remove my rarely used facebook account. 2. remove twitter account. 3. remove gmail, use outlook email instead, probably host my own email. 4. for private messenger, use 'signal' app instead. 5. use vpn more. There are more stuff I could not remove though, e.g., my Amazon account, ebay and paypal, etc, also my account and posts at HN, hi I can not even remove my posts not to mention my account at HN, will HN sell me someday or is it doing this already? The only solution I see, is that paying for all those services: pay for twitter, facebook, gmail etc, so they do not need your personal info to profit? of those they need supervise, means if they still violate my privacy after I paid, sue them to hell.
- j605 9y ago
  The problem with using signal is getting your contacts on it as well. You could always switch email providers but not chat applications.
soared 9y ago
The problem with Facebook is it allows people to gather data about a user and their friends. Literally every single other platform (including google) can gather data about you but not your friends. That is the current problem that needs to be immediately solved IMO. After the obvious, easy win then we should move on to more difficult regulation like others have suggested.
- 908087 9y ago
  > Literally every single other platform (including google) can gather data about you but not your friends. That's not true at all. Google gets things like contact lists, SMS data, call data, etc.. which all certainly contain information about your friends.
AlphaWeaver 9y ago
The explanation of HIBP went a tiny bit overzealous... > For example, the website of Australian security expert Troy Hunt, haveibeenpwned.com (“pwned” is how elite, or “l33t,” hackers, or “hax0rs,” spell “owned”),
plorg 9y ago
I have a loosely imagined regulatory solution to the particular problem of secretive data brokerages and user targeting. It works at follows: * Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user. * Ad and data brokers are required to provide a chain of discovery detailing where the individual ad or data entity received information that contributed to the targeting of the user. (I think this was hit upon in TFA, but it was difficult to get through with the focus as it was mostly on credentials and PII). * Firms which hold user targeting information and information on individual user preferences are required to allow users to have their records removed from the firm's database. I'm sure this seems punitive to the companies it would affect, but I'm not sure that's a problem overall. It allows people to control the information that is collected about them and puts the onus on the companies benefiting from that information. If user targeting really does help in product discovery and user preference marching, then the ad and data companies will be rewarded, and the price of regulation will be the cost of information transparency. If it turns out that users really don't want to have dozens of companies tracking their every move then the advertising business model will be starved and make way for companies with more innovative, user-friendly business models. Edit: autocorrect fucking up words that autocomplete originally predicted correctly.
- michaelbuckbee 9y ago
  If you haven't already, you might enjoy reading the EU's forthcoming GDPR regulations [1] they cover all of this and much, much more including things like: - data should be exportable in digital formats - you can request what information a company has about you regardless if you're a full "user/customer" (think of things like how FB tracks anyone who visits a webpage with a Like button). - you have the right to request a manual review of computer made decisions (ex: a credit approval) - right to have your data corrected/fixed if it's listed incorrectly - right to escalate to each country's "supervisory authority" (this is the agency within each country that handles things) - serious fines in case of non compliance (% of revenue, not a flat amount) 1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-english https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
  - 9y ago
tbabb 9y ago
I've been saying for years that software engineering needs to be elevated to the same standards held by other engineering fields; like civil, mechanical, biomedical, and so on: If an engineer or a firm is negligent and people die and/or millions of dollars are lost, they are kicked out of the industry/lose their right to operate as a business. For example: To work on cryptography and security, you need a degree and to have passed certification, perhaps at regular multi-year intervals. Then if you build a login page and store the unsalted passwords in plain text and someone pwns your site, you lose your license, could be fined, sued, or possibly go to jail if your negligence is criminal. Then, if you are a company and you need a login system, you either (a) hire certified software engineers to write one, (b) subcontract a certified firm, or (c) license a certified off-the-shelf solution. If pwnage happens, the company is liable if they failed to do one those things. Therefore it becomes in the interest of companies to do security correctly, and of engineers to only attempt it if they are competent and qualified. It's really simple: In other fields of engineering, there are consequences if you fuck up. If you design a bridge that falls down and kills people, you lose your career, are sued, and/or go to jail. Not so in CS. That needs to change.
