7 ms·

I think there's a simpler way to achieve this. Force companies who leak personal data to pay reasonable damages to all the individuals involved, on the scale of

I think there's a simpler way to achieve this. Force companies who leak personal data to pay reasonable damages to all the individuals involved, on the scale of 10-100 dollars, depending on how much personal info has been leaked. That would make businesses very quickly reassess how much data they need to keep, and how careful they need to be with it, without requiring any really radical legislation.

pjerem 5y ago
Yeah but what is a leak ? Do you consider it a leak when a data transfer to another company is intentional ? Companies like Google are probably secured like fortress and will probably not leak data anytime soon (lets hope) so your idea wont have any effect against giants that takes security seriously. However, I really like your point and you'll probably have a good side effect on middle size companies. But giants are a giant part of the problem.
- pasabagi 5y ago
  Well, my suggestion is kind of aiming to be as pragmatic and unambitious as possible, so the fact it doesn't have an effect against giants who spend a lot of money on security is part of the pragmatism - it means you split the opposition a bill like this would face. The big companies would see it as a way to expand their moat, and so, they'd probably lobby for it, or at least, you could convince them not to lobby against it. If you can build a big coalition of people for whom privacy is something important, then you can start making ambitious policy proposals because you'll have the voters to back it up. Before that point, I think you have to try for easy wins.
- inetknght 5y ago
  > Yeah but what is a leak? Any time someone who's not me or a direct party to a transaction or conversation learns something about me then that is a "leak". > Do you consider it a leak when a data transfer to another company is intentional? If I do business with my bank then the bank should have no right to sell my information to a third party for any reason whatsoever. If I do business with my hair stylist then the credit card processor should not have any right whatsoever to do anything with the facts: - where was the hair stylist? That's private. - who was the hair stylist? That's private. - when was I at the hair stylist? That's private. - what did the hair stylist sell? That's private. - why did I go to the hair stylist? That's private. Nobody except my hair stylist and myself should have this information.
  - jefftk 5y ago
    > someone who's not me or a direct party to a transaction or conversation It sounds to me like this definition strongly promotes consolidation. The bigger a party is, the more information it would be allowed to have and the more ways it can use it to cross-sell. > If I do business with my hair stylist then the credit card processor should not have any right whatsoever to do anything with the facts... Should the credit card company be allowed to use the information about your transaction to assess how likely it is that someone has stolen your card?
    - inetknght 5y ago
      > Should the credit card company be allowed to use the information about your transaction to assess how likely it is that someone has stolen your card? I've been called by the credit card company many times for failed transactions that I've authorized. When fraud did occur then I was not contacted by my card company and I had only noticed the fraud because I actively monitor my card. The credit card company should be able to determine what it wants without providing the information to any other entity. No, I do not think that the credit card company should be permitted to sell the information about my transaction under the guise of determining how likely it is that someone has stolen my card.
      - jefftk 5y ago
        > I've been called by the credit card company many times for failed transactions that I've authorized. When fraud did occur then I was not contacted by my card company and I had only noticed the fraud because I actively monitor my card. Yes, credit card antifraud has both false positives and false negatives. It's not clear to me whether you're going from there to saying that it is useless? > I do not think that the credit card company should be permitted to sell the information about my transaction under the guise of determining how likely it is that someone has stolen my card. I think I misunderstood you earlier. When you wrote "the credit card processor should not have any right whatsoever to do anything with the facts..." I thought you meant that they shouldn't be allowed to use the credit card data to do anything, including fraud prevention, not just that they shouldn't be allowed to sell it?
