9 ms·

The Norwegian parliament recently passed a bill that implements bulk metadata collection here as well. I tried debating with ministers, writing op-eds, and eve

by eivarv 6y ago

The Norwegian parliament recently passed a bill that implements bulk metadata collection here as well. I tried debating with ministers, writing op-eds, and even organizing petitions (over 1000 security, privacy and tech professionals in a couple of days) before the vote. While every informed person I know thinks it's a bad idea, and every organization consulted massively criticized it as mass surveillance, a huge majority of our nation's decision makers apparently disagreed. Watching video from the proceedings made me realize just how few of them have any real understanding both of the practical consequences of the technical implementation, as well as of privacy in and of itself (my jaw was literally agape from some comments). How can we do something about this sorry state of things when politicians are not only ignorant, but ignorant of their ignorance – and unwilling to listen to experts that are critical? Besides using privacy-preserving technologies, how can we work against this on a technical level?

pdonis 6y ago
> how can we work against this on a technical level? As the saying goes, you can't use a technical solution to fix a social problem. One way to fix the social problem is to vote politicians out of office when they make bad decisions--not just about surveillance, but in general. People who don't have to pay a cost for bad decisions have no incentive to make better decisions. Another way is to not give powers like this to governments in the first place. If politicians don't have decision making power at all over something, they can't harm the rest of us by making a bad decision.
- vkou 6y ago
  > Another way is to not give powers like this to governments in the first place. If politicians don't have decision making power at all over something, they can't harm the rest of us by making a bad decision. It is generally impossible for a parliament to pass a law that forbids a future parliament from repealing it.
  - pdonis 6y ago
    > It is generally impossible for a parliament to pass a law that forbids a future parliament from repealing it. Not giving powers to governments in the first place would be something at a higher level than parliamentary. In the US, it would be something like a Constitutional amendment. I agree that no such action, at any level, can ever be completely irreversible, in the sense that future citizens would never have to worry about the issue again. Eternal vigilance is the price of liberty.
    - vkou 6y ago
      And who adds or repeals constitutional amendments? The government.
      - arcticbull 6y ago
        Not sure why you're getting down-voted. Yes, constitutional amendments are repealed by the government. A very challenging majority of government officials, yes, but the government.
        cgriswald 6y ago
        This is not true in the United States, unless you conflate all the governments within the United States as "the government" and ignore the federal system. In the United States, either Congress or the States may adopt a proposed amendment with a 2/3 vote. However, and importantly, only the States can ratify the amendment with a 3/4 vote. This means that, in the United States, at least, "the government" itself cannot repeal amendments. It requires the approval of at least (at this time) 38 other governments.
        vkou 6y ago
        State, federal, it's still the government.
        6y ago
- fogetti 6y ago
  > One way to fix the social problem is to vote politicians out of office I think this kind of reactive view of the problem oversimplifies the issue. Many times it's a magnitude bigger problem to undo something than doing it in the first place.
- chooseaname 6y ago
  And yet another is to run for office.
- squarefoot 6y ago
  > One way to fix the social problem is to vote politicians out of office when they make bad decisions--not just about surveillance, but in general. In an ideal world that would be the way to go, but I'm not so sure in this one. Those people are masters at fooling voters using the same old tricks: "collecting data helps fighting terrorists", "only those who haven't anything to hide ...", "anonimity helps pedophiles, please think of the children!" etc. So to me that battle is a lost one. Until the day they actually outlaw and prosecute the use or even mere possession of countermeasures (encrypted disks, communication protocols and connections, etc.) I think we're to the point it's time to first implement them and then maybe attempting to solve the social problem the usual ways. Hopefully someone will prove me wrong.
- koonsolo 6y ago
  > As the saying goes, you can't use a technical solution to fix a social problem. True, but the law is so slow that you can continue to outpace it with technology.
- pacamara619 6y ago
  You cannot vote someone out of office, you can only vote for someone else. Who do you vote for when every somewhat popular candidate doesn't even know how to change their WLAN password?
deleted 6y ago
[deleted]
baxtr 6y ago
I’m almost at a point where I think a well programmed robot would do a better job using known heuristics and a method to test legislation for effectiveness.
- whatshisface 6y ago
  All of the effort that goes in to exploiting the humans would turn to exploiting the heuristics.
  - RonanTheGrey 6y ago
    This is why I remain a proponent of OP's original statement, "don't give governments the power to do it in the first place." Humans will always always always descend into abuse of power. Always. We basically suck.
- skrowl 6y ago
  If you think legislators of driven by what actually is effective instead of what lines their own pockets, you really aren't paying attention.
bundledock 6y ago
Networks require metadata to function, so metadata will always be around to abuse unless you can somehow invent networks that don't require it, which I have a hard time imagining. That means the only available methods to fix this problem are probably legal and regulatory, not technical.
coldtea 6y ago
>While every informed person I know thinks it's a bad idea, and every organization consulted massively criticized it as mass surveillance, a huge majority of our nation's decision makers apparently disagreed. Why would they agree? The whole thing is made to profit and empower them (as government and decision makers).
nuker 6y ago
> how can we work against this on a technical level? Always on VPN on all devices? Clear cookies? As a side benefit, people will move away from Google too, Google does not like VPNs.
mindfulhack 6y ago
I don't know if this comment is out of place, but it makes me realise the 'Americanisation' of the world (whenever that takes place) is not only the exporting of 'democracy', but also USA-style surveillance (and also American prudish cultural values - see Facebook as the instrument of that). It makes me realise that on some level, it's great we see countries who refuse to bow down to such 'americanisation'. I'm certainly not advocating for countries having despotism and corruption in their own right, but on some level, we need diversity.
dependenttypes 6y ago
> my jaw was literally agape from some comments I am curious, would you mind sharing some of them?
- eivarv 6y ago
  Context: This bill would mean implementing collecting all metadata of communications "crossing the border" (in practice most of Norwegian traffic), and that "service providers" (undefined) would have make unencrypted communications available if they can. The bill was about out military/foreign intelligence service. They would also combine this with "metadata" from other sources, as well as unspecified data from unspecified sources. They would be able to search in the metadata-storage via court-order. Content data could also be collected via court-order. From memory: - Members of the committee kept stating that this bill would provide us security (without arguing how/why) - Members of the committee kept ignoring rights-based arguments re: privacy from orgs like our DPA, Amnesty, the Norwegian Institute for Human Rights, Norwegian Society of Graduate Technical and Scientific Professionals, etc. - Members of the committee kept suggesting that the bill would let us protect ourselves against the types of attacks we've seen on large public (petroleum, health) services - Member of the committee kept harping about how this bill could protect us against identity-theft, hacking by extranational threat actors, etc. (despite obviously being out of legal scope) - Member of the committee arguing with consulted bodies (incl. organizations of editors, journalists) that source protection was not about democracy or the public, but about the individual - Comments from our Minister of Defense like: "This is not mass surveillance; It is mass storage" (mirroring arguments from Europe) and "Source protection should not be something threats to the nation can hide behind" - Top politicians conflating privacy with securing against external threats throughout debate, and claiming that we had to remember that the Norwegian state is not "the bad guy" - The government stating that without this bill, we'd be a less attractive collaborative partner internationally, and that most other countries have this sort of practice - The Minister claiming that the external intelligence service needs these tools to be able to do their job at all, casting doubt on the existing of a chilling effect, claiming the ends justify the means...