- nitrogen 9y ago
  Consequences and credentialism don't have to go hand in hand. Software's lack of credentialism is what allows so many to rise above their circumstances, break through class barriers, etc.
  - tbabb 9y ago
    Somehow I doubt you would apply that argument to designing bridges, or medical practice, or airline piloting, or bus driving, or law, or any of a zillion other professions where credentials are normal and essential to safety and liability. We don't let random schmoes do those other things-- aspiring and starry-eyed or not-- without first proving that they know what they're doing. We certainly don't wait until the bridge has fallen down or the plane has crashed or the patient has died before we put a burden on the professional to certify their competence. I don't think it's unreasonable to mandate rigorous certification for life-critical, security-critical, and financial software engineering. You can write a cookie clicker with a high school degree and put it online if you want. But the moment your cookie clicker takes credit card numbers, you should be legally obligated to know what you are doing or hire someone who does.
Nomentatus 9y ago
"YouTube. It has users who love conspiracy videos, and YouTube takes that love as a sign that more and more people would love those videos, too." Not exactly. YouTube sends everybody down rabbit holes, because it adores sticky topics and video sources (more views, more $), and so rewards those who create a bit of an information monopoly by simply lying; after which, one of their videos leads you to another one of their videos. Nobody else is making videos on that, 'cause you made it up. You win. Novel "information" is more likely to be viewed through, and then followed up on with searches for more on the topic. So make up, and YouTube is all about you, thrilled to facilitate the niche info-market you've created out of thin air or wildly exaggerated. Merely having your own misleading phrases to refer to your bent views will be heavily rewarded by search engines including Google's and YouTube's. For example: "I wrote about this in my new book, Algorithms of Oppression: How Search Engines Reinforce Racism. In it, I discuss Dylann Roof, the Charleston mass murderer, who said he Googled the phrase “black on white crime” after the Trayvon Martin shooting. He has talked about how important that experience was in forming his white supremacist views. He noted in his online diary that when he Googled the phrase “black on white crime,” the search engine gave him information that shocked him—and helped him come to a different understanding about the so-called truth about race and the value of a multiracial society. That’s because his search only returned the white supremacist websites that use such a phrase—a phrase that is used by hate-based sites to radicalize white Americans against African Americans and other people of color, including Jewish people. Google didn’t provide any context on the white supremacist movement. It didn’t provide any counterpoints of view." https://logicmag.io/03-engine-failure/ https://logicmag.io/03-engine-failure/
Nomentatus 9y ago
Note a huge reason to target political ads is precisely that you can send your targets highly offensive or obviously misleading ads that you know they won't be offended by, without showing the rest of the electoral how vile the shit you're slinging at voters really is. Targeting covers the stench. Keeping the average voter from seeing your nastiest ads is just as important as who does see the ads. Democracy is about informing voters, targeting is all about keeping information about your ads from most voters.
puppetmaster400 9y ago
I’m sure gov. Will fix it./s
SomeHacker44 9y ago
I really don't think the proposal goes far enough. Not only should the agency collect and monitor all "leaked data," but it should set clear an detailed regulations on what can be collected, how it must be revealed to the people who it is relevant to ("relevancy TBD"), how it must be removed at the request of those same people, and how it must be amended when (claimed to be) incorrect. Many of these things are already done by other organizations for subsets of data (e.g., the regulations on credit reports). It just needs to be expanded to all kinds of data. Europe is way ahead of the USA on this one. As someone managing the implementation of a lot of the GDPR regulations on data access (e.g., "Subject Access Requests") for a small company, I absolutely wish I as a US citizen had the rights to do this stuff to US companies. But, I don't. Sucks to be an American again. Maybe this can fall under MAGA? LOL
wemdyjreichert 9y ago
Users turn over their data. The solution to people recklessly turning over their once considered private info is not to implement yet more regulation.