ColinHayhurst 5y ago
Johnny Ryan is having another go this time in Hamburg. "Online advertising causes the world's biggest data breach. We are going to court to stop it." https://www.iccl.ie/rtb-june-2021/ https://www.iccl.ie/rtb-june-2021/ As he eloquently explains there, and in detail, RTB auctions "broadcasts private information about what you are doing online, and where you are, to many other companies in order to solicit their bids for the opportunity to show you their ad."
handrous 5y ago
Yeah, rather than targeting advertising I'd prefer to get to the actual point, and target mass surveillance and collection of huge troves of personal data no matter the purpose. Ban monetizing data (no selling, no pay-for-access, no derived products) and make leaks guaranteed to be expensive, so companies only keep what they have to to operate, with some large multiplier attached to the leak fine if it was related to banned activities. Done. The advertising is a symptom, it's not the disease.
- blooalien 5y ago
  > … "get to the actual point, and target mass surveillance and collection of huge troves of personal data no matter the purpose." This! Exactly this!
- amelius 5y ago
  > The advertising is a symptom, it's not the disease. Advertising also stimulates mass overconsumption. If we want to save the planet, advertising is among the top things we should ban right away.
  - handrous 5y ago
    Right, but the alternative in question is banning surveillance-based advertising. I'd prefer to curb surveillance itself, having the side-effect of eliminating surveillance-based advertising. Separately, yes, I'd like to see practically all public advertising banned (billboards are blight), and while I'd have to think on it some more before supporting a blanket ban on all advertising (I'm not sure it's workable, for one thing) I'd also not be sad if I woke up one morning and learned that such a law had been passed.
    - kerkeslager 5y ago
      From my perspective, both advertising and surveillance are bad, and both should be banned.
      - 5y ago
cartoonworld 5y ago
I don't think that's gonna cut it, but definitely on the right track. Its going to require some kind of legislation, or an insurance requirement that renders the insurers as de-facto regulators. This is still crazy hard due to the possibility of regulatory arbitrage, just open shop in Anguilla or wherever. Without the auditing, compliance, and domain experts to verify and implement this, its going to be extremely hard to create and levy these penalties in any meaningful way. Using (legally) vague terms like "leak" "personal" "data" and "involved", a quick trip to the local courtroom will obviate a lot of the fines for well connected C-execs and legal teams. Data integrity needs to be baked into the equation from the start. Until it is a business requirement to ensure proper system architecture practices, data integrity, and auditing, I don't see a snowball's chance of reaching sanity. Really, we've only barely defined the problem. Businesses have compliance departments that are totally subservient to business needs and would much rather resort to gaslighting stakeholders with silver-bullet checkbox security technology processes shaded in at the board room. On the other side, we are now ushering in a fascinating golden age of the security rodeo. There is astonishing growth in this industry, enjoy unending contracts for Red and Blue alike. It could soon really begin to look like a Gibson novel.
- shkkmo 5y ago
  The problem is it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies. It's really hard to come up with a set of regulations here that protects users data and doesn't completely disadvantage startups and small businesses.
  - ClumsyPilot 5y ago
    We do not regulate how a coffee shop does accounts in the same way we regulate a bank. Many regulations only apply to companies bigger than 50 employees, more than billion of turnover, data on over 1 million people, etc. Or in a spesific market.
  - cartoonworld 5y ago
