6 ms·

How about we forbid the sale of our location data as a general principle, rather than just forbidding the government from purchasing it? Couldn't they just cont

How about we forbid the sale of our location data as a general principle, rather than just forbidding the government from purchasing it? Couldn't they just contract with a non-govt-entity that does have access to the information, and achieve results that way?

superkuh 6y ago
That is partially how they do things now, yes. This bill is a step in the right direction but doesn't actually fix anything. Since the cell phone system literally cannot work without location data (base stations need to know where the handset is) the data will always be there. But there's no reason to store it for 2-5 years as is currently done by US telcos. A "fix" for this situation would be to limit the stored location data to, say, a week. Then there would be no incentives for the companies to sell the data.
- atat7024 6y ago
  Yes there would. They'd just sell it to the same buyer, or an intermediary, as it happens.
- mjburgess 6y ago
  That data is absolutely vital in many criminal investigations to, eg., determine whether alibis are accurate. Many criminals have been caught in lies by taking calls that place them not-where-they-said-they-were. There's a please clear justification for holding that data and making it accessible via a warrant. What here needs reform is the warrant process, and more precisely, the incentive structures around policing. US DAs/Judges/Police/etc. need to be independent and impartial. At the moment excessive US electoral "democracy" creates pathological incentive structures.
  - throwaway0a5e 6y ago
    They did just fine before location data. They'll do just fine after location data. Especially with all the other digital breadcrumbs left around (security cameras and whatnot). If you don't think someone was somewhere they say they were there's a million other ways than phone data to check it out. Besides, it's not like "oh look his phone was elsewhere" ever stopped police from investigating someone. They just assume you left it at home or gave it to someone for the purposes of an alibi.
    - kelnos 6y ago
      > They did just fine before location data. I hear this sort of argument a lot, and often use it myself, but... did they? Sure, law enforcement existed and solved cases before they had access to location data, but are there some (more recent) cases that would have been unsolvable without it? Or has police efficacy not increased at all because of access to location data? Do we have data on this? As much as I'm not positive on law enforcement in general, I think it's reasonable to have access to location data. But that access should be gated behind a limited-scope court order, and judges should not be rubber-stamping them. On the other hand, it seems like any capability granted to law enforcement ends up getting abused, so I'm sympathetic to the idea of just banning all location data use.
  - Sleepytime 6y ago
    Most criminals know to use burner phones or at least turn off their phones, I'd be shocked if anything more than a token number of them were caught with this data. Meanwhile it can and does put innocent bystanders (often minorities) at risk of arrest or defamation for simply being in the area. >US DAs/Judges/Police/etc. need to be independent and impartial. This is like wishing hell had an air conditioner.
    - pupdogg 6y ago
      Agreed! Also note that violent Criminals have absolutely 0% incentive to purchase firearms via legal means or actual background checks leading to denial. Their intent to commit harm is by any means possible and they WILL figure out a way.
      - deleted 6y ago
        [deleted]
  - Mountain_Skies 6y ago
    Problem is history has shown that the mere existence of such information is too much of a temptation to resist. The "extraordinary" circumstances used to justify getting this data has a way of expanding over time until it becomes almost any routine reason being justification enough. The only way to combat this is for the information to not exist. Yes, in some cases this means a guilty person will go free but we have a long standing belief in western legal culture that it is better for some of the guilty to go free than to punish the innocent for the actions of the guilty. Invading everyone's privacy in the name of catching the small minority that engage in criminal activities is punishing the innocent for the crimes of the guilty.