253 points by adrian_mrd 9y ago

What did people really expect would happen with Facebook? It's social media, not a file storage service - of course your data isn't going to be private. It's more or less what you should expect when signing up on any social media platform.

wu-ikkyu 9y ago
It's naive of technical minded people to think the average person could imagine the types of things you can do with big data sets and algorithms.
- Mononokay 9y ago
  The average user's mindset must have changed from when I was younger - mass hysteria over what people and companies online might be doing with your personal information was standard.
  - maksimum 9y ago
    > The average user's mindset must have changed from when I was younger Yes, for a simple reasons: the average web user today is basically the average person. The average web user 20-25 years ago was a technology enthusiast.
    - Mononokay 9y ago
      I was talking moreover of the Myspace-era than the Usenet-era.
    - drak0n1c 9y ago
      My parents have very minimal technical abilities and they’ve always been paranoid about putting any personal info on a paper form and that extended to the internet when things moved online. They always left the birthdate field blank on forms. I was under the impression that most Boomers grew up being wary of privacy whether conservative or liberal, and it was GenX and Millenial who would give their data to anyone.
      - Tempest1981 9y ago
        It's good that your parents are informed, and care about privacy. Many are uninformed, so have no idea. Then, like you said, there are those who don't care about privacy, even if informed.
ggregoire 9y ago
They have names, phone numbers, locations, calls history and who-knows-what about people who have not signed on Facebook. They just take all these data from your friends' smartphones contacts list.
- lopmotr 9y ago
  When I was a kid, everybody's name, address, and phone number was published in a phone book. Why does everyone feel like that's private information today? For some special people, yes, but for just about everybody, it's fine for others to be able to contact them. If I wanted to be kept hidden, I'd have to be careful who I gave my secret information to. If I trust my friends, and they carelessly give it to Facebook, that's my fault for carelessly trusting untrustworthy friends.
  - slededit 9y ago
    Back then long distance was expensive so you didn't get scammers outside of the US calling you. Local police are currently unable to deal with the deluge of foreign scams making protecting your private information much more important.
  - e12e 9y ago
    The key difference is how easy it is to correlate different digital datasets. The phonebook gives you name, address and phone number. Call logs give you pairs of phone numbers. Together you know who knows who. Add in the yellow pages and you know who called the suicide hotline. Mix with taxi data and you know who visited who, what time. And who went to an abortion clinic. Or a place of worship. Or who knows more than ten people that regularly worship. Etc. Getting all that for everyone as opposed to a certain targeted someone is much, much easier with digital records. [ed: this is why many countries have had strict rules on digital databases of personal (not just sensitive) data a long time, well before the GDPR. The amount you can learn from "simple" correlations of even public data can be staggering.]
rickycook 9y ago
it’s partly that people didn’t even think about it rather than didn’t expect it i guess? “what did people expect” implies that they had enough of an understanding of where their data is stored, and put enough thought into it in order to form an expectation of any kind and that’s before you get to the unintentional tracking in things like like buttons, friends’ data that you have no control over, etc
e12e 9y ago
I certainly expect my phone company to not record my calls, or my isp not to mine my email. The problem isn't that fb is social media; or that Google/Gmail is an email provider - it's that both of them are ad agencies and private intelligence agencies (they gather, refine and sell information; ie intelligence). So it really is: Facebook is an intelligence agency and information broker: why would you supply information on yourself and your friends to them. And the answer is likely: I didn't know they were an intelligence company; I thought they were a (social) personal media platform. Like email or a blog, only slightly more modern. And this isn't a wild expectation. Eg the telephone providers are regulated, and can't sell the content of your calls, even if it's "just" if you're talking about a recent pregnancy, or how you're thinking about buying a car...
- dredmorbius 9y ago
  Your phone company has, in all liklihood, maintained a log of all your calls, dating to the 1980s. https://www.schneier.com/blog/archives/2006/03/atts_19trillion.html https://www.schneier.com/blog/archives/2006/03/atts_19trilli...
  - e12e 9y ago
    I'm sure Norwegian military intelligence has a semi legal access to meta data and contents of my calls: but at least it's clearly illegal for them. The largest isp/phone provider (telenor) actually fought back against the eu data collection directive because they had to store more data than they currently did (3 months). But yeah, data protection in the private sector in the US is dismal.

