11 ms·

A data ‘black hole’: Europol ordered to delete vast store of personal data

scrollaway 5y ago
4 petabytes eh. Bonus points for the first article in several years to use CD-ROMs as a unit of comparison. > "drawn from crime reports, hacked from encrypted phone services and sampled from asylum seekers never involved in any crime"
- newsbinator 5y ago
  Never underestimate the bandwidth of a station wagon full of floppy disks https://what-if.xkcd.com/31/ https://what-if.xkcd.com/31/
  - tejtm 5y ago
    "tapes". You may be new, but you got the gist of it. "Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway." --Andrew Tannenbaum
    - Brian_K_White 5y ago
      And the essence is still true today. If you want to recover a lot of data from a backup service, they mail you a drive.
- 8bitsrule 5y ago
  >4 petabytes – equivalent to 3m CD-Roms... Where are they getting these 1333MB CD-ROMs? Also: that article's overloaded first sentence is NOT going to win any Pulitzers. And what kind of news article has an average sentence length of 29 words?
  - divbzero 5y ago
    Must be those double-sided CD-ROMs?
    - anticensor 5y ago
      I think a double-sided CD-ROM would be too thick for most CD readers to rotate at the correct speed.
  - azalemeth 5y ago
    > And what kind of news article has an average sentence length of 29 words The Guardian usually has excellent writing -- and I for one don't mind reading long sentences. If anything, it's refreshing.
    - Terry_Roll 5y ago
      A sentence can be any length, there is no rule defining the maximum number of words that can be used to convey the point, however some experts use a sentence's word count to quantify elements of an authors intelligence, put simply its one way you can spot AI bots operating on social media.
    - dzhiurgis 5y ago
      - mhh__ 5y ago
        No it hasn't. I've been reading the guardian physically for years, it's still good. How many is a few anyway? They only broke the Panama papers 6 years ago now
        guiriduro 5y ago
        Maybe time to revisit your assumptions. I'd grant the Guardian was still fairly decent under Rubsbridger, but under Viner its quality has dropped precipitously. Full 180 on Assange, dereliction of their previous general support for international and UK leftwing issues. Nowadays they are a joke, washy liberalism and snapping at the coat-tails of US democrat readers (if any). A taint which also loses readers and undermines the authority of their (better) climate writers, which is a shame.
- rossmohax 5y ago
  Who counts in CD-ROMs in 2022?
  - delecti 5y ago
    Is there a more recent storage medium with a single size (ish, 650 vs 700 is close enough)? USB drives come in all sizes, and DVD and Blu-Ray come in single and multi-layer. It's also the last time most people interacted with the media for storage, rather than buying pre-pressed copies. I struggle to think of a better measurement unit for a lay person.
    - pbhjpbhj 5y ago
      X hours of HD/2k/4k video?
      - layer8 5y ago
        That’s a bad measure, it depends a lot on the codec and the selected picture quality (and also on the picture content).
        geenew 5y ago
        X [s/m/h] of [jwst/ska/lhc] data?
        pbhjpbhj 5y ago
        It's certainly a bad technical measure, but then stacks of CDROMs could all be super sparsely populated, those human capillaries going around the world are stretchy, etc. I think it's a reasonable metric for huge quantities of data when communicating to the general public - you can specify the movie to narrow it too. So "the LHC produces 90 Petabytes of data per year, that's the same amount of data as streaming Avengers Endgame in 4K high-definition 40 million times! Bet their ISP wishes they hadn't offered them the unlimited data package!!" yadda-yadda?
    - Brian_K_White 5y ago
- divbzero 5y ago
  That made me chuckle too. CD-ROMs as a unit of comparison works only for a specific age group not too old nor too young.
- stjohnswarts 5y ago
  That really doesn't sound like enough data for all of Europe over several years to be honest. They would surely have more than that.
- TheFattestNinja 5y ago
  Up to a handful of years ago police data was still mostly stored in CD's in a first world country like Italy (it was a fun lecture during a Computer Security in class where we had a few sessions with court experts about procedure). It wouldn't surprise me that there are archive rooms lost to memory somewhere in Europol/Interpol full of CD's of data.
  - nix23 5y ago
    >first world country like Italy Are you talking about north or south?
bsedlm 5y ago
How could we be sure they aren't actually trying to cleanse evidence of high-level corruption and other crimes?
- Zababa 5y ago
  Because the police doesn't collect those in the first place /s.
- pgeorgi 5y ago
  Simple: "high-level corruption" isn't part of Europol's mandate (see https://www.europol.europa.eu/about-europol https://www.europol.europa.eu/about-europol), so it's unlikely that they have data on that in the first place.
