6 ms·

This is definitely a touchy subject. As the article notes, this will remove the privacy from all people who commented on net neutrality, but it will also allow

This is definitely a touchy subject. As the article notes, this will remove the privacy from all people who commented on net neutrality, but it will also allow 2 NYTimes reporters to try to figure out why there were fake comments that led to the loss of neutrality for the people. The separate question that still needs to be figured out, is who is going to be penalized for lying to the american people and taking away their freedoms [1]? [1] https://techcrunch.com/2018/08/06/fcc-admits-it-was-never-actually-hacked/ https://techcrunch.com/2018/08/06/fcc-admits-it-was-never-ac...

EndXA 7y ago
The privacy aspect to this is definitely touchy: > The FCC argued in court that making the millions of IP addresses contained in the logs publicly accessible would constitute an “unwarranted invasion of personal privacy.” And while [Judge Schofield] didn’t entirely disagree, she said the agency had failed to adequately spell out how anyone would be harmed by the disclosure. > Regardless, Schofield said she also decided to weigh any hypothetical harm against the potential value of the information to the public. “In this case, the public interest in disclosure is great because the importance of the comment process to agency rulemaking is great,” she said, adding: “If genuine public comment is drowned out by a fraudulent facsimile, then the notice-and-comment process has failed.” The judge also wrote that: > ...despite the privacy concerns raised by the agency, releasing the logs may help clarify whether fraudulent activity interfered with the comment period, as well as whether the agency’s decision-making process is “vulnerable to corruption.”
- rasengan 7y ago
  What’s crazy is if you own the ISP (who generally wants to repeal net neutrality) you already know which names are associated with each IP as well as other information since you looked up their credit score among other things.
- warent 7y ago
  This is really great news and I admire the judge's dedication to truth and justice. It makes me wonder how much pressure the judge recieved behind-the-scenes before making this ruling. Excited to see how this develops. Unfortunately I suspect the answer is probably more mundane than anything; e.g. the comments were from a botnet which the FCC lacks technical competence to deal with.
- elliekelly 7y ago
  I’m a bit confused about the privacy issue here. Isn’t the (alleged) commenter’s full name and address published along with their comment in the public filing? If the commenter’s address is already published what other information can be gleaned from their IP address? Is the fear that someone could use it to piece together a person’s web history?
  - henryfjordan 7y ago
    The New York times isn't seeking the name or address in their request, just some other metadata about each comment including the IP and user agent header. Gizmodo failed to link to the actual opinion with this info: https://www.courtlistener.com/docket/7906482/33/the-new-york-times-company-v-federal-communications-commission/ https://www.courtlistener.com/docket/7906482/33/the-new-york... Edit: upon reading more, now I'm not sure if the NYT already has the names and addresses and is just seeking the metadata or if they don't need that data to do their analysis. Your guess might have been right, the ruling is unclear.
    - deathanatos 7y ago