Mediumium 9y ago

Silicon valley didn't fail at all. The main business model of a lot of silicon Valley businesses is based upon selling, buying, trading and using people's personal data, so considering this they didn't fail at all. Edit : IMO to solve privacy we need to create another business model which is obviously not based on data / advertising.

manigandham 9y ago

As usual, a bunch of nonsense by people who have no idea about this. The fundamental problem is that digital advertising is a 12-figure global industry with practically 0 oversight and regulation. This is an industry that sells influence at scale. Anyone with a credit card can start changing how people think and act but there are absolutely no real consequences for bad actors. Even the most minimal laws around who can advertise and how would radically change everything. Google has even more data than Facebook. Amazon has just as much. Your ISP has just as much. These silly little projects to chase the latest scandal will do nothing in the long run. The only way to fix anything is to regulate the core, not try and fix every little symptom that occurs. * Before the inevitable comments, yes advertising works, yes it works on you no matter how much you think otherwise, and no adblockers dont magically solve everything.

BrentOzar 9y ago
> yes advertising works, yes it works on you no matter how much you think otherwise And even if you think it doesn’t, it works on enough other people to make it a worthwhile spend if you want to win an election or get regulation passed.
- bloak 9y ago
  I'm sure some advertising "works" on some people, but I've met some of the people who buy the advertising on behalf of big companies that produce consumer goods, the people who decide which advertisers get the big contracts and which campaigns get approved, and those people were not exactly of a scientific bent. I think it would be very easy to con them, and probably they get conned a lot of the time. Also, I can think of a couple of cases in which I was planning to buy a product, but changed my mind because of an advertisement for the product. In one case the advertisement made me consider a particular aspect of the product, which lead to me reevaluating and choosing an alternative product. In the other case the product was an alcoholic beverage, which I liked the taste of, but the advertisement made me embarrassed to be in any way associated with the product. In a way that proves that advertising works, but I would guess it's a lot easier to influence people against something rather than for it, even accidentally. And this is perhaps very relevant to political advertising, which often is "against" something.

tscs37 9y ago

Tbh, I don't trust any corporation in the US to keep my data safe anymore. You can't fix that kind of reputation damage

organsnyder 9y ago

Regardless of how well you feel this article is written whether you agree with it, it's important to not ignore it and others like it. This reflects a growing sentiment among much of the population—address their concerns, or regulation will do it for you (likely in a sub-optimal, if not counterproductive, way).

domevent 9y ago
That ball is already rolling downhill, and I don’t think it can be stopped. In addition to the perfectly reasonable concerns of a few billion people, there are also some very wealthy and entrenched media interests who only stand to gain by kicking it along. I don’t think the reputation of tech is salvageable at this point, and the result will be having to live with regulation and oversight like every other industry. Even if everyone shaped up overnight (and they won’t) there is still so much yet to emerge into the public light about what has already happened. Uber and Facebook alone have almost certainly only just begun to bleed scandal.
- laen 9y ago
  > the result will be having to live with regulation and oversight like every other industry. The only other industry I think could be comparable to this, from a privacy standpoint, would be the banking industry. They are largely flying under the radar during all of this, any hypothesis why? Is it because their regulation and oversight is working like you are alluding to? Or is it because the banking industry has not been caught...yet?
jeoeo8383 9y ago
Anyone that can build a project from a “build a web app in 24hrs!” is capable of building a private replacement for these things These svcs just strike me as so worthless that we should be spending the resources on the data centers. I share family moments via some raspberry pi’s running sync thing Just copy photos from phone over to a Samba share, and grandparents, aunts, uncles get a refresh Facebook especially is utter novelty. Twitter I use for local alerts. Cause rss couldn’t raise a bunch of IPO dollars This social thing needs to drop off a bit. A Facebook implosion might be a good thing

mlb_hn 9y ago

The author's suggested fix is "Let’s make a digital Environmental Protection Agency. Call it the Digital Protection Agency. Its job would be to clean up toxic data spills, educate the public, and calibrate and levy fines." A couple upfront issues with this: 1) "cleaning up toxic data spills" - this doesn't seem well worked out, unless the author suggests going and deleting the stolen data off others' computers 2) "educate the public" - the author suggests explaining how to deal with identify theft. That's great, but doesn't address the secondary issues of advertising/propaganda/other clever unintended uses of data.

