4 ms·

In the past, when a government sent an Internet company a National Security Letter (or equivalent), it was a lot of work for them to dig up every trace of conte

by raldi 9y ago

In the past, when a government sent an Internet company a National Security Letter (or equivalent), it was a lot of work for them to dig up every trace of content that user has ever produced or had recorded about them -- think, for example, of a Google account, which might have GMail archives, chat logs, search history, YouTube videos, Google+ posts, Google Voice records, Chrome backups.... It used to be really hard to gather all that information and package it up in a nice little bundle. It used to be hard for a company to get their software engineers to quietly implement such functionality across all products without getting internal angst and bad press leaks. But now, companies can just tell their software engineers that they're writing user-friendly data-portability features. Across all product lines, they'll happily code away, completely oblivious to the fact that their code is also going to be used for this other purpose.

degenerate 9y ago
Good point. If I was working with sensitive data, I would definitely question a decision on allowing data to be exported somewhere. I'd probably get confirmation from my manager in how that data was allowed to be accessed/requested. But if I was coding an export feature for users to download all their data in one click, I wouldn't think twice about it. I would assume it was used for that purpose. That's scary.
foolfoolz 9y ago
i think this is a false statement. i have worked for companies with lots of user data. the tools to download or retain all user data for legal reasons existed although they were not customer facing. one particular company i worked for had a tool to download all files to disk and partition into ~700mb chunks, helping you achieve the end goal of burning to files to CD rom. this was used frequently during subpoenas. i see the ability to download and delete your account as a good improvement
- raldi 9y ago
  What's the part of my comment that you think is false?
  - CPLX 9y ago
    Presumably the part where you say that in the past this wasn't the case.
  - SmellyGeekBoy 9y ago
    Presumably the numerous mentions of it being "really hard" to do this kind of thing.
lmkg 9y ago
On the other hand, now users get the same level of access to their own data that governments have had for years. Silver linings, and such.
- tejas281 9y ago
  This might not be completely true. It would be trivial to determine who is requesting the data dump and include/exclude content based on that.
deleted 9y ago
[deleted]
maxerickson 9y ago
Google first implemented Takeout like 10 years ago (Checking Wikipedia, in 2011). So they are more of the anti-example for your argument.
- raldi 9y ago
  I'm not following -- 2011 was a decade after the Patriot Act was passed. Google had been receiving NSLs for years by that point, which likely used to be much harder to respond to before the creation of Takeout. Now, as soon as Legal signs off, the production of the ZIP file is probably completely automated. And the programmers who made that possible probably believed their code was going to be used solely for their users' data portability. (Disclaimer: Though I used to work there, all of the above is pure speculation.)
- lucideer 9y ago
  Takeout was implemented by the Data Liberation Front, an independent 20%-time collaboration between engineers in Google, accompanied by whimsical videos[0]. Takeout was never anywhere close to comprehensive, and the DLF didn't last[1]. [0] https://www.youtube.com/watch?v=QP4NI5o-WUw https://www.youtube.com/watch?v=QP4NI5o-WUw [1] https://www.twitter.com/dataliberation https://www.twitter.com/dataliberation
  - bwillard 9y ago
    It turns out reports of the Data Liberation Front demise have been greatly exaggerated. We are still very actively improving Google Takeout[0] as well as developing other products[1]. The thing that didn't last was running a quasi-official Twitter account, perhaps without official blessing. Its true that the Data Liberation Front did start as a group of 20%ers, but like the much less successful GMail, we got turned in a real team and now we have reorgs and TPS and everything. [0] Check out the new My Activity service as an example of some of the new data we have added: https://takeout.google.com/settings/takeout/custom/my_activity https://takeout.google.com/settings/takeout/custom/my_activi... [1] https://thejournal.com/articles/2016/12/09/google-unveils-graduation-for-g-suite.aspx https://thejournal.com/articles/2016/12/09/google-unveils-gr...
untog 9y ago
If you extend your logic (anything that can be used for government surveillance was created for government surveillance) pretty much anything is guilty of this. The existence of Facebook itself, Google providing an e-mail service, anyone providing an e-mail service, anyone providing access to the internet... That's probably the least charitable way of looking at this. It's a tool for data portability that gives users access to their own content, in a way they weren't previous able to do. If the government wanted some data on a user I think they're going to get it from the company whether this service exists or not.
- raldi 9y ago
  > If you extend your logic (anything that can be used for government surveillance was created for government surveillance) To be clear, that's not my logic.
- deegles 9y ago
  The implication is that if you create the technology for “good” then you also make its misuse possible.
  - rando444 9y ago
    Why stop at technology? You can use pretty much anything for good or bad. Rocks, Nitrogen, Automobiles, Thoughts.. it's an endless list.
    - bausshf 9y ago
      The only thing you can't use for good is Windows Vista
zaidf 9y ago
But now, companies can just tell their software engineers that they're writing user-friendly data-portability features. Across all product lines, they'll happily code away, completely oblivious to the fact that their code is also going to be used for this other purpose. If a developer was not oblivious to the fact that their code might be used for this other purpose, what do you think a typical developer a) would do and b) should do?
encoderer 9y ago
The data is already centralized in a "data lake" or data warehouse largely because a lot of data is desired by R&D driven data science teams to produce recommendations and personalizations. Engineers build the data collection without cringing because it really does, in addition to driving ad targeting etc, also drive real user features. You also tend to be bought-in when you work at a company. Honestly there is so much liquidity in the employment market in SFBA and Seattle and has been for so long now that a lot of sorting has taken place. I think.
icebraining 9y ago
If the government only gets a bundle from people they are specifically interested in, that's an improvement over letting them trawl the whole dataset.

