9 ms·
US spies are buying Americans’ data – Congress has a new chance to stop it
- hunglee2 3y agoAt least they are buying it, a validation of the freedoms inherent in the US
- Dah00n 3y agoIs that sarcasm?
- mhoad 3y agoThis story is adjacent to some topics I follow fairly closely for various reasons. I had seen a lot of not super well informed commentary on it when it was talked about here previously and so in that spirit I wanted to offer a short 20 minute chat that was aimed at policy makers between a well respected infosec journalist and someone who previously spent a long time working at the Australian equivalent of NSA about this particular topic. I’d like to think it helps provide the outlines of how professionals in and around that field tend to think about it while not getting so caught up in a strictly US perspective. Hopefully some of you find it helpful. https://overcast.fm/+5Sl8Ai8LA https://overcast.fm/+5Sl8Ai8LA
- coldtea 3y agoPerhaps what should stop is the collection from the third parties and ability to sell them altogether?
- mhoad 3y agoThat’s the only obvious and reasonable answer.
- pixl97 3y agoCompanies that collect that data: "Dear Congressperson, here are 100,000 donated reasons to ignore the obvious and reasonable answer"
- mhoad 3y agoThere are actually a bunch of really compelling strategic level national security style reasons to come to the same conclusion, it’s not purely just a consumer rights issue.
- pixl97 3y agoAnd until those other interest ^Hbribe their congress people, or said congress peoples data leaks to the world in a way they are effected on re-election they will be ignored by said people that make our laws.
- vacuity 3y agoFirstly, it'd be nice if those national security reasons were clearly stated without the other bullshit. Secondly, as far as I've heard, there's no real success story for all the dragnet surveillance. If there's a legitimate application that is too broad that a warrant for targeted surveilance doesn't cover it, I'd like to hear it.
- pessimizer 3y agoThink tanks: "Congresspeople, here's some compelling word salad designed by the best. You can memorize and repeat this while pocketing 100,000 donated reasons from one of our funders."
- hospitalJail 3y agoDevils advocate: "So the data isnt owned by the host company, its owned by the support company which is a child of the parent company. We are selling that child company to Amazon/FB/Google." Google didn't buy nest because they were IOT fans.
- phpisthebest 3y ago1. Data about me should be owned by me, not the entity that collects it. 2. Disseminating false info about a person should trigger a statutory defamation liability akin to statutory copy right infringement, where the person does not have to prove damages then expand the Credit Reporting laws to include all Information and force them to tell you who all they have sold or given that info to. #2 would do the most, if we reform defamation to make it where if a credit reporting agency, or Google gets something wrong and tells someone else that wrong thing they are liable you would see a massive curbing of private information collection, and even more of it being up for sale.
- theptip 3y agoGDPR solves these problems. As a startup it was annoying implementing all the subprocessor paperwork, but as a consumer / citizen I want those rights. In your case above, I’m not actually sure how data ownership works on sale of a company, but you can always have the company delete all your data if you don’t want it changing hands. In other words, you should always own your data, and companies should never be able to do something with it that you do t consent to.
- hospitalJail 3y agoIs GPDR the thing you click accept all at the start?
- theptip 3y agoThat’s ePD: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- exabrial 3y agoI have a better idea: instead stopping the purchase, how about we stop the collection?
- deleted 3y ago[deleted]
- mindslight 3y agoThis is still missing the 800,000 pound gorilla in the room. There's little point to preventing the de jure government from using commercial surveillance data, when corporations are all too happy to create an unregulated de facto government to stand in its place - eg credit bureaus, retail equation, unilateral account closures, etc. The US desperately needs a port of the EU's GDPR, critically including its exact definitions of consent, personal information, and the right to deletion.
- parineum 3y agoI don't want GDPR. I want two things. No sale of personal (even unidentifiable) data without consent coupled with no punishment for not consenting and a requirement of explicit affirmative consent. Deletion of data upon request. As a bonus third, retrieval of data on request. I want those in that priority. I'd be pretty happy with just the first one.
- lockhouse 3y agoThe problem is that we'll have to consent to allowing the sale of our data just to use a service. From what I've seen a statement to that effect is already in the click through license fine print.