      > The New York times isn't seeking the name or address in their request, just some other metadata about each comment including the IP and user agent header. The point of the person you're responding to is that the NYT doesn't need to seek names or addresses, because they're already public information. Anyone can go look up the docket and see them[1]. So, their argument I believe is that, given that the names and addresses of the filers of comments are already publicly available, what further privacy concern is there in releasing IP address information? And there might be one. IP address & UA might further allow me to correlate the user's activity elsewhere; some comments didn't submit names or addresses — IIRC these were "required" but some people filled in the fields with things like "none". There were also allegations that the names of some comments were falsified on comments not in favor of net neutrality. IP address information might lend evidence to or against those allegations. [1]: https://www.fcc.gov/ecfs/search/filings?proceedings_name=17-108&sort=date_disseminated,DESC&submissiontype_description=COMMENT https://www.fcc.gov/ecfs/search/filings?proceedings_name=17-...
- crocodiletears 7y ago
  Would a good middle ground would be add some salt to each unique IP, hash the addresses, and hand hashed data over?
  - nightfly 7y ago
    It would make the ip address information useless. What they probably want to do is figure out how many comments came from the same network blocks that were allocated to organizations (to detect large numbers of fake comments). If you hash the ip addresses you can't figure out which ones came from the same network allocation, the most you could do is figure out which comments came from identical ip addresses.
    - crocodiletears 7y ago
      True. Bar assigning each hashed ip a block id, the data would be pretty useless. Even then you might still lose out on some important metadata.
duxup 7y ago
Is there any realistic expectation of anonymity when it comes to FCC comments? They usually publish the names of people who commented don't they? I know mine was accessible.
deleted 7y ago
[deleted]
acdha 7y ago
I don’t think this is actually much of a privacy change. Here’s what you agree to when you submit a comment: > Any comments that you submit to the FCC on a proposed rulemaking, petition, or other document for which public comment is requested will be made public, including any personally identifiable information you include in your submission. We may share non-personally identifiable information with others, including the public, in aggregated form, in partial or edited form, or verbatim. https://www.fcc.gov/consumers/guides/how-comment#comments https://www.fcc.gov/consumers/guides/how-comment#comments
- Gaelan 7y ago
  > including any personally identifiable information you include in your submission Wording here is a little ambiguous. As a techie, it's pretty easy to make an argument that the IP address is something I "included" in the submission (it's part of the packets my computer is sending on my behalf), but I'm not sure the average person would read it that way, instead interpreting it as pertaining only to information they explicitly typed into a text box.
  - acdha 7y ago
    Yes, but even in that case how much does it change matters to go from your name, city, state, zip code, email address, etc. to include an IP? I mean, a data miner might be able to tell if you were posting from a house which isn’t yours or using your employer’s network but the entered PII is enough to uniquely identify a large number of people.
- m463 7y ago
  You could probably aggregate the IP addresses in a few ways and even maintain privacy: - how many submissions came from the ISP law offices address block? - how many submissions came from lobby group #12's address block? - which ip addresses had more than 20 unique submissions? then use the results as the basis for investigations. Some results could be benign, some results could be less so.
londons_explore 7y ago
Why not release a randomly selected sample of 100 comments? A random sample should be sufficient to see whats going on, if its sufficiently widespread to affect results.

