3 ms·

> When things were done that way, surveillance was possible but it was expensive. Yes, I mean I didn't suggest otherwise. What you're describing is a differenc

by bhupy 6y ago

> When things were done that way, surveillance was possible but it was expensive. Yes, I mean I didn't suggest otherwise. What you're describing is a difference in degree, not kind. In principle not much has changed. > It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours. This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense. On the flip side, today, in the age of information, the market has produced tools that allow us to communicate via end-to-end encryption that has finally become somewhat insurmountable by even state actors. This is why the US government is actively[1] trying to outlaw warrant-proof encryption. > PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm. > In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. I'm not sure that I agree. The EMV standard for payment cards is fairly robust. > And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world. This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. If your argument is that most people use cash, then that's orthogonal to a discussion about the risks of digital systems. > I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue. Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction. [1] https://www.judiciary.senate.gov/press/rep/releases/graham-cotton-blackburn-introduce-balanced-solution-to-bolster-national-security-end-use-of-warrant-proof-encryption-that-shields-criminal-activity https://www.judiciary.senate.gov/press/rep/releases/graham-c...

Silhouette 6y ago
What you're describing is a difference in degree, not kind. Here we clearly disagree. I think the ubiquitous surveillance that happens today very much is a qualitative difference. A single data point of the kind that is captured might not be very interesting, and a single person leaving their home and seen by another person passing in the street would be forgotten in moments. But the huge databases that are built today, combining many types of personal data from many sources to build a picture of everyone's personal lives at an unprecedented level of detail, is something that has never happened before. This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense. Sure, but the expense meant that is was targeted. People expect the state to make some attempt to monitor criminals or those reasonably believed to be planning a serious crime. That's totally different from private multinational entities building up vast databases profiling billions of people. PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm. Not for small businesses, they're not. I don't know of a single small business that has ever been audited under PCI-DSS. And these are the ones that will keep your CVC code in the unencrypted spreadsheet on the unprotected laptop they use to track their customers' phone orders. I'm not sure that I agree. If I have someone's credit card in my hand, then right now I can walk into any shop in the area and buy up to £45 of goods without a question being asked. If I go online, even with just the details embossed on the card, I could buy way more from countless stores. With just a little more widely available personal information about the cardholder, I could buy even more still. This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. Do you realise that there are entire first world countries where credit cards are hardly used? That outside the US, direct payment/debit schemes are widespread? Take a look at one of the big multi-method payment services. They offer hundreds of different options for accepting payments from different places around the world. Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction. So because Google is in the US, I shouldn't be concerned that everyone holding an Android phone within sight or earshot of me is potentially sending data about me to Google, that everyone I ever send an email to might be sharing the contents of the message with Google, and so on? Sorry, but I simply don't agree. Just because these huge multinationals may be based outside of easy legal reach for me, that doesn't mean they don't pose a danger to me or almost 70 million of my fellow citizens here, or the same for any other country.

by bhupy 6y ago

Silhouette 6y ago

What you're describing is a difference in degree, not kind. Here we clearly disagree. I think the ubiquitous surveillance that happens today very much is a qualitative difference. A single data point of the kind that is captured might not be very interesting, and a single person leaving their home and seen by another person passing in the street would be forgotten in moments. But the huge databases that are built today, combining many types of personal data from many sources to build a picture of everyone's personal lives at an unprecedented level of detail, is something that has never happened before. This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense. Sure, but the expense meant that is was targeted. People expect the state to make some attempt to monitor criminals or those reasonably believed to be planning a serious crime. That's totally different from private multinational entities building up vast databases profiling billions of people. PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm. Not for small businesses, they're not. I don't know of a single small business that has ever been audited under PCI-DSS. And these are the ones that will keep your CVC code in the unencrypted spreadsheet on the unprotected laptop they use to track their customers' phone orders. I'm not sure that I agree. If I have someone's credit card in my hand, then right now I can walk into any shop in the area and buy up to £45 of goods without a question being asked. If I go online, even with just the details embossed on the card, I could buy way more from countless stores. With just a little more widely available personal information about the cardholder, I could buy even more still. This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. Do you realise that there are entire first world countries where credit cards are hardly used? That outside the US, direct payment/debit schemes are widespread? Take a look at one of the big multi-method payment services. They offer hundreds of different options for accepting payments from different places around the world. Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction. So because Google is in the US, I shouldn't be concerned that everyone holding an Android phone within sight or earshot of me is potentially sending data about me to Google, that everyone I ever send an email to might be sharing the contents of the message with Google, and so on? Sorry, but I simply don't agree. Just because these huge multinationals may be based outside of easy legal reach for me, that doesn't mean they don't pose a danger to me or almost 70 million of my fellow citizens here, or the same for any other country.