    Well, in this instance I would argue that the current state of affairs also completely disadvantages startups and small businesses. Kaseya has a whole portfolio of services marketed to small, medium and startup business (as well as larger) that their customers bought in order to enable them to leverage this business model in the first place. They've since burned countless providers, torching their relationship with customers, shutting down countless businesses of all sizes all across the planet. What is the cost to them of this? Worst case scenario, they fold and change the sign. The people in charge of not screwing up will be snatched from doom by their network. I would hope they do better next time, but why would that be any more likely than just another over par round of golf? I definitely agree that it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies or to develop some kind of regulatory structure. The alternative to not doing this is accepting this unstable chaos-monkey in perpetuity. If there is no business requirement for effective controls, there wont be any. Kaseya's people can walk and start another tire fire and surely everyone else will sweep up and move on, but these problems are everybody's problems. There is no IT infrastructure that does not require effective controls. If we don't improve this problem, things are gonna get weird.
lolsal 5y ago
If my information gets leaked and my identity compromised, you think $10-100 is reasonable compensation? I like the idea but I don't think we can put any sort of numbers on damages like this before it happens.
- ClumsyPilot 5y ago
  We need a minimal sum to enable lawsuita. Every time there is a leak, you have to prove you've suffered damages. That's hard to prove: even if someone commited massive fraud with your identify, you dont know if the data came from this leak, or from 10 other leaks. Setting a minimum would mean thay you can immediately fine conpanies for loosing millions of records in one lawsuit, instead of a million suits proving that each particular claimant was harmed
Jonsvt 5y ago
This is not a question of leaks. The data is already in the wrong hands and actively being misused.
amelius 5y ago
> Force companies who leak personal data to pay reasonable damages to all the individuals involved Companies like Google and Facebook already leak. Proof: start an ad campaign on e.g. Facebook targeted at people who have trait X, but sell a product Y not related to X. For people who click on the ad and buy your product Y, you now know they have trait X. And you can now also link that to their address info.
- jefftk 5y ago
  Run an ad campaign in a magazine dedicated to a sensitive topic, selling something by mail-order. For people who write to you and buy your product, now you know they are interested in that sensitive topic. (Disclosure: I work on ads at Google, speaking only for myself)
  - blooalien 5y ago
    Hey, mad respect at you for bein' able to discuss this without sounding like an advertising shill, and for bein' open about your place of employment and for coverin' your butt by makin' your comments known to be yours and not your employers'. Wish more folks could do that. Good job of "adulting" there. ;) As a (sometimes) "consumer", I personally don't mind companies I'm doing business with gathering some data to better serve me as a customer. It's actually kinda their job. And I don't even mind when they advertise related products/services at me (but not the product/service I just bought please). And I don't mind one little bit bein' advertised at (respectfully) when I'm on a site where I'm obviously lookin' to buy something. My main problem is that too often there's a degree of uncomfortable overreach with building (and worse yet, sharing around) a detailed profile of my travels on the web that is beyond unnecessary and unreasonable. I don't honestly trust most personal friends with as much information about me as some freakin' advertisers would seem to want to database and index about me. It's gotten honestly out of control, and I don't know what else to do anymore except use every tool my browser has available to block as much of it as I can actively.
  - amelius 5y ago
    Well, you've just found another leak ;) By the way, scale matters too.
beervirus 5y ago
Leaks are not even my main concern. I don’t want anyone spying on me, even if they’re really conscientious about data protection.
pomian 5y ago
This is what happened with pollution. Leaks were common. But it cost to fix. Then regulations came in to fine any leakage. It works, but is always the lowest priority for any company. Because it's a profit drain not profit growth.
dalbasal 5y ago