EndXA 7y ago

The privacy aspect to this is definitely touchy: > The FCC argued in court that making the millions of IP addresses contained in the logs publicly accessible would constitute an “unwarranted invasion of personal privacy.” And while [Judge Schofield] didn’t entirely disagree, she said the agency had failed to adequately spell out how anyone would be harmed by the disclosure. > Regardless, Schofield said she also decided to weigh any hypothetical harm against the potential value of the information to the public. “In this case, the public interest in disclosure is great because the importance of the comment process to agency rulemaking is great,” she said, adding: “If genuine public comment is drowned out by a fraudulent facsimile, then the notice-and-comment process has failed.” The judge also wrote that: > ...despite the privacy concerns raised by the agency, releasing the logs may help clarify whether fraudulent activity interfered with the comment period, as well as whether the agency’s decision-making process is “vulnerable to corruption.”

rasengan 7y ago
What’s crazy is if you own the ISP (who generally wants to repeal net neutrality) you already know which names are associated with each IP as well as other information since you looked up their credit score among other things.
warent 7y ago
This is really great news and I admire the judge's dedication to truth and justice. It makes me wonder how much pressure the judge recieved behind-the-scenes before making this ruling. Excited to see how this develops. Unfortunately I suspect the answer is probably more mundane than anything; e.g. the comments were from a botnet which the FCC lacks technical competence to deal with.
elliekelly 7y ago
I’m a bit confused about the privacy issue here. Isn’t the (alleged) commenter’s full name and address published along with their comment in the public filing? If the commenter’s address is already published what other information can be gleaned from their IP address? Is the fear that someone could use it to piece together a person’s web history?
- henryfjordan 7y ago
  The New York times isn't seeking the name or address in their request, just some other metadata about each comment including the IP and user agent header. Gizmodo failed to link to the actual opinion with this info: https://www.courtlistener.com/docket/7906482/33/the-new-york-times-company-v-federal-communications-commission/ https://www.courtlistener.com/docket/7906482/33/the-new-york... Edit: upon reading more, now I'm not sure if the NYT already has the names and addresses and is just seeking the metadata or if they don't need that data to do their analysis. Your guess might have been right, the ruling is unclear.
  - deathanatos 7y ago
    > The New York times isn't seeking the name or address in their request, just some other metadata about each comment including the IP and user agent header. The point of the person you're responding to is that the NYT doesn't need to seek names or addresses, because they're already public information. Anyone can go look up the docket and see them[1]. So, their argument I believe is that, given that the names and addresses of the filers of comments are already publicly available, what further privacy concern is there in releasing IP address information? And there might be one. IP address & UA might further allow me to correlate the user's activity elsewhere; some comments didn't submit names or addresses — IIRC these were "required" but some people filled in the fields with things like "none". There were also allegations that the names of some comments were falsified on comments not in favor of net neutrality. IP address information might lend evidence to or against those allegations. [1]: https://www.fcc.gov/ecfs/search/filings?proceedings_name=17-108&sort=date_disseminated,DESC&submissiontype_description=COMMENT https://www.fcc.gov/ecfs/search/filings?proceedings_name=17-...
crocodiletears 7y ago
Would a good middle ground would be add some salt to each unique IP, hash the addresses, and hand hashed data over?
- nightfly 7y ago
  It would make the ip address information useless. What they probably want to do is figure out how many comments came from the same network blocks that were allocated to organizations (to detect large numbers of fake comments). If you hash the ip addresses you can't figure out which ones came from the same network allocation, the most you could do is figure out which comments came from identical ip addresses.
  - crocodiletears 7y ago
    True. Bar assigning each hashed ip a block id, the data would be pretty useless. Even then you might still lose out on some important metadata.

duxup 7y ago

Is there any realistic expectation of anonymity when it comes to FCC comments? They usually publish the names of people who commented don't they? I know mine was accessible.

deleted 7y ago

[deleted]

acdha 7y ago

I don’t think this is actually much of a privacy change. Here’s what you agree to when you submit a comment: > Any comments that you submit to the FCC on a proposed rulemaking, petition, or other document for which public comment is requested will be made public, including any personally identifiable information you include in your submission. We may share non-personally identifiable information with others, including the public, in aggregated form, in partial or edited form, or verbatim. https://www.fcc.gov/consumers/guides/how-comment#comments https://www.fcc.gov/consumers/guides/how-comment#comments

Gaelan 7y ago
> including any personally identifiable information you include in your submission Wording here is a little ambiguous. As a techie, it's pretty easy to make an argument that the IP address is something I "included" in the submission (it's part of the packets my computer is sending on my behalf), but I'm not sure the average person would read it that way, instead interpreting it as pertaining only to information they explicitly typed into a text box.
- acdha 7y ago
  Yes, but even in that case how much does it change matters to go from your name, city, state, zip code, email address, etc. to include an IP? I mean, a data miner might be able to tell if you were posting from a house which isn’t yours or using your employer’s network but the entered PII is enough to uniquely identify a large number of people.
m463 7y ago
You could probably aggregate the IP addresses in a few ways and even maintain privacy: - how many submissions came from the ISP law offices address block? - how many submissions came from lobby group #12's address block? - which ip addresses had more than 20 unique submissions? then use the results as the basis for investigations. Some results could be benign, some results could be less so.

londons_explore 7y ago

Why not release a randomly selected sample of 100 comments? A random sample should be sufficient to see whats going on, if its sufficiently widespread to affect results.