by eivarv 6y ago

pdonis 6y ago

> how can we work against this on a technical level? As the saying goes, you can't use a technical solution to fix a social problem. One way to fix the social problem is to vote politicians out of office when they make bad decisions--not just about surveillance, but in general. People who don't have to pay a cost for bad decisions have no incentive to make better decisions. Another way is to not give powers like this to governments in the first place. If politicians don't have decision making power at all over something, they can't harm the rest of us by making a bad decision.

vkou 6y ago
> Another way is to not give powers like this to governments in the first place. If politicians don't have decision making power at all over something, they can't harm the rest of us by making a bad decision. It is generally impossible for a parliament to pass a law that forbids a future parliament from repealing it.
- pdonis 6y ago
  > It is generally impossible for a parliament to pass a law that forbids a future parliament from repealing it. Not giving powers to governments in the first place would be something at a higher level than parliamentary. In the US, it would be something like a Constitutional amendment. I agree that no such action, at any level, can ever be completely irreversible, in the sense that future citizens would never have to worry about the issue again. Eternal vigilance is the price of liberty.
  - vkou 6y ago
    And who adds or repeals constitutional amendments? The government.
    - arcticbull 6y ago
      Not sure why you're getting down-voted. Yes, constitutional amendments are repealed by the government. A very challenging majority of government officials, yes, but the government.
      - cgriswald 6y ago
        This is not true in the United States, unless you conflate all the governments within the United States as "the government" and ignore the federal system. In the United States, either Congress or the States may adopt a proposed amendment with a 2/3 vote. However, and importantly, only the States can ratify the amendment with a 3/4 vote. This means that, in the United States, at least, "the government" itself cannot repeal amendments. It requires the approval of at least (at this time) 38 other governments.
        vkou 6y ago
        State, federal, it's still the government.
        6y ago
fogetti 6y ago
> One way to fix the social problem is to vote politicians out of office I think this kind of reactive view of the problem oversimplifies the issue. Many times it's a magnitude bigger problem to undo something than doing it in the first place.
chooseaname 6y ago
And yet another is to run for office.
squarefoot 6y ago
> One way to fix the social problem is to vote politicians out of office when they make bad decisions--not just about surveillance, but in general. In an ideal world that would be the way to go, but I'm not so sure in this one. Those people are masters at fooling voters using the same old tricks: "collecting data helps fighting terrorists", "only those who haven't anything to hide ...", "anonimity helps pedophiles, please think of the children!" etc. So to me that battle is a lost one. Until the day they actually outlaw and prosecute the use or even mere possession of countermeasures (encrypted disks, communication protocols and connections, etc.) I think we're to the point it's time to first implement them and then maybe attempting to solve the social problem the usual ways. Hopefully someone will prove me wrong.
koonsolo 6y ago
> As the saying goes, you can't use a technical solution to fix a social problem. True, but the law is so slow that you can continue to outpace it with technology.
pacamara619 6y ago
You cannot vote someone out of office, you can only vote for someone else. Who do you vote for when every somewhat popular candidate doesn't even know how to change their WLAN password?