    - Sleepytime 6y ago
      >The "extraordinary" circumstances used to justify getting this data has a way of expanding over time until it becomes almost any routine reason being justification enough. One need to look no further than the widespread use of swat teams and no knock raids for mundane purposes, when even 50 years ago most cities didn't even have a swat team.
      - throwaway0a5e 6y ago
        That's use it or lose it budgeting for you. Kind of hard to justify the "APC maintenance" line item if the answer to "how much did you use that thing" is "never" so things like MRAPs and the swat team get used in situations they shouldn't be just to inflate their usefulness on paper.
      - jfrunyon 6y ago
        People wouldn't think the world is so much more dangerous than 50 years ago if we didn't use the SWAT so often. And if people didn't think the world is more dangerous, then those in power wouldn't be able to get away with nearly as much money.
    - kelnos 6y ago
      > Yes, in some cases this means a guilty person will go free but we have a long standing belief in western legal culture that it is better for some of the guilty to go free than to punish the innocent for the actions of the guilty. I think that's a fine ideal (that I agree with), but I don't think any reverence for it is shared by many in law enforcement or the legal profession in general. Conviction rates are king, and incentives are often not aligned with true justice.
  - apazzolini 6y ago
    IANAL, but it seems to me that cell tower triangulation data proves a phone was at a given place at a given time but says nothing about who was in possession of the phone.
    - anigbrowl 6y ago
      Correct, but if I tell police I took a call from you while relaxing at home, and it turns out I did take the call, but was actually at the crime scene, then my alibi falls apart. Note this is not an endorsement of the grandparent's policy view, just an explanation of how it can be applied.
  - ska 6y ago
    > There's a please clear justification for holding that data and making it accessible via a warrant. That's not a justification, that's an argument. A justification would involved evidence-based analysis of why the potential benefits (that you point out) outweigh the potential risks (abuse of process, targeting, etc.). Given the current state of affairs (as you point out) it's not clear at all that the benefits win.
  - kelnos 6y ago
    That's what legal holds are for. I agree that a week is probably too short, but 3-5 years seems way too long. Six months, maybe? And a law enforcement agency can apply for a court order to put a hold on deleting data for specific people (a request that would require less scrutiny than requesting access to the data itself).
  - anigbrowl 6y ago
    That data is absolutely vital in many criminal investigations What you're arguing for here is to holding data on everyone for several years on the grounds that you might commit a crime in the future or be planning to commit a crime now. I'm OK with this for someone who has aroused sufficient suspicion to justify surveillance, but your approach makes mass surveillance the default condition.
- jfrunyon 6y ago
  > Then there would be no incentives for the companies to sell the data. That's just not true. You do realize that they sell your live location data, right?
teawrecks 6y ago
Or how about a GDPR for the US.
- toomuchtodo 6y ago
  Absolutely! Please contact your federal Congressional representatives and ask them to draft and assemble cosponsors for such legislation. California has made headway with CCPA, you don’t need many more states before it becomes the default without federal action. There is momentum, and it’d be a shame to waste it.
- GloriousKoji 6y ago
  As much as I love the spirit of the GDPR it hasn't done much other than add in an extra layer of annoying float over bars to webpages harassing me about cookies.
  - jfrunyon 6y ago
    Then you haven't been looking or you aren't in the EU and it therefore doesn't even apply to you...
  - anigbrowl 6y ago