I don't think the letter writers' goal is data security.
2OEH8eoCRo0 5y ago
>Force companies who leak personal data to pay reasonable damages to all the individuals involved Doesn't this just consolidate power among FAAG even more? They can pay these fines and they don't often leak data- if ever. That's another thing- define leaking data. Sharing with 3rd parties? It's vague enough for them to beat that in court. We do somehow need to get back to advertising the old fashioned way rather than this surveillance capitalism arms-race.
- squiggleblaz 5y ago
  > We do somehow need to get back to advertising the old fashioned way rather than this surveillance capitalism arms-race. Old fashioned ads were targeted based on the thing they were attached to. For instance, if you read the sports pages of a newspaper sold in your city, you probably got ads of presumed interest to people in your city who are interested in sports. To restore that kind of system, you would need to focus on those kinds of issues: making advertising first party, distinguishing between parts of a site without distinguishing between users. But once you've done that, you're still left with first parties that can spy on you and use that data in non-advertising ways, or even presumably for direct marketing (if you have some kind of an account). I think it's better to focus on the surveillance. If they can't surveil you, then they can't use surveillance advertising. As you point out, focusing on leaks is irrelevant because I don't really feel better that only Google knows everything about me. Focusing on advertising doesn't stop them collecting data, it just limits how they can use it. If we don't want the data to exist, collecting it should be prohibited.
zwkrt 5y ago
Facebook et al want the privacy discussion to revolve around “keeping your personal data safe” but that is just bald-faced propaganda that covers up the fundamental issue. It’s not like Facebook’s digital model of my behavior is really “mine” and they are just borrowing it or protecting it. They don’t even care about my data in the singular. What they do have is a giant corpus of behavioral data spanning everyone on the planet. Companies can (statistically) detect that you are going to get a divorce, or that you are going to be pregnant. They know everyone who has been to jail, our sexual fantasies, how likely it is that our children will go to college. Right now we say they sell ads, but you could just as correctly say that they take advantage of this incredible, unprecedented information advantage to directly change the world in their favor and in the favor of whoever can pay. It used to be used to sell clothing and frippery, but already SM is plastered with ads for political campaigns and brain-altering drugs. Their cultural hegemony will only increase over time, as the data gets better and the methods become more effective. In this regime, what does it even mean for Facebook to “leak my data”? If anything I’d rather it was out in the open. (Although I’d much rather it didn’t exist!)
- pasabagi 5y ago
  I generally think along your lines, but I think there is an actually a fundamental question here: do we care about privacy? My feeling is that surveillance states are more or less the norm, and it tends to become controversial as a sort of stand-in for other issues. So, for instance, the DDR's extreme surveillance apparatus becomes a sort of explanation for why this relatively bland state was actually a historic example of evil. In england, there's a (very mild) controversy about the use of secret police to surveil activists - it became controversial because several of them had sexual relationships, and even children, while in their undercover role. One of the curious features of all this was who merited attention. One group of vegan restaurant connoisseurs, who met on fridays to review welsh vegan diners, discovered that one of their members was a police officer, for example. This surveillance, which really had no bounds, including the surveillance of sitting government ministers (always labour, fwiw), is actually very typical, historically speaking. So, while I'm broadly in agreement with you when it comes to the dangers of surveillance, I think we've all had and lost this argument in the past, and the fact is, if the state historically wanted to destroy or persecute a specific group, paper records were always enough. That means that if you want to make meaningful progress in the face of this information asymmetry, you have to find wedge issues.

