5 ms·

I’m wondering: is there a good list of data privacy failure consequences? There are good lists of breaches but few describing what happened to the people after

by baxtr 3y ago

I’m wondering: is there a good list of data privacy failure consequences? There are good lists of breaches but few describing what happened to the people afterwards. Credit card theft resulting in a loss being the most obvious one. Such concrete (real) examples would help me to argue with people who say: all this non-sense about data privacy. What would anyone want to do with your data anyways?

Tijdreiziger 3y ago
> Credit card theft resulting in a loss being the most obvious one. This seems more like a security than a privacy issue. The data (credit card info) is not shared intentionally, but is leaked due to a security hole.
- maxbond 3y ago
  There isn't such a tight distinction between security and privacy. Consider the Ashley Madison leak. I don't mean to defend people who violate their SO's trust - that's unconscionable - but clearly this was both a privacy and a security issue, data was stolen and leaked which revealed really intimate information which ruined people's lives.
- dspillett 3y ago
  Credit card issues, and many other forms of fraud, can result from identity theft which is both a security and privacy issue.
kkfx 3y ago
In mere privacy terms? - a women start planning to have a child, her employer know that, she got fired before the conception, legally; - you are someone who know his/shes knows his rights, no jobs for you since you are not easy to exploit; - you have a certain political opinion, not nice toward the present government? You'll got hard career and all possible "issues", just like getting more traffic red lights than someone else, more police checks causing delays and so on. The list is long. The point is: we can't design a society like a factory, we can't plan evolution beyond banal things, so we need noise, variability that nobody can master to ensure nothing can last too much impeding further evolution just because someone manage to grab a certain position of power and do want to end the history to remain there forever in a loop. That's why we need privacy, diversity, and so on.
- baxtr 3y ago
  Thanks. I was looking for real cases. Theory won't convince the nay-sayers
  - ChrisMarshallNY 3y ago
    Well, I know that, not too long ago, employers were asking prospective hires to give them their Facebook and Twitter credentials. I'm talking full login credentials. Other ones asked employees to friend them. I think a lot of HR departments also required employees to friend HR people. I'm pretty sure that's documented. The courts slammed that drawer shut, pretty hard. Something that might hit a little closer to home, here: When I was still looking for work, about four or five years ago, a couple of the companies asked me to tell them my HN ID (I'm not sure if I had joined here, back then). That's one of the reasons that I try to behave well, here. I'm not looking for work, but a lot of y'all are. I try not to propagate fights (although it can be tough), because the person that really gets harmed, is the one attacking me. They are showing their ass, in front of potential employers and teammates, and, even though I might not like them, I don't want to play a part in their not getting a job.
  - antihipocrat 3y ago
    Real cases are everywhere, in front of everyone, every day. For example: Victims of domestic violence or stalking. Victims of personal vendettas or bigotry from figures in authority. Victims of exploitative employers. These victims have done nothing wrong and they need privacy. All kinds of people are randomly distributed throughout all professions and strata of society. Politicians, police, lawyers, doctors, posties, real estate agents, chefs. All have great and terrible human representation. Now think about a person you distrust/dislike the most in your life. Would you want to give them access to everything about you? The type of person that you like least will eventually have access to your information. If you don't protect your privacy now, who will protect you then?
    - ClumsyPilot 3y ago
      > Real cases are everywhere, in front of everyone, every day W He is looming to something that is well written and convincing, something salient. Punchy Your post is not that. it is difficult to express this so wlel that it is irrefutable
pinguin3 3y ago
No list, but here’s a non-US example Torture, rape and imprisonment based on phone data (Belarus 2022)
momirlan 3y ago
ask them to share their email password
- Karunamon 3y ago
  Not a useful argument; anyone making the "nothing to hide" argument is implicitly arguing the trustworthiness (or the low likelihood of a mistake impacting them) of the state/justice system. You and other members of the general public are not part of that. This is also why the snippy "so you don't have (locks on your doors/blinds on your windows/etc.)?" comeback does not work.
  - jaredhallen 3y ago
    Who makes up the state and justice system? Is it not people?