- mindslight 3y agoI don't see your reason for downplaying the GDPR. That plus saying you're willing to forgo your second/third ask (deletion is paramount!) just feels like trying to bargain with the surveillance-industrial complex for something it'll accept. But most anything in that direction is just creating loopholes for the surveillance industry to nullify the intent of such law. Your simple regulations sound great for the cases they address, but there are a lot of corner cases that the GDPR addressed that your "simple" requirements do not. For example, what happens when a surveillance company uses a third party data processor outside the jurisdiction? That is not a sale, and yet the processor can proceed to do whatever they want. Or when a company insists that it has obtained indefinite "consent" by some claimed assent to a contract of adhesion, or as part of a contract with a third party? The surveillance industry would love nothing more than to pass fig-leaf regulation that purports to create rights but actually just enshrines their regime into law while giving them further protections. That's precisely what they managed to do with the "Fair" Credit Reporting Act, which is why that segment of the surveillance industry has continued to spiral out of control, pushing nonsense like "identity theft" onto us.
- thisisthenewme 3y agoSo on the side of wanting easy access to American data - - People in the gov who want to monitor the general populace for dissent - Power hungry individuals and governments - Governments wanting to learn about their foreign adversaries/allies - People in the gov who want to monitor other gov agents for whatever reason - Corporations wanting to learn about their adversaries - Corporations wanting to maximize their profits - Corporations wanting to learn about their users for whatever reasons - And so on and on. On the side of limiting access to user data - - People wanting privacy Don't want to sound too pessimistic but I can't help it.
- allenrb 3y agoThis feels like a correct summary of the situation. I wish it were not so, but that genie is so far out of the bottle, she’d need GPS to find her way back in.
- mhoad 3y agoIt’s correct in the same way Joe Rogan talking about anything other than MMA or comedy feels correct to some people. It’s great at feeling like you’ve said something clever but also makes it clear you haven’t actually thought about the topic for more than five minutes and you just said the first thing that came to mind and missed a bunch of important points in the process.
- badosu 3y agoI understand the point, but it feels disingenuous to have it directed at someone who makes a living out of inviting guests and making interesting talk out of it. I don't think he ever claimed to be an expert at the stuff he talks about and that we're free to talk about stuff we don't know everything about.
- deleted 3y ago[deleted]
- 3y ago
- analog31 3y agoI propose a system of statutory damages for offering to sell personal information, similar to those imposed for sharing copyrighted music recordings. This might create an industry of bounty hunters who track down violators, for a percentage of the damages.
- RcouF1uZ4gsC 3y agoI think US intelligence should have access to any data that is already out there for purchase. If you have an issue with that, then regulate the sale of data. Otherwise, this is all just PR, due to agreements such as Five Eyes where for example British intelligence buys American data and shares with CIA, etc.
- Dah00n 3y agoNo need for five eyes. 1) Three letter agency cannot collect X 2) Big Business Inc. can and sells it 3) Three letter agency can buy commercial information With your logic the government will have access to everything because these laws are written to be circumvented, by the right people, just like tax laws. Stop Give eyes instead, simple, but impossible.
- lcnPylGDnU4H9OF 3y agoWhy is 1 not violated by 3 in this context?
- vacuity 3y agoPresumably, the three letter agency can't actively perform surveillance but the data bought from companies wasn't illegally collected, so it's fine.
- lcnPylGDnU4H9OF 3y ago> wasn't illegally collected I understand this technicality; it doesn’t seem to answer my question, though I may have presented it poorly. If it’s ostensibly “wrong” (as some proxy) to collect something, it doesn’t matter how it was acquired given there’s still some intact collection.
- vacuity 3y agoIf the rules are ironclad (in an ideal world) then you're right about 3 violating 1. In the current world, don't count on it.
- kelnos 3y agoApparently this isn't the first go-around for this; Davidson and Jacobs proposed something much weaker last year[0], though I can't tell if it made it to the final bill. Their amendment last year merely required law enforcement to disclose when they purchase user data from a third party, and only applied to the feds, not to state and local law enforcement. It's a little hard to believe that Congress is in a better position to pass privacy-related legislation (regardless of what bill it's attached to) this year than it was last year. But I'd love to be proven wrong! It seems even Breitbart is reporting on this year's proposed amendment in a more-or-less positive way. That's... something. [0] https://www.eff.org/deeplinks/2022/07/department-defense-should-disclose-when-it-purchases-user-data https://www.eff.org/deeplinks/2022/07/department-defense-sho...