pjerem 5y ago

Yeah but what is a leak ? Do you consider it a leak when a data transfer to another company is intentional ? Companies like Google are probably secured like fortress and will probably not leak data anytime soon (lets hope) so your idea wont have any effect against giants that takes security seriously. However, I really like your point and you'll probably have a good side effect on middle size companies. But giants are a giant part of the problem.

pasabagi 5y ago
Well, my suggestion is kind of aiming to be as pragmatic and unambitious as possible, so the fact it doesn't have an effect against giants who spend a lot of money on security is part of the pragmatism - it means you split the opposition a bill like this would face. The big companies would see it as a way to expand their moat, and so, they'd probably lobby for it, or at least, you could convince them not to lobby against it. If you can build a big coalition of people for whom privacy is something important, then you can start making ambitious policy proposals because you'll have the voters to back it up. Before that point, I think you have to try for easy wins.
inetknght 5y ago
> Yeah but what is a leak? Any time someone who's not me or a direct party to a transaction or conversation learns something about me then that is a "leak". > Do you consider it a leak when a data transfer to another company is intentional? If I do business with my bank then the bank should have no right to sell my information to a third party for any reason whatsoever. If I do business with my hair stylist then the credit card processor should not have any right whatsoever to do anything with the facts: - where was the hair stylist? That's private. - who was the hair stylist? That's private. - when was I at the hair stylist? That's private. - what did the hair stylist sell? That's private. - why did I go to the hair stylist? That's private. Nobody except my hair stylist and myself should have this information.
- jefftk 5y ago
  > someone who's not me or a direct party to a transaction or conversation It sounds to me like this definition strongly promotes consolidation. The bigger a party is, the more information it would be allowed to have and the more ways it can use it to cross-sell. > If I do business with my hair stylist then the credit card processor should not have any right whatsoever to do anything with the facts... Should the credit card company be allowed to use the information about your transaction to assess how likely it is that someone has stolen your card?
  - inetknght 5y ago
    > Should the credit card company be allowed to use the information about your transaction to assess how likely it is that someone has stolen your card? I've been called by the credit card company many times for failed transactions that I've authorized. When fraud did occur then I was not contacted by my card company and I had only noticed the fraud because I actively monitor my card. The credit card company should be able to determine what it wants without providing the information to any other entity. No, I do not think that the credit card company should be permitted to sell the information about my transaction under the guise of determining how likely it is that someone has stolen my card.
    - jefftk 5y ago
      > I've been called by the credit card company many times for failed transactions that I've authorized. When fraud did occur then I was not contacted by my card company and I had only noticed the fraud because I actively monitor my card. Yes, credit card antifraud has both false positives and false negatives. It's not clear to me whether you're going from there to saying that it is useless? > I do not think that the credit card company should be permitted to sell the information about my transaction under the guise of determining how likely it is that someone has stolen my card. I think I misunderstood you earlier. When you wrote "the credit card processor should not have any right whatsoever to do anything with the facts..." I thought you meant that they shouldn't be allowed to use the credit card data to do anything, including fraud prevention, not just that they shouldn't be allowed to sell it?

ColinHayhurst 5y ago

Johnny Ryan is having another go this time in Hamburg. "Online advertising causes the world's biggest data breach. We are going to court to stop it." https://www.iccl.ie/rtb-june-2021/ https://www.iccl.ie/rtb-june-2021/ As he eloquently explains there, and in detail, RTB auctions "broadcasts private information about what you are doing online, and where you are, to many other companies in order to solicit their bids for the opportunity to show you their ad."

handrous 5y ago

Yeah, rather than targeting advertising I'd prefer to get to the actual point, and target mass surveillance and collection of huge troves of personal data no matter the purpose. Ban monetizing data (no selling, no pay-for-access, no derived products) and make leaks guaranteed to be expensive, so companies only keep what they have to to operate, with some large multiplier attached to the leak fine if it was related to banned activities. Done. The advertising is a symptom, it's not the disease.

blooalien 5y ago
> … "get to the actual point, and target mass surveillance and collection of huge troves of personal data no matter the purpose." This! Exactly this!
amelius 5y ago
> The advertising is a symptom, it's not the disease. Advertising also stimulates mass overconsumption. If we want to save the planet, advertising is among the top things we should ban right away.
- handrous 5y ago
  Right, but the alternative in question is banning surveillance-based advertising. I'd prefer to curb surveillance itself, having the side-effect of eliminating surveillance-based advertising. Separately, yes, I'd like to see practically all public advertising banned (billboards are blight), and while I'd have to think on it some more before supporting a blanket ban on all advertising (I'm not sure it's workable, for one thing) I'd also not be sad if I woke up one morning and learned that such a law had been passed.
  - kerkeslager 5y ago
    From my perspective, both advertising and surveillance are bad, and both should be banned.
    - 5y ago

cartoonworld 5y ago

I don't think that's gonna cut it, but definitely on the right track. Its going to require some kind of legislation, or an insurance requirement that renders the insurers as de-facto regulators. This is still crazy hard due to the possibility of regulatory arbitrage, just open shop in Anguilla or wherever. Without the auditing, compliance, and domain experts to verify and implement this, its going to be extremely hard to create and levy these penalties in any meaningful way. Using (legally) vague terms like "leak" "personal" "data" and "involved", a quick trip to the local courtroom will obviate a lot of the fines for well connected C-execs and legal teams. Data integrity needs to be baked into the equation from the start. Until it is a business requirement to ensure proper system architecture practices, data integrity, and auditing, I don't see a snowball's chance of reaching sanity. Really, we've only barely defined the problem. Businesses have compliance departments that are totally subservient to business needs and would much rather resort to gaslighting stakeholders with silver-bullet checkbox security technology processes shaded in at the board room. On the other side, we are now ushering in a fascinating golden age of the security rodeo. There is astonishing growth in this industry, enjoy unending contracts for Red and Blue alike. It could soon really begin to look like a Gibson novel.