  - GauntletWizard 5y ago
    I think it's reasonable that "organised forms of crime" (an example of their mandate) could have, as a large side effect, high-level corruption.
  - petre 5y ago
    The EU needs an anti corruption directorate just like the countries they accuse of corruption and delay entry to Schengen. The EPPO and OLAF only deal with fraud with EU funds. Maybe the scope of these institutions should be extended.
    - di4na 5y ago
      That need has been acknowledged, the problem is to get the Council of Europe to accept when some of its members are major fraudsters...
jdougan 5y ago
I wonder what their budget looked like for the data operations? It might actually be seperable if it is only a few years old and doesn't appear to be that black yet.
- kingcharles 5y ago
  It's a shame all those (now) unnecessary hard drives won't make it onto the market, since they'll need to be drilled and dumped.
FridgeSeal 5y ago
Putting aside the data collection for a moment, I really appreciate that the data watchdog (data protection supervisor) for the EU actually has the ability to find this data, has the authority to force the deletion and the policy makers and agencies actually appear to be willing to even entertain discussing where the boundary between privacy and security should lie. It’s refreshing, especially in comparison with how things are done in my country.
- dataflow 5y ago
  Let's see if the deletion actually happens. GDPR didn't seem to have as many teeth as people were initially hoping for.
  - mhitza 5y ago
    I was of the same impression until I've encountered this information last year https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights
    - dataflow 5y ago
      I'm not sure fines really tell the story here. Have big companies had a significant change in behavior as a result? Have major actors in any space (say) deleted data they'd gathered without legal basis?
      - mattashii 5y ago
        At least they must now put effort into their reasons for collecting data, and share this data with the subject; which was previously impossible or unfeasable. In that regard there have been significant changes.
        dataflow 5y ago
        Sure, I'm not claiming GDPR has been useless. Just that if GDPR is any indication, this data won't get deleted.
kingcharles 5y ago
I was recently informed that I have a Europol entry. The British Embassy said they were forced to make an entry since I had been accused of a crime in the USA, although the charge never came to trial.
anfogoat 5y ago
> The commission says the legal concerns raised by the EDPS raise “a serious challenge” for Europol’s ability to fulfil its duties. Last year, it proposed sweeping changes to the regulation underpinning Europol’s powers. If made law, the proposals could in effect retrospectively legalise the data cache and preserve its contents as a testing ground for new AI and machine learning tools. > ... > The tussle that followed is captured in a series of internal documents obtained under freedom of information laws. They show Europol stalling for time and the watchdog telling them that they have failed to resolve “the legal breach”. The police agency appears to be holding out for new EU legislation to provide retrospective cover for what it has been doing without a legal basis for six years. > The European Commission’s nervousness over a public clash was enough to pull Monique Pariat, the EU’s director general for home affairs, into a meeting between the two agencies in December 2021. Sources said the watchdog had been encouraged to “tone down” its public criticism of Europol. Typical. Any talk of privacy in EU circles is mere marketing speak, void of everything. Europol won't be deleting anything and the Commission has their back on it. It's just amazing. Anytime I read something about the Commission and compare what I've just read with the priorities they themselves have announced, it becomes clear their stated priorities are complete fiction, something someone wrote just to fill a page. You can throw in a new set of stooges every now and then but I guess a rotten institution just stays rotten.
- deleted 5y ago
  [deleted]
- kiliancs 5y ago
  > Typical. Any talk of privacy in EU circles is mere marketing speak, void of everything. I have observed this with many other areas, not just privacy. Very sad to see this in contrast with what the EU could be.
  - coldtea 5y ago
    A union the nation states people actually asked for, instead of having it be imposed unto them?
thisisnotatest1 5y ago
A self-appointed police organization pretends they need to harvest 4 petabytes of citizen data to "fight terrorism". Not legitimized by any constitution, no defined responsibilities, these Brussels organizations (sorry, the Hague!) appoint each other and assign themselves budget, and the bureaucracy grows every day.