by raldi 9y ago

degenerate 9y ago

Good point. If I was working with sensitive data, I would definitely question a decision on allowing data to be exported somewhere. I'd probably get confirmation from my manager in how that data was allowed to be accessed/requested. But if I was coding an export feature for users to download all their data in one click, I wouldn't think twice about it. I would assume it was used for that purpose. That's scary.

foolfoolz 9y ago

i think this is a false statement. i have worked for companies with lots of user data. the tools to download or retain all user data for legal reasons existed although they were not customer facing. one particular company i worked for had a tool to download all files to disk and partition into ~700mb chunks, helping you achieve the end goal of burning to files to CD rom. this was used frequently during subpoenas. i see the ability to download and delete your account as a good improvement

raldi 9y ago
What's the part of my comment that you think is false?
- CPLX 9y ago
  Presumably the part where you say that in the past this wasn't the case.
- SmellyGeekBoy 9y ago
  Presumably the numerous mentions of it being "really hard" to do this kind of thing.

lmkg 9y ago

On the other hand, now users get the same level of access to their own data that governments have had for years. Silver linings, and such.

tejas281 9y ago
This might not be completely true. It would be trivial to determine who is requesting the data dump and include/exclude content based on that.

deleted 9y ago

[deleted]

maxerickson 9y ago

Google first implemented Takeout like 10 years ago (Checking Wikipedia, in 2011). So they are more of the anti-example for your argument.

raldi 9y ago
I'm not following -- 2011 was a decade after the Patriot Act was passed. Google had been receiving NSLs for years by that point, which likely used to be much harder to respond to before the creation of Takeout. Now, as soon as Legal signs off, the production of the ZIP file is probably completely automated. And the programmers who made that possible probably believed their code was going to be used solely for their users' data portability. (Disclaimer: Though I used to work there, all of the above is pure speculation.)
lucideer 9y ago
Takeout was implemented by the Data Liberation Front, an independent 20%-time collaboration between engineers in Google, accompanied by whimsical videos[0]. Takeout was never anywhere close to comprehensive, and the DLF didn't last[1]. [0] https://www.youtube.com/watch?v=QP4NI5o-WUw https://www.youtube.com/watch?v=QP4NI5o-WUw [1] https://www.twitter.com/dataliberation https://www.twitter.com/dataliberation
- bwillard 9y ago
  It turns out reports of the Data Liberation Front demise have been greatly exaggerated. We are still very actively improving Google Takeout[0] as well as developing other products[1]. The thing that didn't last was running a quasi-official Twitter account, perhaps without official blessing. Its true that the Data Liberation Front did start as a group of 20%ers, but like the much less successful GMail, we got turned in a real team and now we have reorgs and TPS and everything. [0] Check out the new My Activity service as an example of some of the new data we have added: https://takeout.google.com/settings/takeout/custom/my_activity https://takeout.google.com/settings/takeout/custom/my_activi... [1] https://thejournal.com/articles/2016/12/09/google-unveils-graduation-for-g-suite.aspx https://thejournal.com/articles/2016/12/09/google-unveils-gr...

untog 9y ago

If you extend your logic (anything that can be used for government surveillance was created for government surveillance) pretty much anything is guilty of this. The existence of Facebook itself, Google providing an e-mail service, anyone providing an e-mail service, anyone providing access to the internet... That's probably the least charitable way of looking at this. It's a tool for data portability that gives users access to their own content, in a way they weren't previous able to do. If the government wanted some data on a user I think they're going to get it from the company whether this service exists or not.

raldi 9y ago
> If you extend your logic (anything that can be used for government surveillance was created for government surveillance) To be clear, that's not my logic.
deegles 9y ago
The implication is that if you create the technology for “good” then you also make its misuse possible.
- rando444 9y ago
  Why stop at technology? You can use pretty much anything for good or bad. Rocks, Nitrogen, Automobiles, Thoughts.. it's an endless list.
  - bausshf 9y ago
    The only thing you can't use for good is Windows Vista

zaidf 9y ago

But now, companies can just tell their software engineers that they're writing user-friendly data-portability features. Across all product lines, they'll happily code away, completely oblivious to the fact that their code is also going to be used for this other purpose. If a developer was not oblivious to the fact that their code might be used for this other purpose, what do you think a typical developer a) would do and b) should do?

encoderer 9y ago

The data is already centralized in a "data lake" or data warehouse largely because a lot of data is desired by R&D driven data science teams to produce recommendations and personalizations. Engineers build the data collection without cringing because it really does, in addition to driving ad targeting etc, also drive real user features. You also tend to be bought-in when you work at a company. Honestly there is so much liquidity in the employment market in SFBA and Seattle and has been for so long now that a lot of sorting has taken place. I think.

icebraining 9y ago

If the government only gets a bundle from people they are specifically interested in, that's an improvement over letting them trawl the whole dataset.