4 ms·

> so far The really clever ways to abuse this kind of data haven't even been invented yet. We are still fumbling around with these technologies. Most of the cu

by pdkl95 7y ago

> so far The really clever ways to abuse this kind of data haven't even been invented yet. We are still fumbling around with these technologies. Most of the currently visible examples of data misuse are "high tech"/"on the internet" variation of the scams and abuses humans have always done. Current data misuse is a minor concern. The larger concern is that these databases will probably sill exist 20/30/50 years from now when someone invents a really clever way to abuse data. While it isn't possible[1] to predicting how technology will be used in the future, if the trends in technology over the last few decades suggest that this clever new abuse of data will be difficult for the average person to understand, highly disruptive to existing institutions, and the damage will cascade across the interdependencies[2] we've been adding to everything. > Building a large list of potential suspects ... sounds very useful Increasing the number of "potential suspects" is a terrible idea, because most of those suspects are innocent. Adding people to the suspect pool lowers S/N (actually-useful-targets/"potential suspects"). The ideal (magic) tool would produce a minimal list that simply identified the actual criminal. Adding more people to that list makes it less useful. Also, see the Base Rate Fallacy[3] and the Birthday Paradox[4]. [1] https://en.wikipedia.org/wiki/Connections_%28TV_series%29#Content https://en.wikipedia.org/wiki/Connections_%28TV_series%29#Co... [2] http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt (section 10, "Convergence") [3] https://www.schneier.com/blog/archives/2012/05/criminal_intent.html https://www.schneier.com/blog/archives/2012/05/criminal_inte... [4] https://en.wikipedia.org/wiki/Birthday_problem https://en.wikipedia.org/wiki/Birthday_problem

sailfast 7y ago
Thanks. This is very informative. I completely agree on future misuse, but I'm also not sure how to put any of this back in the bottle. What regulation are people proposing that would prevent compilation and sale of this kind of data that is accessible publicly on the internet? Is it the government use of the tech, or the fact that the company exists in the first place that is upsetting?
- pdkl95 7y ago
  > What regulation are people proposing that would prevent compilation and sale of this kind of data Liability! (with the option of avoiding that liability by explicitly not allowing yourself access to content/personal-data, aka a common carrier) As Dan Geer said in my previous [2] (section 2, "Net neutrality"): Hello, Uncle Sam here. You can charge whatever you like based on the contents of what you are carrying, but you are responsible for that content if it is hurtful; inspecting brings with it a responsibility for what you learn. -or- You can enjoy common carrier protections at all times, but you can neither inspect nor act on the contents of what you are carrying and can only charge for carriage itself. Bits are bits. Choose wisely. No refunds or exchanges at this window. While he was talking about ISP spying, the general principle can be adapted easily. Inspection (or building databases of the results of other people's inspections) must be tied to liability for the problems and negative externalities produced by that inspection (or database). Obviously this is a high-level description that ignores the messy details that are important in any actual plan. There is room for negotiation and modification. The goal is to create a situation that disincentives creating tomorrow's problems, just like we do for other types of hazardous technology. Data and spyware needs to be seen as toxic that requires special handling, storage, and disposal procedures. > This is very informative. Dan Geer's keynote - "Cybersecurity as Realpolitik" (video: [5], transcript: previous [2]) - is incredibly informative and should be mandatory viewing/reading for anyone interesting in trying to create the "least worst" Grim Meathook Future that technology is pushing us towards. I also recommend Dan Geer BSides DC 2018 keynote[6][7] as an addendum/update to "Cybersecurity as Realpolitik". In both talks he provides a very concise description of the core problems that are defining our future. We have to soon choose what we want to happen when stolen data is, for example, not just exposed but also put on a blockchain from which it cannot be erased. Put differently, assured data deletion is far harder than permanent data retention, yet many civilized goals, including but hardly limited to a right to be forgotten, require the sealing of records or their outright destruction. Which do we give up, the slick usefulness of immutability or information crime being unmitigatable? What does consent of the governed mean when a technology trumps a Court Order? [5] https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.youtube.com/watch?v=nT-TGvYOBpI [6] https://www.youtube.com/watch?v=gbDEbfijxNY https://www.youtube.com/watch?v=gbDEbfijxNY [7] http://www.bsidesdc.org/history/geer.html http://www.bsidesdc.org/history/geer.html

by pdkl95 7y ago

sailfast 7y ago

Thanks. This is very informative. I completely agree on future misuse, but I'm also not sure how to put any of this back in the bottle. What regulation are people proposing that would prevent compilation and sale of this kind of data that is accessible publicly on the internet? Is it the government use of the tech, or the fact that the company exists in the first place that is upsetting?

pdkl95 7y ago
> What regulation are people proposing that would prevent compilation and sale of this kind of data Liability! (with the option of avoiding that liability by explicitly not allowing yourself access to content/personal-data, aka a common carrier) As Dan Geer said in my previous [2] (section 2, "Net neutrality"): Hello, Uncle Sam here. You can charge whatever you like based on the contents of what you are carrying, but you are responsible for that content if it is hurtful; inspecting brings with it a responsibility for what you learn. -or- You can enjoy common carrier protections at all times, but you can neither inspect nor act on the contents of what you are carrying and can only charge for carriage itself. Bits are bits. Choose wisely. No refunds or exchanges at this window. While he was talking about ISP spying, the general principle can be adapted easily. Inspection (or building databases of the results of other people's inspections) must be tied to liability for the problems and negative externalities produced by that inspection (or database). Obviously this is a high-level description that ignores the messy details that are important in any actual plan. There is room for negotiation and modification. The goal is to create a situation that disincentives creating tomorrow's problems, just like we do for other types of hazardous technology. Data and spyware needs to be seen as toxic that requires special handling, storage, and disposal procedures. > This is very informative. Dan Geer's keynote - "Cybersecurity as Realpolitik" (video: [5], transcript: previous [2]) - is incredibly informative and should be mandatory viewing/reading for anyone interesting in trying to create the "least worst" Grim Meathook Future that technology is pushing us towards. I also recommend Dan Geer BSides DC 2018 keynote[6][7] as an addendum/update to "Cybersecurity as Realpolitik". In both talks he provides a very concise description of the core problems that are defining our future. We have to soon choose what we want to happen when stolen data is, for example, not just exposed but also put on a blockchain from which it cannot be erased. Put differently, assured data deletion is far harder than permanent data retention, yet many civilized goals, including but hardly limited to a right to be forgotten, require the sealing of records or their outright destruction. Which do we give up, the slick usefulness of immutability or information crime being unmitigatable? What does consent of the governed mean when a technology trumps a Court Order? [5] https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.youtube.com/watch?v=nT-TGvYOBpI [6] https://www.youtube.com/watch?v=gbDEbfijxNY https://www.youtube.com/watch?v=gbDEbfijxNY [7] http://www.bsidesdc.org/history/geer.html http://www.bsidesdc.org/history/geer.html