    - Karunamon 3y ago
      "Officer" is indeed a subclass of "Person", but the former includes a StateAuthority mixin that modifies its acceptable and expected behavior in a number of ways that make it unreasonable to blindly substitute one for the other.
  - ClumsyPilot 3y ago
    > "nothing to hide" argument is implicitly arguing the trustworthiness (or the low likelihood of a mistake impacting them) of the state/justice system There is a massive assumption that only justice systen will have access to this data. We know this data is sold to anyone, even criminals.
sacrosancty 3y ago
[dead]
probably_wrong 3y ago
I think location data is the best example. First, you have those who stormed the Capitol and were identified by the NYT based on their phones location [1]. You also have the Substack that used location data to publicly out a priest as gay [2]. You then have the companies selling location data of people who visit abortion clinics [3]. They obtain this location from SDKs that they deploy via apps you may already be using. And if you want to get more dystopian remember that Texas allows citizens to sue anyone for "aiding or abetting a post-heartbeat abortion" [4], meaning that driving your friend Rebeca to a clinic can land you in a lawsuit for at least $10k by people who do this as their day job. Even if you're not sued, remember that companies have been reliably predicting whether you're pregnant for at least 10 years [5] and using it to influence your behavior in their favor. This one may be the one with the "least bad" consequences but, paradoxically, the one that better drives home the point since nothing here is criminal. [1] https://archive.is/r6c7b https://archive.is/r6c7b [2] https://www.vice.com/en/article/pkbxp8/grindr-location-data-priest-weaponization-app https://www.vice.com/en/article/pkbxp8/grindr-location-data-... [3] https://www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood https://www.vice.com/en/article/m7vzjb/location-data-abortio... [4] https://www.cbsnews.com/news/texas-abortion-law-bounty-hunters-citizens/ https://www.cbsnews.com/news/texas-abortion-law-bounty-hunte... [5] https://archive.is/Z4x2f https://archive.is/Z4x2f
Swizec 3y ago
> I’m wondering: is there a good list of data privacy failure consequences? The ultimate example is how 1940’s Germany used 1930’s Germany’s census data. In 1933 it didn’t seem so bad to tick a box with your religious affiliation …
- dredmorbius 3y ago
  The Netherlands as well. Dutch census religious affiliation data were used by the imposed regime 1940--45. Several Dutch officials enacted wholesale destruction of those records as the occupation became obviously imminent, which saved many, though the Jewish population of the Netherlands fell from 154,887 in 1941 to 14,346 in 1947. The point being it's not necessarily your own government you need be worried about. In another variant on this, surveillance records kept by the East German Ministry for State Security (Ministerium für Staatssicherheit, a/k/a the Stasi) and Soviet KGB were acquired by successor governments (unified German and post-Soviet states including Ukraine). See: <https://www.wilsoncenter.org/blog-post/unearthing-soviet-secrets-ukraines-archives https://www.wilsoncenter.org/blog-post/unearthing-soviet-sec...> (I'm trying without success to find a reference to the destruction of Dutch census records, though I'm pretty certain this did actually happen.)
  - endgame 3y ago
    > Dutch census records I'm pretty sure I saw this spelled out years ago in a groups.google.com post, but the amnesiac search engines of today are not yielding it up to me. I did find these articles: https://jacquesmattheij.com/if-you-have-nothing-to-hide/ https://jacquesmattheij.com/if-you-have-nothing-to-hide/ https://medium.com/@hansdezwart/during-world-war-ii-we-did-have-something-to-hide-40689565c550 https://medium.com/@hansdezwart/during-world-war-ii-we-did-h... And one of them references http://web.archive.org/web/20150812120743/https://stadsarchief.amsterdam.nl/presentaties/amsterdamse_schatten/oproer/aanslag_bevolkingsregister/index.nl.html http://web.archive.org/web/20150812120743/https://stadsarchi... (archive link, site is no longer up).
  - MereInterest 3y ago
    There was a dedicated effort by the Dutch resistance to destroy the records of the civil registries. During the occupation, forged documents could be checked against the records in the civil registry. By bombing the civil registry office, the forged papers could no longer be validated against the civil registry, and would pass inspection. [0] https://en.wikipedia.org/wiki/1943_bombing_of_the_Amsterdam_civil_registry_office https://en.wikipedia.org/wiki/1943_bombing_of_the_Amsterdam_...
isanjay 3y ago
Amy Boyer ?

by baxtr 3y ago

Tijdreiziger 3y ago

> Credit card theft resulting in a loss being the most obvious one. This seems more like a security than a privacy issue. The data (credit card info) is not shared intentionally, but is leaked due to a security hole.