Mononokay 9y ago
It also only really works for things that happen domestically - watch as every social media company moved overseas. Social media companies are in the wonderful position as to where they don't have to take money outright from users to operate, so they can claim they don't operate in any country they'd like to claim they don't, and can move to a foreign country with a lower tax rate without harming themselves at all really. With no users exchanging currency and no (retail) physical presence they're incredibly free as far as mobility goes. Unless I'm missing something about this all, it's surprising that it's not common for them to.
- JumpCrisscross 9y ago
  > It also only really works for things that happen domestically - watch as every social media company moved overseas A limited solution is better than no solution.
  - Mononokay 9y ago
    In some cases, it isn't. This would be one of those cases - tax increase because of the spending increase required for a new department, little benefit in practice, anti-free market, etc. It's a culture issue, not particularly a regulation issue. Fining companies for doing with data exactly what they say will be done with data in their ToS (Granted, ToSs are a terrible concept - they are legal and enforcable depending on how the government is feeling for the day, though) would allow the government to effectively shut down platforms it didn't like by fee. Proposing a department to "Calibrate and Levy Fines" upon media is bizarre. The proper thing to do would be solely focusing on educating the populus, or alternatively funding the EFF to do it for them.

ig1 9y ago

Most developed countries have an agency dedicated to data protection. The UK has the ICO, Japan has the Personal Information Protection Commission, Canada has the Office of the Privacy Commissioner, Switzerland has the FDPIC, etc. Their exact role varies from country-to-country but the US is one of the few modern countries to not have a national body dedicated to the field.

wooter 9y ago
I've never found "everybody's doing it" to be compelling.
- r3bl 9y ago
  How about "everybody's doing it for a good reason"?
  - rickycook 9y ago
    like the metric system which is to say, i think momentum is the issue
ggregoire 9y ago
The CNIL in France, created in 1980.
walterbell 9y ago
FTC in the US.
- e12e 9y ago
  Indeed. I came across this, which should probably be of interest to readers in the US: https://www.ftc.gov/public-statements/2016/01/two-way-street-us-eu-parallels-under-general-data-protection-regulation https://www.ftc.gov/public-statements/2016/01/two-way-street... However, I seem to recall, that last time I checked (several years ago) there appeared to be very slim data protection in the US. Or rather, somewhat strict rules for the federal government, few or no rules for private business. To the point of federal agencies contracting out databases to firms, so as to dodge legislation...

dictum 9y ago

I can't wait for the 2023 thinkpieces on how the Digital Homeland Protection Agency or some such has been taken over by purveyors of ungood ethics and we must do something about it.

marknadal 9y ago

Oh my goodness, the solution is to spend billions on a government agency? Seriously, you can just use encryption for free. People are building entire apps around E2E P2P tools that exist today: https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-with-e2e-encryption-f90505b2ff8 https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi...

jeoeo8383 9y ago

General public does its usual thing; ignores the reality Eventually freaks out and demands everyone be held accountable for their past indifference Let’s fix a thing we don’t need! Cause private IM and chat are lame. The world must know I exist! (Or at least I must feel that’s the case) and watch me go about doing things people been doing forever! Oh those sunset shots and cat pics! Oh those pop culture references! TV 2.0 is right

jaequery 9y ago

Regardless of regulations, I feel you can’t really stop what the employees do with the data. For every company, there is an employee who have the key to your data just doing their jobs, be it devs verifying data to sysadmins managing the backups. Sure you can have better auditing procedures and analyzing logs, but if its the group of guys especially at the head, its hard to prevent that. Social hacking is happening without us knowing it and that is what worries me more.

