4 ms·

If my normal route for lunch is down the street to the hotdog stand to get a dog and coke, then into the park to read. Do I own that information? If a friend go

If my normal route for lunch is down the street to the hotdog stand to get a dog and coke, then into the park to read. Do I own that information? If a friend goes to the hotdog vendor and asks if I'd been by there, when he replies is he giving away my information or his?

lotsofpulp 8y ago
It’s not one or the other, both parties have the information, and without a prior agreement of confidentiality, there isn’t any reason to expect confidentiality from any party other than common courtesy.
- icebraining 8y ago
  > without a prior agreement of confidentiality Or a law.
- danShumway 8y ago
  In that case, let's talk about a current privacy problem and see if the model OP is advocating helps. One of the ways that Facebook fills out relationship graphs is by reading contacts. Both I and my brother own the information that we're related to each other. Both I and my brother own my phone number (I didn't make him sign a confidentiality agreement when I gave it to him), so outside of the bounds of common courtesy, I can't force him not to tell anyone else. So if my brother decides to let Facebook scan his phone contacts, he's just giving away information that he owns, which is his right to do. But if information ownership under this model doesn't provide any real protection to stop one of Facebook's primary data gathering techniques, then what's the value in it at all? What privacy infringement would this protect me from? If a store that I walk into could still claim ownership of the fact that I walked in and track my movements everywhere with facial recognition, and a website can still log that I visited and track where my mouse moves, and if they have co-ownership of that information, then they can still sell it to whomever they want. A big issue with information ownership is that in order to make it logically scale, it has to be neutered to the point where it's no longer useful.
  - dragonwriter 8y ago
    You know, if you have a conversation with someone (without an NDA, etc.) they are free to tell anyone about it, but in a number of states they (or anyone acting with their permission) would not be free to record the conversation because of all-party consent laws. I wonder if that's the kind of model that we need to consider expanding into personal data collection in a number of areas. (And maybe reinforcing with separate, affirmative consent requirements for some uses; e.g., I've posted notice and you entered the property may be sufficient consent for video recording used exclusively for normal security purposes, but perhaps not for outside sharing, as targeting, etc.)
    - nickpsecurity 8y ago
      "but in a number of states they (or anyone acting with their permission) would not be free to record the conversation because of all-party consent laws." I'm against that due to the power dynamics in place. I'd rather anyone be able to record anyone without saying anything. The whole situation, start to finish, will need to be recorded to make sure they're not cherry picking. I've found that lots of arrogant, evil people will be too cocky to realize someone is recording something or even that folks around them are listening. Gives us a way to deal with more of them. I've known quite a few people that protected themselves that way. I haven't seen a strong argument in terms of practical effects for full disclosure of that. If anything, less people in abusive environments would be able to prove abuse since abusers would hide it second they know someone is recording evidence. So, I'm for rolling back those all-party, consent laws into one-party or no consent. At least for dealing with harms to person recording. We could require consent before publishing something if no provable harm was done. "I wonder if that's the kind of model that we need to consider expanding into personal data collection" Interesting. Not sure about that one. I do prefer it for businesses collecting consumer data given they do most of the abuses. They also have most of the power in this space. "reinforcing with separate, affirmative consent requirements for some uses" They'll mostly just click through the dialogs or whatever. It might still be good for few it helps. I don't know. This is a security feature that fails the most unless they already know ahead of time how valuable or important something is. They already have to want to protect whatever it is. Plus, sacrifice whatever product/service is being offered to them, esp free. We could try it to see what happens, though.
imgabe 8y ago
That's a good question. If they were asking "Did you see a person who looked like (description of JustSomeNobody)?" That seems like it's clearly the vendor's information, because it's asking about his memory of what he did or didn't see. It doesn't seem right that your memories should belong to someone else. On the other hand, if he happened to have a photographic memory and remembered your exact credit card number, expiration date and CCV, we would all say that that is not his information to give out however he wishes. So, yeah. I don't know what point I'm trying to make except maybe introducing the idea of data "ownership" just creates more problems than it solves.
losteric 8y ago
A business transaction is mutual information - we both know it went down, and we both can share that information at will... ignoring legal and market incentives to stay quiet (eg medicine, sex toys). My problem is unjustifiable aggregation of data that provides personal information. If a stalker gets some information from the vendor, the problem is the stalking behavior - deriving an intimate view of my personal life without justification. The line has been crossed, whatever they use the information for is just additional problems. Commercialized stalking isn't OK on or offline. I have no problem with HN tracking that I visited this thread - mutual information - but services deriving personal information using this visit as one of many signals is crossing the line.
mindslight 8y ago
If someone sees wild berries growing next to the road and takes some, are they stealing? Perhaps technically yes, but not rising to a level where invoking the concept is worthwhile. If enough people do this that it bothers the owner so they put up a sign, only then does that paradigm start to matter. We're in this small-scale realm when talking about access_logs and friends' lunch routes. For the hotdog vendor scenario, we've developed informal social ways of dealing with this that don't revolve around fundamentalist-style ownership and access control. "Hey, I just saw your friend! He was headed to the park" vs "That other guy is always inviting himself to lunch with me and I really just want to read, so if he comes asking can you pretend I wasn't here" (which is only necessary if the "friend" hasn't responded to the first round of social hints to stop inviting himself to your lunch). But the small scale is not what we're talking about! In the berries analogy, what Google et al are doing is each sending around a crew at night to harvest a few "free" berries from each bush. Many bush owners put up signs (Do not track), but the companies keep right on harvesting under a theory that they're just doing the same thing as a hungry person taking berries for personal consumption. But the total revenue and business model of the companies paint a much different picture. And that's what we're dealing with here - something that on a small scale appears worthless, but in aggregate is quite valuable. In fact, that's basically just the fundamental thesis of "big data". Myopically focusing on each individual fact in isolation is simply not an appropriate way to analyze society-level surveillance.