    I'm in California so our similar law produced a similar result, but it's only once per website and (importantly) it's extremely clear and gives me a simple choice focused on my preferences, rather than those of the website operator. Now if we could just do something about js popups...
Mountain_Skies 6y ago
It's pretty clear that the US government has become very comfortable using corporate entities to do their dirty work for them. This, along with agreements with foreign governments such as the Five Eyes Alliance, means the government has pretty much limitless power to ignore the spirit of any privacy law while still complying with the letter of the law. Unfortunately many are fine with this because they believe it benefits their ideological group, which is more important than individual rights.
- barbacoa 6y ago
  >Unfortunately many are fine with this because they believe it benefits their ideological group, which is more important than individual rights. Sadly true. A good example from this year: https://theintercept.com/2021/02/22/capitol-riot-fbi-cellphone-records/ https://theintercept.com/2021/02/22/capitol-riot-fbi-cellpho... >...the FBI relied in some cases on emergency orders that do not require court authorization in order to quickly secure actual communications from people... I remember back in the day when this would outrage people.
  - colpabar 6y ago
    What really scares me is that it feels like in today's climate, the press would not even touch a story like the Snowden leaks. Not only that, but any outlet that did would be labeled as a spreader of misinformation, and banned. After all, it's a conspiracy theory, which means it's verboten.
    - SV_BubbleTime 6y ago
      It’s not like the press really did all that much with Snowden. The few journalists that were involved haven’t exactly jumped in fame or popularity greatly. In fact, looking at Greenwald who was recently ousted out of the outlet he started, pretty much the opposite. The press ran the story in my opinion half heartedly and imo forgave the transgressions because it was Obama in at the time. Most of the kick was directed right or wrong back to Bush. It’s not like Brennan or Clapper or Rice or Yates ever faced even a degree of heat for directly lying to Congress about domestic spying. I don’t at all disagree we live in a different world now, I just don’t have a perspective that this specific example was really that big at the time. Blurbs and tweets and Snowden Celebrity withstanding, the leaks had little to no actionable effect I can recall. I could be forgetting though.
mLuby 6y ago
Outlaw the sharing (and therefore resale) of all personally identifiable information. If companies want PII from their users, they should ask those users directly for permission. The legal test for a violation is straightforward: if a user can be de-anonymized from what the company shares along with public information.
joshka 6y ago
>Couldn't they just contract with a non-govt-entity that does have access to the information, and achieve results that way? On page 2 of the bill, the definition of 'covered customer or subscriber record' includes the following: (II) an intermediary service provider that delivers, stores, or processes communications of such covered person;
an_opabinia 6y ago
This is missing the forest for the trees. There isn't like, a piece of evidence presented here that any of this will matter. Wyden and others introduce bills of little substance all the time, they turn the best polling headline / title into bills. So in one perspective this is just politics as usual. Wyden's idiosyncratic donor focus groups ranked this highest this month and we're only hearing about it because this is Hacker News, and on some other forum there's some other bill we don't care about but also polled well with some other senator's donor focus groups. This isn't saying much, that legislation is reactionary, but it's interesting the specific mechanisms nowadays are super-representative, super-cheap focus groups and polling, enabled by services like Facebook and Instagram that these bills, ironically, target. Do these bills advance the cause of privacy? I don't really need location tracking data to guess that most of the time, you're at home or at work. And if you're eeking out such a subsistence existence that you don't have a permanent home or you're jobless? The bigger injustice is that the government has set an adversarial sight on you in the first place.