zmix 9y ago

I thought you guys are "Silicon Valley"?!

gerash 9y ago

Perhaps one solution could be to keep your personal data encrypted but then if you need an online service you'll need to somehow let the services access it. That's the part where it gets tricky. Either the code working on your data is sandboxed from the outside world which sounds impractical. What if needs to talk to other backends. Alternatively the operating system ACL framework is super granular so you can give the service the minimum amount of data it needs. Or another solution could be a way to easily see which entities/apps have access to your data and the time they accessed them. Like some sort of an audit log with accessible UI. A non-profit agency is nice and all but doesn't give much guarantee.

dqpb 9y ago

It's been interesting to see how much press Facebook, and to a lesser degree Google, silicon valley, and "tech" have been getting lately. I look forward to when the press seriously talks about the truly evil organizations that are physically drugging, poisoning, and killing people and our environment.

sqdbps 9y ago

The US must not introduce any laws detrimental to US companies especially when China is bolstering their tech firms (and stealing our IP) and the EU is trying everything short of altogether outlawing US tech companies out of their market. Just ride out this silly populist convulsion and we'll all be the better for it.

llukas 9y ago
Protect US companies but screw US people? Did you forget about Equifax leak? Why everybody else can have their data protected by not US people?
- sqdbps 9y ago
  Generally what's good for US companies is good for the US and its people, I'm fine with a legislative response to the equifax breach, something along the line of mandated disclosure and penalties for lax security but we are in the midst of a global battle and so our tech firms must be protected and not assailed by our gov't.
  - sparkie 9y ago
    The same lack of regulation over what Google, Facebook et al can collect about you is also lack of regulation over what Huawei, Xiaomi et al can collect about you. It's not giving US companies any competitive advantage. The Chinese companies have the advantage that they're also collecting the data on Chinese citizens, which is out of bounds of US companies unless they're conducting shady deals with the Chinese government.
sparkie 9y ago
China isn't just "stealing IP", they're also innovating in means of production. It's not just "cheap labor" that people get things produced in China for anymore - it's because China is way ahead of anyone else in production capabilities, costs and speed US companies can't compete with China when they're sending all of their production over to China. You've placed too much emphasis on ideas and not enough on actually making them, because the attitude "China can make it at lower cost." IP laws are really what are stifling US companies. They're exhausting huge amounts of resources on building up IP portfolios for the sake of entering (or avoiding) legal battles over "I thought of that first." You have zero chance of competing against China when you're fighting among yourselves over who gets the biggest piece of the shrinking pie.

tedwilliamshock 9y ago

Protect it yourself. -> https://spreadprivacy.com/duckduckgo-privacy-challenge-2018/ https://spreadprivacy.com/duckduckgo-privacy-challenge-2018/

johnnyOnTheSpot 9y ago

This is all a very new problem only seen under the new POTUS.

johnnyOnTheSpot 9y ago
Given the massive uptick in stories around Facebook, it would seem this statement would be true.

cowmix 9y ago

As a side note. In the past 5 years of doing serious contracting work in every industry you can think of (pharma, banking, manufacturing, etc) the places where I have seen info sec taken the most seriously are two: gaming studios (any) and Bloomberg.

riazrizvi 9y ago

Google built an algorithm that promoted Alex Jones 15 billion times to vulnerable people. I wonder are they systematizing established marketing influences, or are they creating a new era of conspiracy theory prone populations because those types of articles have better click-through rates for ads?

duncan_bayne 9y ago

Silicon Valley, huh? I wonder how many trackers appear on the Bloomberg page. Let's see ... 14, according to Ghostery: * Doubleclick * Lotame * Scorecard Research * Taboola * SailThrough Horizon ... and nine more. In the unlikely event anyone from Bloomberg is reading this: fuck you, you hypocrites.

arez 9y ago

...They pay taxes... wtf :'D

shmerl 9y ago

> Silicon Valley Has Failed to Protect Our Data. They are joking, right? FB was never about protecting data, it was always about profiting from selling it.