lotsofpulp 8y ago

It’s not one or the other, both parties have the information, and without a prior agreement of confidentiality, there isn’t any reason to expect confidentiality from any party other than common courtesy.

icebraining 8y ago
> without a prior agreement of confidentiality Or a law.
danShumway 8y ago
In that case, let's talk about a current privacy problem and see if the model OP is advocating helps. One of the ways that Facebook fills out relationship graphs is by reading contacts. Both I and my brother own the information that we're related to each other. Both I and my brother own my phone number (I didn't make him sign a confidentiality agreement when I gave it to him), so outside of the bounds of common courtesy, I can't force him not to tell anyone else. So if my brother decides to let Facebook scan his phone contacts, he's just giving away information that he owns, which is his right to do. But if information ownership under this model doesn't provide any real protection to stop one of Facebook's primary data gathering techniques, then what's the value in it at all? What privacy infringement would this protect me from? If a store that I walk into could still claim ownership of the fact that I walked in and track my movements everywhere with facial recognition, and a website can still log that I visited and track where my mouse moves, and if they have co-ownership of that information, then they can still sell it to whomever they want. A big issue with information ownership is that in order to make it logically scale, it has to be neutered to the point where it's no longer useful.
- dragonwriter 8y ago
  You know, if you have a conversation with someone (without an NDA, etc.) they are free to tell anyone about it, but in a number of states they (or anyone acting with their permission) would not be free to record the conversation because of all-party consent laws. I wonder if that's the kind of model that we need to consider expanding into personal data collection in a number of areas. (And maybe reinforcing with separate, affirmative consent requirements for some uses; e.g., I've posted notice and you entered the property may be sufficient consent for video recording used exclusively for normal security purposes, but perhaps not for outside sharing, as targeting, etc.)
  - nickpsecurity 8y ago
    "but in a number of states they (or anyone acting with their permission) would not be free to record the conversation because of all-party consent laws." I'm against that due to the power dynamics in place. I'd rather anyone be able to record anyone without saying anything. The whole situation, start to finish, will need to be recorded to make sure they're not cherry picking. I've found that lots of arrogant, evil people will be too cocky to realize someone is recording something or even that folks around them are listening. Gives us a way to deal with more of them. I've known quite a few people that protected themselves that way. I haven't seen a strong argument in terms of practical effects for full disclosure of that. If anything, less people in abusive environments would be able to prove abuse since abusers would hide it second they know someone is recording evidence. So, I'm for rolling back those all-party, consent laws into one-party or no consent. At least for dealing with harms to person recording. We could require consent before publishing something if no provable harm was done. "I wonder if that's the kind of model that we need to consider expanding into personal data collection" Interesting. Not sure about that one. I do prefer it for businesses collecting consumer data given they do most of the abuses. They also have most of the power in this space. "reinforcing with separate, affirmative consent requirements for some uses" They'll mostly just click through the dialogs or whatever. It might still be good for few it helps. I don't know. This is a security feature that fails the most unless they already know ahead of time how valuable or important something is. They already have to want to protect whatever it is. Plus, sacrifice whatever product/service is being offered to them, esp free. We could try it to see what happens, though.

imgabe 8y ago

That's a good question. If they were asking "Did you see a person who looked like (description of JustSomeNobody)?" That seems like it's clearly the vendor's information, because it's asking about his memory of what he did or didn't see. It doesn't seem right that your memories should belong to someone else. On the other hand, if he happened to have a photographic memory and remembered your exact credit card number, expiration date and CCV, we would all say that that is not his information to give out however he wishes. So, yeah. I don't know what point I'm trying to make except maybe introducing the idea of data "ownership" just creates more problems than it solves.

losteric 8y ago

A business transaction is mutual information - we both know it went down, and we both can share that information at will... ignoring legal and market incentives to stay quiet (eg medicine, sex toys). My problem is unjustifiable aggregation of data that provides personal information. If a stalker gets some information from the vendor, the problem is the stalking behavior - deriving an intimate view of my personal life without justification. The line has been crossed, whatever they use the information for is just additional problems. Commercialized stalking isn't OK on or offline. I have no problem with HN tracking that I visited this thread - mutual information - but services deriving personal information using this visit as one of many signals is crossing the line.

mindslight 8y ago

If someone sees wild berries growing next to the road and takes some, are they stealing? Perhaps technically yes, but not rising to a level where invoking the concept is worthwhile. If enough people do this that it bothers the owner so they put up a sign, only then does that paradigm start to matter. We're in this small-scale realm when talking about access_logs and friends' lunch routes. For the hotdog vendor scenario, we've developed informal social ways of dealing with this that don't revolve around fundamentalist-style ownership and access control. "Hey, I just saw your friend! He was headed to the park" vs "That other guy is always inviting himself to lunch with me and I really just want to read, so if he comes asking can you pretend I wasn't here" (which is only necessary if the "friend" hasn't responded to the first round of social hints to stop inviting himself to your lunch). But the small scale is not what we're talking about! In the berries analogy, what Google et al are doing is each sending around a crew at night to harvest a few "free" berries from each bush. Many bush owners put up signs (Do not track), but the companies keep right on harvesting under a theory that they're just doing the same thing as a hungry person taking berries for personal consumption. But the total revenue and business model of the companies paint a much different picture. And that's what we're dealing with here - something that on a small scale appears worthless, but in aggregate is quite valuable. In fact, that's basically just the fundamental thesis of "big data". Myopically focusing on each individual fact in isolation is simply not an appropriate way to analyze society-level surveillance.