shkkmo 5y ago
The problem is it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies. It's really hard to come up with a set of regulations here that protects users data and doesn't completely disadvantage startups and small businesses.
- ClumsyPilot 5y ago
  We do not regulate how a coffee shop does accounts in the same way we regulate a bank. Many regulations only apply to companies bigger than 50 employees, more than billion of turnover, data on over 1 million people, etc. Or in a spesific market.
- cartoonworld 5y ago
  Well, in this instance I would argue that the current state of affairs also completely disadvantages startups and small businesses. Kaseya has a whole portfolio of services marketed to small, medium and startup business (as well as larger) that their customers bought in order to enable them to leverage this business model in the first place. They've since burned countless providers, torching their relationship with customers, shutting down countless businesses of all sizes all across the planet. What is the cost to them of this? Worst case scenario, they fold and change the sign. The people in charge of not screwing up will be snatched from doom by their network. I would hope they do better next time, but why would that be any more likely than just another over par round of golf? I definitely agree that it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies or to develop some kind of regulatory structure. The alternative to not doing this is accepting this unstable chaos-monkey in perpetuity. If there is no business requirement for effective controls, there wont be any. Kaseya's people can walk and start another tire fire and surely everyone else will sweep up and move on, but these problems are everybody's problems. There is no IT infrastructure that does not require effective controls. If we don't improve this problem, things are gonna get weird.

lolsal 5y ago

If my information gets leaked and my identity compromised, you think $10-100 is reasonable compensation? I like the idea but I don't think we can put any sort of numbers on damages like this before it happens.

ClumsyPilot 5y ago
We need a minimal sum to enable lawsuita. Every time there is a leak, you have to prove you've suffered damages. That's hard to prove: even if someone commited massive fraud with your identify, you dont know if the data came from this leak, or from 10 other leaks. Setting a minimum would mean thay you can immediately fine conpanies for loosing millions of records in one lawsuit, instead of a million suits proving that each particular claimant was harmed

Jonsvt 5y ago

This is not a question of leaks. The data is already in the wrong hands and actively being misused.

amelius 5y ago

> Force companies who leak personal data to pay reasonable damages to all the individuals involved Companies like Google and Facebook already leak. Proof: start an ad campaign on e.g. Facebook targeted at people who have trait X, but sell a product Y not related to X. For people who click on the ad and buy your product Y, you now know they have trait X. And you can now also link that to their address info.

jefftk 5y ago
Run an ad campaign in a magazine dedicated to a sensitive topic, selling something by mail-order. For people who write to you and buy your product, now you know they are interested in that sensitive topic. (Disclosure: I work on ads at Google, speaking only for myself)
- blooalien 5y ago
  Hey, mad respect at you for bein' able to discuss this without sounding like an advertising shill, and for bein' open about your place of employment and for coverin' your butt by makin' your comments known to be yours and not your employers'. Wish more folks could do that. Good job of "adulting" there. ;) As a (sometimes) "consumer", I personally don't mind companies I'm doing business with gathering some data to better serve me as a customer. It's actually kinda their job. And I don't even mind when they advertise related products/services at me (but not the product/service I just bought please). And I don't mind one little bit bein' advertised at (respectfully) when I'm on a site where I'm obviously lookin' to buy something. My main problem is that too often there's a degree of uncomfortable overreach with building (and worse yet, sharing around) a detailed profile of my travels on the web that is beyond unnecessary and unreasonable. I don't honestly trust most personal friends with as much information about me as some freakin' advertisers would seem to want to database and index about me. It's gotten honestly out of control, and I don't know what else to do anymore except use every tool my browser has available to block as much of it as I can actively.
- amelius 5y ago
  Well, you've just found another leak ;) By the way, scale matters too.

beervirus 5y ago

Leaks are not even my main concern. I don’t want anyone spying on me, even if they’re really conscientious about data protection.

pomian 5y ago

This is what happened with pollution. Leaks were common. But it cost to fix. Then regulations came in to fine any leakage. It works, but is always the lowest priority for any company. Because it's a profit drain not profit growth.

dalbasal 5y ago

I don't think the letter writers' goal is data security.