- mattkevan 5y ago
  Calm down, Nigel.
  - coldtea 5y ago
    Thank you for your intellectual contribution to this discussion
- KarlKemp 5y ago
  When they are "appointing each other" they are, by definition, not self-appointed. And Europol doesn't appoint anyone, nor does is assign any budgets outside its own purview. So I'm at a loss at what you're actually trying to say.
  - thisisnotatest1 5y ago
pdimitar 5y ago
Take a wild guess: how many backups these mere 4000 TB already have all across the EU? I'd say at least 8, maybe 20. Even if Europol miraculously agrees to delete one ZFS data pool, the other N-1 remain. So yeah, it's a PR theater. Pretty sure that the moment they found out what EDPS knows, a few sysadmins were ordered not to sleep until a big redundancy ratio has been achieved. But it's still VERY impressive that a discussion about the tradeoffs between privacy and security is possible. That's a huge plus (if the discussion comes to being in the first place but still).
- mqus 5y ago
  Why do you think a legal order will only target a single copy, obviously all related data have to be deleted. Anything else would not make any sense. If Europol only deletes "one data pool" then it could just as well say that it will not abide.
  - pdimitar 5y ago
    What I mean is: why should we believe them if they say "OK we deleted all copies"? How do we even validate that? I'm very cynical towards intelligence agencies. They will not let go of what they perceive as valuable intel. Would love to be proven wrong but I don't see how. They can claim anything and everything and do something else where nobody is looking.
olliej 5y ago
I hate the perpetual law enforcement “needs this to protect you”. Seriously, if you have sufficient evidence to believe someone is a threat you should have sufficient information to get a warrant for the information you want. Any other system is by definition warrant less surveillance, and therefore any data collection is a-ok because anyone “might” be a threat. That’s why we made warrants required. It’s why needing warrants is literally part of the constitution. Grumble grumble. Old man shouts at law enforcement.
- nathanaldensr 5y ago
  Don't self-deprecate your very rational perspective with that last paragraph. You are spot on, and you don't have to be an old man grumbling at cops to think the way you do.
- tempodox 5y ago
  You're hitting the nail on the head. It's circular arguments all the way down. How do we know how many criminals there are without making everyone a full-time suspect and surveil them 24/7? in dubio pro reo is out of the window. Now we all have to prove that we're not part of <insert-criminal-activity>.
aborsy 5y ago
Could the ordering agency order the data of EU citizens, unlawfully collected, be removed from all sources, notably from the NSA ZB data lakes? Everyone agrees that such data exists!
- atty 5y ago
  What’s unlawful for the NSA to collect is defined by US law, not EU law. I’m sure they could ask the US nicely, and the NSA may even pretend to listen to their complaints for a little bit :)
  - laurent92 5y ago
    It’s unlawful worldwide to use EU citizen data without GDPR. I don’t know how EU pulled that off, but the work of the NSA is illegal just like Google storing EU citizen’s data in USA without GDPR enforcement is illegal too. Not to say it’s applicable. In fact, you could break the US law from abroad. Ask Assange.
    - mellavora 5y ago
      I wonder if this could be used to get US credit agencies to stop storing data. Many people with EU citizenship end up with data in US credit agency files.
    - krageon 5y ago
      The GDPR does not apply to law enforcement
      - Jon_Lowtek 5y ago
        There is another regulation called "2016/680" or "the police directive" that does: https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng
    - ClumsyPilot 5y ago
      Israel issued fines to New Zealand women for talking about Israel, and having never been in israel. https://www.theguardian.com/music/2018/oct/12/israel-fines-new-zealand-teenagers-18000-for-urging-lorde-concert-boycott https://www.theguardian.com/music/2018/oct/12/israel-fines-n...
daniel-cussen 5y ago
My strategy is generating TBs of noise so that it's expensive to store it all.
- brigandish 5y ago
  The same people who support this agency also set taxes.
- geenew 5y ago
  You can imagine generating an encrypted file 10^3 or 10^6 times larger than the data to be encrypted, with a pointer at the beginning giving the location of the start of the payload. The rest of the file could be encrypted randomness. Transfer would be super slow but presumably the extreme file length would hinder decryption of the payload. Of course the whole scheme would break down if the adversary knew the length/position of the pointer data. Security through size?
  - doomrobo 5y ago