ausjke 9y ago

that's indeed scary, but I saw no way out, but I will do the followings: 1. remove my rarely used facebook account. 2. remove twitter account. 3. remove gmail, use outlook email instead, probably host my own email. 4. for private messenger, use 'signal' app instead. 5. use vpn more. There are more stuff I could not remove though, e.g., my Amazon account, ebay and paypal, etc, also my account and posts at HN, hi I can not even remove my posts not to mention my account at HN, will HN sell me someday or is it doing this already? The only solution I see, is that paying for all those services: pay for twitter, facebook, gmail etc, so they do not need your personal info to profit? of those they need supervise, means if they still violate my privacy after I paid, sue them to hell.

j605 9y ago
The problem with using signal is getting your contacts on it as well. You could always switch email providers but not chat applications.

soared 9y ago

The problem with Facebook is it allows people to gather data about a user and their friends. Literally every single other platform (including google) can gather data about you but not your friends. That is the current problem that needs to be immediately solved IMO. After the obvious, easy win then we should move on to more difficult regulation like others have suggested.

908087 9y ago
> Literally every single other platform (including google) can gather data about you but not your friends. That's not true at all. Google gets things like contact lists, SMS data, call data, etc.. which all certainly contain information about your friends.

AlphaWeaver 9y ago

The explanation of HIBP went a tiny bit overzealous... > For example, the website of Australian security expert Troy Hunt, haveibeenpwned.com (“pwned” is how elite, or “l33t,” hackers, or “hax0rs,” spell “owned”),

plorg 9y ago

I have a loosely imagined regulatory solution to the particular problem of secretive data brokerages and user targeting. It works at follows: * Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user. * Ad and data brokers are required to provide a chain of discovery detailing where the individual ad or data entity received information that contributed to the targeting of the user. (I think this was hit upon in TFA, but it was difficult to get through with the focus as it was mostly on credentials and PII). * Firms which hold user targeting information and information on individual user preferences are required to allow users to have their records removed from the firm's database. I'm sure this seems punitive to the companies it would affect, but I'm not sure that's a problem overall. It allows people to control the information that is collected about them and puts the onus on the companies benefiting from that information. If user targeting really does help in product discovery and user preference marching, then the ad and data companies will be rewarded, and the price of regulation will be the cost of information transparency. If it turns out that users really don't want to have dozens of companies tracking their every move then the advertising business model will be starved and make way for companies with more innovative, user-friendly business models. Edit: autocorrect fucking up words that autocomplete originally predicted correctly.

michaelbuckbee 9y ago
If you haven't already, you might enjoy reading the EU's forthcoming GDPR regulations [1] they cover all of this and much, much more including things like: - data should be exportable in digital formats - you can request what information a company has about you regardless if you're a full "user/customer" (think of things like how FB tracks anyone who visits a webpage with a Like button). - you have the right to request a manual review of computer made decisions (ex: a credit approval) - right to have your data corrected/fixed if it's listed incorrectly - right to escalate to each country's "supervisory authority" (this is the agency within each country that handles things) - serious fines in case of non compliance (% of revenue, not a flat amount) 1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-english https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
- 9y ago

tbabb 9y ago

I've been saying for years that software engineering needs to be elevated to the same standards held by other engineering fields; like civil, mechanical, biomedical, and so on: If an engineer or a firm is negligent and people die and/or millions of dollars are lost, they are kicked out of the industry/lose their right to operate as a business. For example: To work on cryptography and security, you need a degree and to have passed certification, perhaps at regular multi-year intervals. Then if you build a login page and store the unsalted passwords in plain text and someone pwns your site, you lose your license, could be fined, sued, or possibly go to jail if your negligence is criminal. Then, if you are a company and you need a login system, you either (a) hire certified software engineers to write one, (b) subcontract a certified firm, or (c) license a certified off-the-shelf solution. If pwnage happens, the company is liable if they failed to do one those things. Therefore it becomes in the interest of companies to do security correctly, and of engineers to only attempt it if they are competent and qualified. It's really simple: In other fields of engineering, there are consequences if you fuck up. If you design a bridge that falls down and kills people, you lose your career, are sued, and/or go to jail. Not so in CS. That needs to change.