2OEH8eoCRo0 5y ago

>Force companies who leak personal data to pay reasonable damages to all the individuals involved Doesn't this just consolidate power among FAAG even more? They can pay these fines and they don't often leak data- if ever. That's another thing- define leaking data. Sharing with 3rd parties? It's vague enough for them to beat that in court. We do somehow need to get back to advertising the old fashioned way rather than this surveillance capitalism arms-race.

squiggleblaz 5y ago
> We do somehow need to get back to advertising the old fashioned way rather than this surveillance capitalism arms-race. Old fashioned ads were targeted based on the thing they were attached to. For instance, if you read the sports pages of a newspaper sold in your city, you probably got ads of presumed interest to people in your city who are interested in sports. To restore that kind of system, you would need to focus on those kinds of issues: making advertising first party, distinguishing between parts of a site without distinguishing between users. But once you've done that, you're still left with first parties that can spy on you and use that data in non-advertising ways, or even presumably for direct marketing (if you have some kind of an account). I think it's better to focus on the surveillance. If they can't surveil you, then they can't use surveillance advertising. As you point out, focusing on leaks is irrelevant because I don't really feel better that only Google knows everything about me. Focusing on advertising doesn't stop them collecting data, it just limits how they can use it. If we don't want the data to exist, collecting it should be prohibited.

zwkrt 5y ago

Facebook et al want the privacy discussion to revolve around “keeping your personal data safe” but that is just bald-faced propaganda that covers up the fundamental issue. It’s not like Facebook’s digital model of my behavior is really “mine” and they are just borrowing it or protecting it. They don’t even care about my data in the singular. What they do have is a giant corpus of behavioral data spanning everyone on the planet. Companies can (statistically) detect that you are going to get a divorce, or that you are going to be pregnant. They know everyone who has been to jail, our sexual fantasies, how likely it is that our children will go to college. Right now we say they sell ads, but you could just as correctly say that they take advantage of this incredible, unprecedented information advantage to directly change the world in their favor and in the favor of whoever can pay. It used to be used to sell clothing and frippery, but already SM is plastered with ads for political campaigns and brain-altering drugs. Their cultural hegemony will only increase over time, as the data gets better and the methods become more effective. In this regime, what does it even mean for Facebook to “leak my data”? If anything I’d rather it was out in the open. (Although I’d much rather it didn’t exist!)

pasabagi 5y ago
I generally think along your lines, but I think there is an actually a fundamental question here: do we care about privacy? My feeling is that surveillance states are more or less the norm, and it tends to become controversial as a sort of stand-in for other issues. So, for instance, the DDR's extreme surveillance apparatus becomes a sort of explanation for why this relatively bland state was actually a historic example of evil. In england, there's a (very mild) controversy about the use of secret police to surveil activists - it became controversial because several of them had sexual relationships, and even children, while in their undercover role. One of the curious features of all this was who merited attention. One group of vegan restaurant connoisseurs, who met on fridays to review welsh vegan diners, discovered that one of their members was a police officer, for example. This surveillance, which really had no bounds, including the surveillance of sitting government ministers (always labour, fwiw), is actually very typical, historically speaking. So, while I'm broadly in agreement with you when it comes to the dangers of surveillance, I think we've all had and lost this argument in the past, and the fact is, if the state historically wanted to destroy or persecute a specific group, paper records were always enough. That means that if you want to make meaningful progress in the face of this information asymmetry, you have to find wedge issues.