    You can do some really cool cryptography if you assume your adversary has limited space. Examples include non-transferable signatures and streaming programs that stop functioning when the stream stops (repugnant as a DRM but neat as a concept) https://eprint.iacr.org/2021/406 https://eprint.iacr.org/2021/406
IAmEveryone 5y ago
This thread is a shitshow of cynicism, everyone outdoing the others to come up with even more convoluted conspiracy stories how this isn't going to help or why it must be motivated by the data protection agency apparently being criminals themselves trying to erase evidence against them. It's quite a sad state of affairs, really. Another conclusion one could draw from the story as reported is that, contrary to an untold number of assertions I've seen made on HN, GDPR does apply to governments and their institutions. It's a point made in just about every single other thread on the law, and one would expect someone noticing they were wrong, which would seem to be perfect basis for a useful comment. Alas, they all missed this story. I'm sure they'll be back. A close cousin is, of course, the sense that such institutions will choose to ignore the law, as in any law, anyway, and without any risk of blowback or even chance of becoming a matter of public interest. The story itself would seem to contradict that notion to a certain degree, but that doesn't seem to diminish the opportunity of updating one's belief system with even more evidence supporting everything one has always known to be true.
- raxxorrax 5y ago
  It does formally apply do government institutions, but they have exemptions that their security neurosis will be as satisfied as if it would not apply. The need for data collection is not even questioned and blindly accepted. That warrants a lot of criticism. What is surveillance if not an expression of cynicism?
- anfogoat 5y ago
  > This thread is a shitshow of cynicism, everyone outdoing the others to come up with even more convoluted conspiracy stories how this isn't going to help or why it must be motivated by the data protection agency apparently being criminals themselves trying to erase evidence against them. It's quite a sad state of affairs, really. It's sad that the EDPS would get dragged for this, we should be encouraging them. Other than that, if you have a thirst for privacy from government and lack dementia, there really is no such thing as too much cynicism. > Another conclusion one could draw from the story as reported is that, contrary to an untold number of assertions I've seen made on HN, GDPR does apply to governments and their institutions. It's a point made in just about every single other thread on the law, and one would expect someone noticing they were wrong, which would seem to be perfect basis for a useful comment. Alas, they all missed this story. I'm sure they'll be back. Law enforcement are all but exempt from the GDPR, which has nothing to do with this. I'm not 100% sure but I think they're referring to the Europol regulation[0]. > A close cousin is, of course, the sense that such institutions will choose to ignore the law, as in any law, anyway, and without any risk of blowback or even chance of becoming a matter of public interest. The story itself would seem to contradict that notion to a certain degree, but that doesn't seem to diminish the opportunity of updating one's belief system with even more evidence supporting everything one has always known to be true. We've just learned that an EU wide law enforcement agency is ignoring the law governing them, are backchanneling with the Commission to get a new law on the books to whitewash the whole thing, and that the Commission is game. And there is nothing about this in any major newspaper in the member state I'm residing in. Do I have the facts wrong? Because it seems nuts to suggest this would be a good time for people suspicious of law enforcement and the EU to take a moment to reflect. [0]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0794 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...
sebow 5y ago
Yeah right, let's not hold our breaths thinking Europol will actually delete that data.Especially during covid [Pun not intended on a first thought, but at a second one: covid is the main scapegoat and excuse for extending the surveillance state through legal entities[i.e national ones], "semi-legal" ones like Europol, and legal(because we haven't fixed this yet) but indirect through governments buying data from companies.Much like 9/11 or even cracking down on terrorism in Europe post ~2015]. Also 4 petabytes is kind of nothing,granted you can do a lot with little to nothing when it comes to intelligence, we don't need corporation-sized exabyte oceans.
ngcc_hk 5y ago
Understand the privacy need. But could that also meant the history will have a black hole as well. One of the major issue of the History is full of kings and queens but not US the ordinary folks. How to balance that ?
xtat 5y ago
Honestly, what are the odds someone doesn't make a covert copy "just in case"