superkuh 6y ago

That is partially how they do things now, yes. This bill is a step in the right direction but doesn't actually fix anything. Since the cell phone system literally cannot work without location data (base stations need to know where the handset is) the data will always be there. But there's no reason to store it for 2-5 years as is currently done by US telcos. A "fix" for this situation would be to limit the stored location data to, say, a week. Then there would be no incentives for the companies to sell the data.

atat7024 6y ago
Yes there would. They'd just sell it to the same buyer, or an intermediary, as it happens.
mjburgess 6y ago
That data is absolutely vital in many criminal investigations to, eg., determine whether alibis are accurate. Many criminals have been caught in lies by taking calls that place them not-where-they-said-they-were. There's a please clear justification for holding that data and making it accessible via a warrant. What here needs reform is the warrant process, and more precisely, the incentive structures around policing. US DAs/Judges/Police/etc. need to be independent and impartial. At the moment excessive US electoral "democracy" creates pathological incentive structures.
- throwaway0a5e 6y ago
  They did just fine before location data. They'll do just fine after location data. Especially with all the other digital breadcrumbs left around (security cameras and whatnot). If you don't think someone was somewhere they say they were there's a million other ways than phone data to check it out. Besides, it's not like "oh look his phone was elsewhere" ever stopped police from investigating someone. They just assume you left it at home or gave it to someone for the purposes of an alibi.
  - kelnos 6y ago
    > They did just fine before location data. I hear this sort of argument a lot, and often use it myself, but... did they? Sure, law enforcement existed and solved cases before they had access to location data, but are there some (more recent) cases that would have been unsolvable without it? Or has police efficacy not increased at all because of access to location data? Do we have data on this? As much as I'm not positive on law enforcement in general, I think it's reasonable to have access to location data. But that access should be gated behind a limited-scope court order, and judges should not be rubber-stamping them. On the other hand, it seems like any capability granted to law enforcement ends up getting abused, so I'm sympathetic to the idea of just banning all location data use.
- Sleepytime 6y ago
  Most criminals know to use burner phones or at least turn off their phones, I'd be shocked if anything more than a token number of them were caught with this data. Meanwhile it can and does put innocent bystanders (often minorities) at risk of arrest or defamation for simply being in the area. >US DAs/Judges/Police/etc. need to be independent and impartial. This is like wishing hell had an air conditioner.
  - pupdogg 6y ago
    Agreed! Also note that violent Criminals have absolutely 0% incentive to purchase firearms via legal means or actual background checks leading to denial. Their intent to commit harm is by any means possible and they WILL figure out a way.
    - deleted 6y ago
      [deleted]
- Mountain_Skies 6y ago
  Problem is history has shown that the mere existence of such information is too much of a temptation to resist. The "extraordinary" circumstances used to justify getting this data has a way of expanding over time until it becomes almost any routine reason being justification enough. The only way to combat this is for the information to not exist. Yes, in some cases this means a guilty person will go free but we have a long standing belief in western legal culture that it is better for some of the guilty to go free than to punish the innocent for the actions of the guilty. Invading everyone's privacy in the name of catching the small minority that engage in criminal activities is punishing the innocent for the crimes of the guilty.
  - Sleepytime 6y ago
    >The "extraordinary" circumstances used to justify getting this data has a way of expanding over time until it becomes almost any routine reason being justification enough. One need to look no further than the widespread use of swat teams and no knock raids for mundane purposes, when even 50 years ago most cities didn't even have a swat team.
    - throwaway0a5e 6y ago
      That's use it or lose it budgeting for you. Kind of hard to justify the "APC maintenance" line item if the answer to "how much did you use that thing" is "never" so things like MRAPs and the swat team get used in situations they shouldn't be just to inflate their usefulness on paper.
    - jfrunyon 6y ago
      People wouldn't think the world is so much more dangerous than 50 years ago if we didn't use the SWAT so often. And if people didn't think the world is more dangerous, then those in power wouldn't be able to get away with nearly as much money.
  - kelnos 6y ago
    > Yes, in some cases this means a guilty person will go free but we have a long standing belief in western legal culture that it is better for some of the guilty to go free than to punish the innocent for the actions of the guilty. I think that's a fine ideal (that I agree with), but I don't think any reverence for it is shared by many in law enforcement or the legal profession in general. Conviction rates are king, and incentives are often not aligned with true justice.
- apazzolini 6y ago
  IANAL, but it seems to me that cell tower triangulation data proves a phone was at a given place at a given time but says nothing about who was in possession of the phone.
  - anigbrowl 6y ago
    Correct, but if I tell police I took a call from you while relaxing at home, and it turns out I did take the call, but was actually at the crime scene, then my alibi falls apart. Note this is not an endorsement of the grandparent's policy view, just an explanation of how it can be applied.
- ska 6y ago
  > There's a please clear justification for holding that data and making it accessible via a warrant. That's not a justification, that's an argument. A justification would involved evidence-based analysis of why the potential benefits (that you point out) outweigh the potential risks (abuse of process, targeting, etc.). Given the current state of affairs (as you point out) it's not clear at all that the benefits win.
- kelnos 6y ago
  That's what legal holds are for. I agree that a week is probably too short, but 3-5 years seems way too long. Six months, maybe? And a law enforcement agency can apply for a court order to put a hold on deleting data for specific people (a request that would require less scrutiny than requesting access to the data itself).
- anigbrowl 6y ago
  That data is absolutely vital in many criminal investigations What you're arguing for here is to holding data on everyone for several years on the grounds that you might commit a crime in the future or be planning to commit a crime now. I'm OK with this for someone who has aroused sufficient suspicion to justify surveillance, but your approach makes mass surveillance the default condition.
jfrunyon 6y ago
> Then there would be no incentives for the companies to sell the data. That's just not true. You do realize that they sell your live location data, right?

teawrecks 6y ago

Or how about a GDPR for the US.