- neilv 3y agoPresumably non-US spies are also spying on US people using US companies. (Not necessarily the same companies.) As harmful as the OPM hack presumably was for US national security, countless US companies have been collectively assembling comparable-and-more intimate profiles of everyone, and an ongoing basis. Want to map out social networks (in the original sense of the term)? Know who to focus on and target? Know what an individual's weaknesses are, for neutralizing, compromising, or more subtly manipulating? Automate personalized mass influence operations? Good news to adversaries: half of the national technology infrastructure is built upon trying to construct that existential vulnerability, and sell it. (Just trying to frame a pervasive industry/societal problem in a different way, in case that helps to understand it better.)
- hospitalJail 3y agoMy approach is to acknowledge that all of my data is compromised. Sometimes I obfuscate it with nonsense to throw off a trail, but even that I consider is probably worthless. Maybe you could legislate this, but you wonder how a trillion dollar industry is going to lay down and take it. Most likely they will lobby, find loopholes, or do it anyway, accepting the fine as the cost of doing business. I know this is defeatist, but I just don't see bandaids working.
- Animats 3y agoCongress could require that certain personally identifiable data could not be kept in computers. Congress has done this for gun registrations. BATF's out of business records repository for gun registrations is all paper and microfilm. When they receive data in digital form, they print it and microfilm it, to increase lookup time. Really.[1] [1] https://www.npr.org/2013/05/20/185530763/the-low-tech-way-guns-get-traced https://www.npr.org/2013/05/20/185530763/the-low-tech-way-gu...
- mattmaroon 3y agoSeems the problem is less that the US is buying it (our adversaries surely are too) and more that it’s for sale in the first place.
- genmud 3y agoI mean, most of the mobile carriers and a number of ISPs straight up monitor your web traffic and sell it to advertisers, just as bad. Some will even inject headers that you can use to track and associate mobile devices with desktops.
- mattmaroon 3y agoYeah. I’m a lot more upset that the data is for sale in the first place. I want our government to have any helpful data that is public because I assume bad actors have it also. I just don’t want a lot of data to the public.
- mattmaroon 3y agoAlso I really hate when the media refers to the DNI as the “top spy”. It’s silly, sensationalist clickbait. They do a whole lot more than just spying, including this. Buying publicly available data is hardly spying!
- Gunax 3y agoForget about whether spies are buying it for a second. This data is out there. The real problem I see is that: - The data exists - The people involved may not have consented, or they consented when they agreed to a a EULA without really understanding it. In general, it's not illegal to record in public. The only thing that's changed is that it's feasible to use facial recognition, license plate readers, etc. Whereas before, it would have technically possible but practically infeasible.
- worik 3y agoWhy is this data even available? Governments using it is wrong. But in the context of"democrcies" it is private corporations that is terrifying. "Credit checks" are bad enough, and cause many problems in that if your credit record is unorthodox- say you use cash as much as possible- you can get excluded from many financial services when you need them. With all this extra data available there is more chance to discriminate against anybody "other". Forcing everybody to be the same is the hallmark of fascism. Another generation defeated state fascism, at a huge cost. We owe it to them, and even more to our children , to fight creeping corporate fascism. Why is this data even available?
- harry8 3y ago>Why is this data even available? Why is it legal to collect any of it, at all, ever? Why is their zero liability associated with collecting it?
- harry8 3y agoIn a separate but related news item, how many "former" CIA, FBI & NSA operatives are now employed at Twitter, Google & Facebook? Check it out, it's /nuts/.
- genmud 3y agoGet this... there are former military people in those organizations too. What kind of things are they trying to hide from us? This goes deep.
- harry8 3y agoIt's not "there are" it's "how many" How many before you start to get uncomfortable? Nominate your number. Then look. edit for obvious explanation: The military links would be of more concern if these co.s were involved in military ops. They're involved in surveillance of users and data gathering. Spies and law enforcement are of particular interest. "Former cia" is widely regarded as not a thing, you can believe that or not but that very wide belief cannot be ignored when looking that just how many have found a love of silicone valley.
- genmud 3y agoYou read too many spy novels my dude. There are lots of former LE and intel people in any company that deals with analysis of massive amounts of data, because that is specifically what some of these skillsets are trained for. Leaving the IC absolutely is a thing and I can tell you without a doubt that giving up your FAANG job which pays 5-10x what an equivalent government job to break company policy is not something that most of those folks are willing to do. Ironically I find those ex-LE folks to be more protective of the data, because if they ever went back into government or needed a clearance, those questions are not only asked, but if someone has violated the trust of their employer, it's very frowned upon.
- sillywalk 3y agoLets start the bidding at ...
- shoknawe 3y agoDon't worry, they won't stop it.