4 petabytes eh. Bonus points for the first article in several years to use CD-ROMs as a unit of comparison. > "drawn from crime reports, hacked from encrypted phone services and sampled from asylum seekers never involved in any crime"

newsbinator 5y ago
Never underestimate the bandwidth of a station wagon full of floppy disks https://what-if.xkcd.com/31/ https://what-if.xkcd.com/31/
- tejtm 5y ago
  "tapes". You may be new, but you got the gist of it. "Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway." --Andrew Tannenbaum
  - Brian_K_White 5y ago
    And the essence is still true today. If you want to recover a lot of data from a backup service, they mail you a drive.
8bitsrule 5y ago
>4 petabytes – equivalent to 3m CD-Roms... Where are they getting these 1333MB CD-ROMs? Also: that article's overloaded first sentence is NOT going to win any Pulitzers. And what kind of news article has an average sentence length of 29 words?
- divbzero 5y ago
  Must be those double-sided CD-ROMs?
  - anticensor 5y ago
    I think a double-sided CD-ROM would be too thick for most CD readers to rotate at the correct speed.
- azalemeth 5y ago
  > And what kind of news article has an average sentence length of 29 words The Guardian usually has excellent writing -- and I for one don't mind reading long sentences. If anything, it's refreshing.
  - Terry_Roll 5y ago
    A sentence can be any length, there is no rule defining the maximum number of words that can be used to convey the point, however some experts use a sentence's word count to quantify elements of an authors intelligence, put simply its one way you can spot AI bots operating on social media.
  - dzhiurgis 5y ago
    - mhh__ 5y ago
      No it hasn't. I've been reading the guardian physically for years, it's still good. How many is a few anyway? They only broke the Panama papers 6 years ago now
      - guiriduro 5y ago
        Maybe time to revisit your assumptions. I'd grant the Guardian was still fairly decent under Rubsbridger, but under Viner its quality has dropped precipitously. Full 180 on Assange, dereliction of their previous general support for international and UK leftwing issues. Nowadays they are a joke, washy liberalism and snapping at the coat-tails of US democrat readers (if any). A taint which also loses readers and undermines the authority of their (better) climate writers, which is a shame.
rossmohax 5y ago
Who counts in CD-ROMs in 2022?
- delecti 5y ago
  Is there a more recent storage medium with a single size (ish, 650 vs 700 is close enough)? USB drives come in all sizes, and DVD and Blu-Ray come in single and multi-layer. It's also the last time most people interacted with the media for storage, rather than buying pre-pressed copies. I struggle to think of a better measurement unit for a lay person.
  - pbhjpbhj 5y ago
    X hours of HD/2k/4k video?
    - layer8 5y ago
      That’s a bad measure, it depends a lot on the codec and the selected picture quality (and also on the picture content).
      - geenew 5y ago
        X [s/m/h] of [jwst/ska/lhc] data?
      - pbhjpbhj 5y ago
        It's certainly a bad technical measure, but then stacks of CDROMs could all be super sparsely populated, those human capillaries going around the world are stretchy, etc. I think it's a reasonable metric for huge quantities of data when communicating to the general public - you can specify the movie to narrow it too. So "the LHC produces 90 Petabytes of data per year, that's the same amount of data as streaming Avengers Endgame in 4K high-definition 40 million times! Bet their ISP wishes they hadn't offered them the unlimited data package!!" yadda-yadda?
  - Brian_K_White 5y ago
divbzero 5y ago
That made me chuckle too. CD-ROMs as a unit of comparison works only for a specific age group not too old nor too young.
stjohnswarts 5y ago
That really doesn't sound like enough data for all of Europe over several years to be honest. They would surely have more than that.
TheFattestNinja 5y ago
Up to a handful of years ago police data was still mostly stored in CD's in a first world country like Italy (it was a fun lecture during a Computer Security in class where we had a few sessions with court experts about procedure). It wouldn't surprise me that there are archive rooms lost to memory somewhere in Europol/Interpol full of CD's of data.
- nix23 5y ago
  >first world country like Italy Are you talking about north or south?

bsedlm 5y ago

How could we be sure they aren't actually trying to cleanse evidence of high-level corruption and other crimes?