nitrogen 9y ago
Consequences and credentialism don't have to go hand in hand. Software's lack of credentialism is what allows so many to rise above their circumstances, break through class barriers, etc.
- tbabb 9y ago
  Somehow I doubt you would apply that argument to designing bridges, or medical practice, or airline piloting, or bus driving, or law, or any of a zillion other professions where credentials are normal and essential to safety and liability. We don't let random schmoes do those other things-- aspiring and starry-eyed or not-- without first proving that they know what they're doing. We certainly don't wait until the bridge has fallen down or the plane has crashed or the patient has died before we put a burden on the professional to certify their competence. I don't think it's unreasonable to mandate rigorous certification for life-critical, security-critical, and financial software engineering. You can write a cookie clicker with a high school degree and put it online if you want. But the moment your cookie clicker takes credit card numbers, you should be legally obligated to know what you are doing or hire someone who does.

Nomentatus 9y ago

"YouTube. It has users who love conspiracy videos, and YouTube takes that love as a sign that more and more people would love those videos, too." Not exactly. YouTube sends everybody down rabbit holes, because it adores sticky topics and video sources (more views, more $), and so rewards those who create a bit of an information monopoly by simply lying; after which, one of their videos leads you to another one of their videos. Nobody else is making videos on that, 'cause you made it up. You win. Novel "information" is more likely to be viewed through, and then followed up on with searches for more on the topic. So make up, and YouTube is all about you, thrilled to facilitate the niche info-market you've created out of thin air or wildly exaggerated. Merely having your own misleading phrases to refer to your bent views will be heavily rewarded by search engines including Google's and YouTube's. For example: "I wrote about this in my new book, Algorithms of Oppression: How Search Engines Reinforce Racism. In it, I discuss Dylann Roof, the Charleston mass murderer, who said he Googled the phrase “black on white crime” after the Trayvon Martin shooting. He has talked about how important that experience was in forming his white supremacist views. He noted in his online diary that when he Googled the phrase “black on white crime,” the search engine gave him information that shocked him—and helped him come to a different understanding about the so-called truth about race and the value of a multiracial society. That’s because his search only returned the white supremacist websites that use such a phrase—a phrase that is used by hate-based sites to radicalize white Americans against African Americans and other people of color, including Jewish people. Google didn’t provide any context on the white supremacist movement. It didn’t provide any counterpoints of view." https://logicmag.io/03-engine-failure/ https://logicmag.io/03-engine-failure/

Nomentatus 9y ago

Note a huge reason to target political ads is precisely that you can send your targets highly offensive or obviously misleading ads that you know they won't be offended by, without showing the rest of the electoral how vile the shit you're slinging at voters really is. Targeting covers the stench. Keeping the average voter from seeing your nastiest ads is just as important as who does see the ads. Democracy is about informing voters, targeting is all about keeping information about your ads from most voters.

puppetmaster400 9y ago

I’m sure gov. Will fix it./s

SomeHacker44 9y ago

I really don't think the proposal goes far enough. Not only should the agency collect and monitor all "leaked data," but it should set clear an detailed regulations on what can be collected, how it must be revealed to the people who it is relevant to ("relevancy TBD"), how it must be removed at the request of those same people, and how it must be amended when (claimed to be) incorrect. Many of these things are already done by other organizations for subsets of data (e.g., the regulations on credit reports). It just needs to be expanded to all kinds of data. Europe is way ahead of the USA on this one. As someone managing the implementation of a lot of the GDPR regulations on data access (e.g., "Subject Access Requests") for a small company, I absolutely wish I as a US citizen had the rights to do this stuff to US companies. But, I don't. Sucks to be an American again. Maybe this can fall under MAGA? LOL

wemdyjreichert 9y ago

Users turn over their data. The solution to people recklessly turning over their once considered private info is not to implement yet more regulation.