toomuchtodo 6y ago
Absolutely! Please contact your federal Congressional representatives and ask them to draft and assemble cosponsors for such legislation. California has made headway with CCPA, you don’t need many more states before it becomes the default without federal action. There is momentum, and it’d be a shame to waste it.
GloriousKoji 6y ago
As much as I love the spirit of the GDPR it hasn't done much other than add in an extra layer of annoying float over bars to webpages harassing me about cookies.
- jfrunyon 6y ago
  Then you haven't been looking or you aren't in the EU and it therefore doesn't even apply to you...
- anigbrowl 6y ago
  I'm in California so our similar law produced a similar result, but it's only once per website and (importantly) it's extremely clear and gives me a simple choice focused on my preferences, rather than those of the website operator. Now if we could just do something about js popups...

Mountain_Skies 6y ago

It's pretty clear that the US government has become very comfortable using corporate entities to do their dirty work for them. This, along with agreements with foreign governments such as the Five Eyes Alliance, means the government has pretty much limitless power to ignore the spirit of any privacy law while still complying with the letter of the law. Unfortunately many are fine with this because they believe it benefits their ideological group, which is more important than individual rights.

barbacoa 6y ago
>Unfortunately many are fine with this because they believe it benefits their ideological group, which is more important than individual rights. Sadly true. A good example from this year: https://theintercept.com/2021/02/22/capitol-riot-fbi-cellphone-records/ https://theintercept.com/2021/02/22/capitol-riot-fbi-cellpho... >...the FBI relied in some cases on emergency orders that do not require court authorization in order to quickly secure actual communications from people... I remember back in the day when this would outrage people.
- colpabar 6y ago
  What really scares me is that it feels like in today's climate, the press would not even touch a story like the Snowden leaks. Not only that, but any outlet that did would be labeled as a spreader of misinformation, and banned. After all, it's a conspiracy theory, which means it's verboten.
  - SV_BubbleTime 6y ago
    It’s not like the press really did all that much with Snowden. The few journalists that were involved haven’t exactly jumped in fame or popularity greatly. In fact, looking at Greenwald who was recently ousted out of the outlet he started, pretty much the opposite. The press ran the story in my opinion half heartedly and imo forgave the transgressions because it was Obama in at the time. Most of the kick was directed right or wrong back to Bush. It’s not like Brennan or Clapper or Rice or Yates ever faced even a degree of heat for directly lying to Congress about domestic spying. I don’t at all disagree we live in a different world now, I just don’t have a perspective that this specific example was really that big at the time. Blurbs and tweets and Snowden Celebrity withstanding, the leaks had little to no actionable effect I can recall. I could be forgetting though.

mLuby 6y ago

Outlaw the sharing (and therefore resale) of all personally identifiable information. If companies want PII from their users, they should ask those users directly for permission. The legal test for a violation is straightforward: if a user can be de-anonymized from what the company shares along with public information.

joshka 6y ago

>Couldn't they just contract with a non-govt-entity that does have access to the information, and achieve results that way? On page 2 of the bill, the definition of 'covered customer or subscriber record' includes the following: (II) an intermediary service provider that delivers, stores, or processes communications of such covered person;

an_opabinia 6y ago

This is missing the forest for the trees. There isn't like, a piece of evidence presented here that any of this will matter. Wyden and others introduce bills of little substance all the time, they turn the best polling headline / title into bills. So in one perspective this is just politics as usual. Wyden's idiosyncratic donor focus groups ranked this highest this month and we're only hearing about it because this is Hacker News, and on some other forum there's some other bill we don't care about but also polled well with some other senator's donor focus groups. This isn't saying much, that legislation is reactionary, but it's interesting the specific mechanisms nowadays are super-representative, super-cheap focus groups and polling, enabled by services like Facebook and Instagram that these bills, ironically, target. Do these bills advance the cause of privacy? I don't really need location tracking data to guess that most of the time, you're at home or at work. And if you're eeking out such a subsistence existence that you don't have a permanent home or you're jobless? The bigger injustice is that the government has set an adversarial sight on you in the first place.