Zababa 5y ago
Because the police doesn't collect those in the first place /s.
pgeorgi 5y ago
Simple: "high-level corruption" isn't part of Europol's mandate (see https://www.europol.europa.eu/about-europol https://www.europol.europa.eu/about-europol), so it's unlikely that they have data on that in the first place.
- GauntletWizard 5y ago
  I think it's reasonable that "organised forms of crime" (an example of their mandate) could have, as a large side effect, high-level corruption.
- petre 5y ago
  The EU needs an anti corruption directorate just like the countries they accuse of corruption and delay entry to Schengen. The EPPO and OLAF only deal with fraud with EU funds. Maybe the scope of these institutions should be extended.
  - di4na 5y ago
    That need has been acknowledged, the problem is to get the Council of Europe to accept when some of its members are major fraudsters...

jdougan 5y ago

I wonder what their budget looked like for the data operations? It might actually be seperable if it is only a few years old and doesn't appear to be that black yet.

kingcharles 5y ago
It's a shame all those (now) unnecessary hard drives won't make it onto the market, since they'll need to be drilled and dumped.

FridgeSeal 5y ago

Putting aside the data collection for a moment, I really appreciate that the data watchdog (data protection supervisor) for the EU actually has the ability to find this data, has the authority to force the deletion and the policy makers and agencies actually appear to be willing to even entertain discussing where the boundary between privacy and security should lie. It’s refreshing, especially in comparison with how things are done in my country.

dataflow 5y ago
Let's see if the deletion actually happens. GDPR didn't seem to have as many teeth as people were initially hoping for.
- mhitza 5y ago
  I was of the same impression until I've encountered this information last year https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights
  - dataflow 5y ago
    I'm not sure fines really tell the story here. Have big companies had a significant change in behavior as a result? Have major actors in any space (say) deleted data they'd gathered without legal basis?
    - mattashii 5y ago
      At least they must now put effort into their reasons for collecting data, and share this data with the subject; which was previously impossible or unfeasable. In that regard there have been significant changes.
      - dataflow 5y ago
        Sure, I'm not claiming GDPR has been useless. Just that if GDPR is any indication, this data won't get deleted.

kingcharles 5y ago

I was recently informed that I have a Europol entry. The British Embassy said they were forced to make an entry since I had been accused of a crime in the USA, although the charge never came to trial.

anfogoat 5y ago

> The commission says the legal concerns raised by the EDPS raise “a serious challenge” for Europol’s ability to fulfil its duties. Last year, it proposed sweeping changes to the regulation underpinning Europol’s powers. If made law, the proposals could in effect retrospectively legalise the data cache and preserve its contents as a testing ground for new AI and machine learning tools. > ... > The tussle that followed is captured in a series of internal documents obtained under freedom of information laws. They show Europol stalling for time and the watchdog telling them that they have failed to resolve “the legal breach”. The police agency appears to be holding out for new EU legislation to provide retrospective cover for what it has been doing without a legal basis for six years. > The European Commission’s nervousness over a public clash was enough to pull Monique Pariat, the EU’s director general for home affairs, into a meeting between the two agencies in December 2021. Sources said the watchdog had been encouraged to “tone down” its public criticism of Europol. Typical. Any talk of privacy in EU circles is mere marketing speak, void of everything. Europol won't be deleting anything and the Commission has their back on it. It's just amazing. Anytime I read something about the Commission and compare what I've just read with the priorities they themselves have announced, it becomes clear their stated priorities are complete fiction, something someone wrote just to fill a page. You can throw in a new set of stooges every now and then but I guess a rotten institution just stays rotten.

deleted 5y ago
[deleted]
kiliancs 5y ago
> Typical. Any talk of privacy in EU circles is mere marketing speak, void of everything. I have observed this with many other areas, not just privacy. Very sad to see this in contrast with what the EU could be.
- coldtea 5y ago
  A union the nation states people actually asked for, instead of having it be imposed unto them?

