3 ms·

> While the Shanghai government and police department have largely been silent over the leak, Someone/some team in the police department is probably in serious

by nirui 4y ago

> While the Shanghai government and police department have largely been silent over the leak, Someone/some team in the police department is probably in serious panic right now. Not only because the data is leaked, but also because the leak has displayed an example of what they are actually recording. For example, according to the posts that other people has posted online (probably rumor and speculations), the `address_merge_with_mobile_data.json` file is a collection of external data submitted to the police database. In the file, there are data source types such as: - shga_dwd.base_shangyun_lhrytbxx_df - shga_dwd.base_wahlw_base_teladsllibrarytab_df - shga_wa.ods_nb_tab_goods - shga_wa.ods_nb_app_icpoof_expressdelivery - shga_wa.ods_nb_app_icpoof_delivery - shga_wa.ods_nb_app_icpoof_expressdelivery - shga_wa.ods_nb_app_icpoof_foodorder That's a lot of data that are not directly related to census, social safety, or law enforcement. I guess if you're ordering food online in China, probably need to give yourself a nice nickname first instead of just using your real name then.

duxup 4y ago
> That's a lot of data that are not directly related to census, social safety, or law enforcement. Is that a … concept in China? That the police should only have data “ directly related to census, social safety, or law enforcement”? I wonder how strange or surprising to locals this might be or maybe not be?
- nirui 4y ago
  I don't think Chinese people actually cares, most people don't even know what "Data" actually is, let alone how "Data" effects them. The altitude of most people here (I'm a Chinese BTW) is "I did nothing wrong, so why should I care?". But, it's one thing to hear the humor, it's another thing when you can actually see it. People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database.
  - challenger-derp 4y ago
    >People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database. Had a good chuckle. But then it got me thinking about other situations in which government-leak-induced friction that might lead to cause for legal action. The government demands and collates data presumably supported by legal under-pinnings that citizens must comply with. When these are leaked, shouldn't the government bear legal, fiduciary, etc. responsibility? With great data, comes great responsibility, no?
    - nirui 4y ago
      According to the Network Security/Safety (it's the same word in Chinese) Law, the network operator is responsible to ensure the security of their system, which includes 1) setting up security and auditing rules, 2) prevent virus, hacking and other attacks, 3) monitor and record the status of the network and perform backups etc. The law has also stated that if an institution violated the law, and civil damages is generated as result, the institution is also responsible for the damage. There is another law which might also apply to this case, it's called Data Security/Safety Law. This law also stated that the institution is responsible for civil damages if the institution has violated the law. But, I'm not a lawyer and certainly not a Chinese lawyer. This situation is fairly complex already, it's hard for me to tell which direction this case would go. I guess they'll investigate it first, but the company/team which worked on the project has probably already read the laws before, thus I assume they're well-prepared for this. Another twist is the programmer who accidentally published the secret database API key to the public network, this needs to be investigated as well to determine whether or not the key has actually been used in the attack. So I guess in the meantime, the husbands must wait.

by nirui 4y ago

duxup 4y ago

> That's a lot of data that are not directly related to census, social safety, or law enforcement. Is that a … concept in China? That the police should only have data “ directly related to census, social safety, or law enforcement”? I wonder how strange or surprising to locals this might be or maybe not be?

nirui 4y ago
I don't think Chinese people actually cares, most people don't even know what "Data" actually is, let alone how "Data" effects them. The altitude of most people here (I'm a Chinese BTW) is "I did nothing wrong, so why should I care?". But, it's one thing to hear the humor, it's another thing when you can actually see it. People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database.
- challenger-derp 4y ago
  >People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database. Had a good chuckle. But then it got me thinking about other situations in which government-leak-induced friction that might lead to cause for legal action. The government demands and collates data presumably supported by legal under-pinnings that citizens must comply with. When these are leaked, shouldn't the government bear legal, fiduciary, etc. responsibility? With great data, comes great responsibility, no?
  - nirui 4y ago
    According to the Network Security/Safety (it's the same word in Chinese) Law, the network operator is responsible to ensure the security of their system, which includes 1) setting up security and auditing rules, 2) prevent virus, hacking and other attacks, 3) monitor and record the status of the network and perform backups etc. The law has also stated that if an institution violated the law, and civil damages is generated as result, the institution is also responsible for the damage. There is another law which might also apply to this case, it's called Data Security/Safety Law. This law also stated that the institution is responsible for civil damages if the institution has violated the law. But, I'm not a lawyer and certainly not a Chinese lawyer. This situation is fairly complex already, it's hard for me to tell which direction this case would go. I guess they'll investigate it first, but the company/team which worked on the project has probably already read the laws before, thus I assume they're well-prepared for this. Another twist is the programmer who accidentally published the secret database API key to the public network, this needs to be investigated as well to determine whether or not the key has actually been used in the attack. So I guess in the meantime, the husbands must wait.