deleted 6y ago

[deleted]

baxtr 6y ago

I’m almost at a point where I think a well programmed robot would do a better job using known heuristics and a method to test legislation for effectiveness.

whatshisface 6y ago
All of the effort that goes in to exploiting the humans would turn to exploiting the heuristics.
- RonanTheGrey 6y ago
  This is why I remain a proponent of OP's original statement, "don't give governments the power to do it in the first place." Humans will always always always descend into abuse of power. Always. We basically suck.
skrowl 6y ago
If you think legislators of driven by what actually is effective instead of what lines their own pockets, you really aren't paying attention.

bundledock 6y ago

Networks require metadata to function, so metadata will always be around to abuse unless you can somehow invent networks that don't require it, which I have a hard time imagining. That means the only available methods to fix this problem are probably legal and regulatory, not technical.

coldtea 6y ago

>While every informed person I know thinks it's a bad idea, and every organization consulted massively criticized it as mass surveillance, a huge majority of our nation's decision makers apparently disagreed. Why would they agree? The whole thing is made to profit and empower them (as government and decision makers).

nuker 6y ago

> how can we work against this on a technical level? Always on VPN on all devices? Clear cookies? As a side benefit, people will move away from Google too, Google does not like VPNs.

mindfulhack 6y ago

I don't know if this comment is out of place, but it makes me realise the 'Americanisation' of the world (whenever that takes place) is not only the exporting of 'democracy', but also USA-style surveillance (and also American prudish cultural values - see Facebook as the instrument of that). It makes me realise that on some level, it's great we see countries who refuse to bow down to such 'americanisation'. I'm certainly not advocating for countries having despotism and corruption in their own right, but on some level, we need diversity.

dependenttypes 6y ago

> my jaw was literally agape from some comments I am curious, would you mind sharing some of them?

eivarv 6y ago
Context: This bill would mean implementing collecting all metadata of communications "crossing the border" (in practice most of Norwegian traffic), and that "service providers" (undefined) would have make unencrypted communications available if they can. The bill was about out military/foreign intelligence service. They would also combine this with "metadata" from other sources, as well as unspecified data from unspecified sources. They would be able to search in the metadata-storage via court-order. Content data could also be collected via court-order. From memory: - Members of the committee kept stating that this bill would provide us security (without arguing how/why) - Members of the committee kept ignoring rights-based arguments re: privacy from orgs like our DPA, Amnesty, the Norwegian Institute for Human Rights, Norwegian Society of Graduate Technical and Scientific Professionals, etc. - Members of the committee kept suggesting that the bill would let us protect ourselves against the types of attacks we've seen on large public (petroleum, health) services - Member of the committee kept harping about how this bill could protect us against identity-theft, hacking by extranational threat actors, etc. (despite obviously being out of legal scope) - Member of the committee arguing with consulted bodies (incl. organizations of editors, journalists) that source protection was not about democracy or the public, but about the individual - Comments from our Minister of Defense like: "This is not mass surveillance; It is mass storage" (mirroring arguments from Europe) and "Source protection should not be something threats to the nation can hide behind" - Top politicians conflating privacy with securing against external threats throughout debate, and claiming that we had to remember that the Norwegian state is not "the bad guy" - The government stating that without this bill, we'd be a less attractive collaborative partner internationally, and that most other countries have this sort of practice - The Minister claiming that the external intelligence service needs these tools to be able to do their job at all, casting doubt on the existing of a chilling effect, claiming the ends justify the means...