thisisnotatest1 5y ago

A self-appointed police organization pretends they need to harvest 4 petabytes of citizen data to "fight terrorism". Not legitimized by any constitution, no defined responsibilities, these Brussels organizations (sorry, the Hague!) appoint each other and assign themselves budget, and the bureaucracy grows every day.

mattkevan 5y ago
Calm down, Nigel.
- coldtea 5y ago
  Thank you for your intellectual contribution to this discussion
KarlKemp 5y ago
When they are "appointing each other" they are, by definition, not self-appointed. And Europol doesn't appoint anyone, nor does is assign any budgets outside its own purview. So I'm at a loss at what you're actually trying to say.
- thisisnotatest1 5y ago

pdimitar 5y ago

Take a wild guess: how many backups these mere 4000 TB already have all across the EU? I'd say at least 8, maybe 20. Even if Europol miraculously agrees to delete one ZFS data pool, the other N-1 remain. So yeah, it's a PR theater. Pretty sure that the moment they found out what EDPS knows, a few sysadmins were ordered not to sleep until a big redundancy ratio has been achieved. But it's still VERY impressive that a discussion about the tradeoffs between privacy and security is possible. That's a huge plus (if the discussion comes to being in the first place but still).

mqus 5y ago
Why do you think a legal order will only target a single copy, obviously all related data have to be deleted. Anything else would not make any sense. If Europol only deletes "one data pool" then it could just as well say that it will not abide.
- pdimitar 5y ago
  What I mean is: why should we believe them if they say "OK we deleted all copies"? How do we even validate that? I'm very cynical towards intelligence agencies. They will not let go of what they perceive as valuable intel. Would love to be proven wrong but I don't see how. They can claim anything and everything and do something else where nobody is looking.

olliej 5y ago

I hate the perpetual law enforcement “needs this to protect you”. Seriously, if you have sufficient evidence to believe someone is a threat you should have sufficient information to get a warrant for the information you want. Any other system is by definition warrant less surveillance, and therefore any data collection is a-ok because anyone “might” be a threat. That’s why we made warrants required. It’s why needing warrants is literally part of the constitution. Grumble grumble. Old man shouts at law enforcement.

nathanaldensr 5y ago
Don't self-deprecate your very rational perspective with that last paragraph. You are spot on, and you don't have to be an old man grumbling at cops to think the way you do.
tempodox 5y ago
You're hitting the nail on the head. It's circular arguments all the way down. How do we know how many criminals there are without making everyone a full-time suspect and surveil them 24/7? in dubio pro reo is out of the window. Now we all have to prove that we're not part of <insert-criminal-activity>.

aborsy 5y ago

Could the ordering agency order the data of EU citizens, unlawfully collected, be removed from all sources, notably from the NSA ZB data lakes? Everyone agrees that such data exists!

atty 5y ago
What’s unlawful for the NSA to collect is defined by US law, not EU law. I’m sure they could ask the US nicely, and the NSA may even pretend to listen to their complaints for a little bit :)
- laurent92 5y ago
  It’s unlawful worldwide to use EU citizen data without GDPR. I don’t know how EU pulled that off, but the work of the NSA is illegal just like Google storing EU citizen’s data in USA without GDPR enforcement is illegal too. Not to say it’s applicable. In fact, you could break the US law from abroad. Ask Assange.
  - mellavora 5y ago
    I wonder if this could be used to get US credit agencies to stop storing data. Many people with EU citizenship end up with data in US credit agency files.
  - krageon 5y ago
    The GDPR does not apply to law enforcement
    - Jon_Lowtek 5y ago
      There is another regulation called "2016/680" or "the police directive" that does: https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng
  - ClumsyPilot 5y ago
    Israel issued fines to New Zealand women for talking about Israel, and having never been in israel. https://www.theguardian.com/music/2018/oct/12/israel-fines-new-zealand-teenagers-18000-for-urging-lorde-concert-boycott https://www.theguardian.com/music/2018/oct/12/israel-fines-n...

daniel-cussen 5y ago

My strategy is generating TBs of noise so that it's expensive to store it all.

