> What regulation are people proposing that would prevent compilation and sale of this kind of data Liability! (with the option of avoiding that liability by

> What regulation are people proposing that would prevent compilation and sale of this kind of data Liability! (with the option of avoiding that liability by explicitly not allowing yourself access to content/personal-data, aka a common carrier) As Dan Geer said in my previous [2] (section 2, "Net neutrality"): Hello, Uncle Sam here. You can charge whatever you like based on the contents of what you are carrying, but you are responsible for that content if it is hurtful; inspecting brings with it a responsibility for what you learn. -or- You can enjoy common carrier protections at all times, but you can neither inspect nor act on the contents of what you are carrying and can only charge for carriage itself. Bits are bits. Choose wisely. No refunds or exchanges at this window. While he was talking about ISP spying, the general principle can be adapted easily. Inspection (or building databases of the results of other people's inspections) must be tied to liability for the problems and negative externalities produced by that inspection (or database). Obviously this is a high-level description that ignores the messy details that are important in any actual plan. There is room for negotiation and modification. The goal is to create a situation that disincentives creating tomorrow's problems, just like we do for other types of hazardous technology. Data and spyware needs to be seen as toxic that requires special handling, storage, and disposal procedures. > This is very informative. Dan Geer's keynote - "Cybersecurity as Realpolitik" (video: [5], transcript: previous [2]) - is incredibly informative and should be mandatory viewing/reading for anyone interesting in trying to create the "least worst" Grim Meathook Future that technology is pushing us towards. I also recommend Dan Geer BSides DC 2018 keynote[6][7] as an addendum/update to "Cybersecurity as Realpolitik". In both talks he provides a very concise description of the core problems that are defining our future. We have to soon choose what we want to happen when stolen data is, for example, not just exposed but also put on a blockchain from which it cannot be erased. Put differently, assured data deletion is far harder than permanent data retention, yet many civilized goals, including but hardly limited to a right to be forgotten, require the sealing of records or their outright destruction. Which do we give up, the slick usefulness of immutability or information crime being unmitigatable? What does consent of the governed mean when a technology trumps a Court Order? [5] https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.youtube.com/watch?v=nT-TGvYOBpI [6] https://www.youtube.com/watch?v=gbDEbfijxNY https://www.youtube.com/watch?v=gbDEbfijxNY [7] http://www.bsidesdc.org/history/geer.html http://www.bsidesdc.org/history/geer.html