brigandish 5y ago
The same people who support this agency also set taxes.
geenew 5y ago
You can imagine generating an encrypted file 10^3 or 10^6 times larger than the data to be encrypted, with a pointer at the beginning giving the location of the start of the payload. The rest of the file could be encrypted randomness. Transfer would be super slow but presumably the extreme file length would hinder decryption of the payload. Of course the whole scheme would break down if the adversary knew the length/position of the pointer data. Security through size?
- doomrobo 5y ago
  You can do some really cool cryptography if you assume your adversary has limited space. Examples include non-transferable signatures and streaming programs that stop functioning when the stream stops (repugnant as a DRM but neat as a concept) https://eprint.iacr.org/2021/406 https://eprint.iacr.org/2021/406

IAmEveryone 5y ago

This thread is a shitshow of cynicism, everyone outdoing the others to come up with even more convoluted conspiracy stories how this isn't going to help or why it must be motivated by the data protection agency apparently being criminals themselves trying to erase evidence against them. It's quite a sad state of affairs, really. Another conclusion one could draw from the story as reported is that, contrary to an untold number of assertions I've seen made on HN, GDPR does apply to governments and their institutions. It's a point made in just about every single other thread on the law, and one would expect someone noticing they were wrong, which would seem to be perfect basis for a useful comment. Alas, they all missed this story. I'm sure they'll be back. A close cousin is, of course, the sense that such institutions will choose to ignore the law, as in any law, anyway, and without any risk of blowback or even chance of becoming a matter of public interest. The story itself would seem to contradict that notion to a certain degree, but that doesn't seem to diminish the opportunity of updating one's belief system with even more evidence supporting everything one has always known to be true.

raxxorrax 5y ago
It does formally apply do government institutions, but they have exemptions that their security neurosis will be as satisfied as if it would not apply. The need for data collection is not even questioned and blindly accepted. That warrants a lot of criticism. What is surveillance if not an expression of cynicism?
anfogoat 5y ago
> This thread is a shitshow of cynicism, everyone outdoing the others to come up with even more convoluted conspiracy stories how this isn't going to help or why it must be motivated by the data protection agency apparently being criminals themselves trying to erase evidence against them. It's quite a sad state of affairs, really. It's sad that the EDPS would get dragged for this, we should be encouraging them. Other than that, if you have a thirst for privacy from government and lack dementia, there really is no such thing as too much cynicism. > Another conclusion one could draw from the story as reported is that, contrary to an untold number of assertions I've seen made on HN, GDPR does apply to governments and their institutions. It's a point made in just about every single other thread on the law, and one would expect someone noticing they were wrong, which would seem to be perfect basis for a useful comment. Alas, they all missed this story. I'm sure they'll be back. Law enforcement are all but exempt from the GDPR, which has nothing to do with this. I'm not 100% sure but I think they're referring to the Europol regulation[0]. > A close cousin is, of course, the sense that such institutions will choose to ignore the law, as in any law, anyway, and without any risk of blowback or even chance of becoming a matter of public interest. The story itself would seem to contradict that notion to a certain degree, but that doesn't seem to diminish the opportunity of updating one's belief system with even more evidence supporting everything one has always known to be true. We've just learned that an EU wide law enforcement agency is ignoring the law governing them, are backchanneling with the Commission to get a new law on the books to whitewash the whole thing, and that the Commission is game. And there is nothing about this in any major newspaper in the member state I'm residing in. Do I have the facts wrong? Because it seems nuts to suggest this would be a good time for people suspicious of law enforcement and the EU to take a moment to reflect. [0]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0794 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...

sebow 5y ago

Yeah right, let's not hold our breaths thinking Europol will actually delete that data.Especially during covid [Pun not intended on a first thought, but at a second one: covid is the main scapegoat and excuse for extending the surveillance state through legal entities[i.e national ones], "semi-legal" ones like Europol, and legal(because we haven't fixed this yet) but indirect through governments buying data from companies.Much like 9/11 or even cracking down on terrorism in Europe post ~2015]. Also 4 petabytes is kind of nothing,granted you can do a lot with little to nothing when it comes to intelligence, we don't need corporation-sized exabyte oceans.

ngcc_hk 5y ago

Understand the privacy need. But could that also meant the history will have a black hole as well. One of the major issue of the History is full of kings and queens but not US the ordinary folks. How to balance that ?

xtat 5y ago

Honestly, what are the odds someone doesn't make a covert copy "just in case"