maxbond 3y ago
There isn't such a tight distinction between security and privacy. Consider the Ashley Madison leak. I don't mean to defend people who violate their SO's trust - that's unconscionable - but clearly this was both a privacy and a security issue, data was stolen and leaked which revealed really intimate information which ruined people's lives.
dspillett 3y ago
Credit card issues, and many other forms of fraud, can result from identity theft which is both a security and privacy issue.

kkfx 3y ago

In mere privacy terms? - a women start planning to have a child, her employer know that, she got fired before the conception, legally; - you are someone who know his/shes knows his rights, no jobs for you since you are not easy to exploit; - you have a certain political opinion, not nice toward the present government? You'll got hard career and all possible "issues", just like getting more traffic red lights than someone else, more police checks causing delays and so on. The list is long. The point is: we can't design a society like a factory, we can't plan evolution beyond banal things, so we need noise, variability that nobody can master to ensure nothing can last too much impeding further evolution just because someone manage to grab a certain position of power and do want to end the history to remain there forever in a loop. That's why we need privacy, diversity, and so on.

baxtr 3y ago
Thanks. I was looking for real cases. Theory won't convince the nay-sayers
- ChrisMarshallNY 3y ago
  Well, I know that, not too long ago, employers were asking prospective hires to give them their Facebook and Twitter credentials. I'm talking full login credentials. Other ones asked employees to friend them. I think a lot of HR departments also required employees to friend HR people. I'm pretty sure that's documented. The courts slammed that drawer shut, pretty hard. Something that might hit a little closer to home, here: When I was still looking for work, about four or five years ago, a couple of the companies asked me to tell them my HN ID (I'm not sure if I had joined here, back then). That's one of the reasons that I try to behave well, here. I'm not looking for work, but a lot of y'all are. I try not to propagate fights (although it can be tough), because the person that really gets harmed, is the one attacking me. They are showing their ass, in front of potential employers and teammates, and, even though I might not like them, I don't want to play a part in their not getting a job.
- antihipocrat 3y ago
  Real cases are everywhere, in front of everyone, every day. For example: Victims of domestic violence or stalking. Victims of personal vendettas or bigotry from figures in authority. Victims of exploitative employers. These victims have done nothing wrong and they need privacy. All kinds of people are randomly distributed throughout all professions and strata of society. Politicians, police, lawyers, doctors, posties, real estate agents, chefs. All have great and terrible human representation. Now think about a person you distrust/dislike the most in your life. Would you want to give them access to everything about you? The type of person that you like least will eventually have access to your information. If you don't protect your privacy now, who will protect you then?
  - ClumsyPilot 3y ago
    > Real cases are everywhere, in front of everyone, every day W He is looming to something that is well written and convincing, something salient. Punchy Your post is not that. it is difficult to express this so wlel that it is irrefutable

pinguin3 3y ago

No list, but here’s a non-US example Torture, rape and imprisonment based on phone data (Belarus 2022)

momirlan 3y ago

ask them to share their email password

Karunamon 3y ago
Not a useful argument; anyone making the "nothing to hide" argument is implicitly arguing the trustworthiness (or the low likelihood of a mistake impacting them) of the state/justice system. You and other members of the general public are not part of that. This is also why the snippy "so you don't have (locks on your doors/blinds on your windows/etc.)?" comeback does not work.
- jaredhallen 3y ago
  Who makes up the state and justice system? Is it not people?
  - Karunamon 3y ago
    "Officer" is indeed a subclass of "Person", but the former includes a StateAuthority mixin that modifies its acceptable and expected behavior in a number of ways that make it unreasonable to blindly substitute one for the other.
- ClumsyPilot 3y ago
  > "nothing to hide" argument is implicitly arguing the trustworthiness (or the low likelihood of a mistake impacting them) of the state/justice system There is a massive assumption that only justice systen will have access to this data. We know this data is sold to anyone, even criminals.

sacrosancty 3y ago

[dead]

probably_wrong 3y ago

I think location data is the best example. First, you have those who stormed the Capitol and were identified by the NYT based on their phones location [1]. You also have the Substack that used location data to publicly out a priest as gay [2]. You then have the companies selling location data of people who visit abortion clinics [3]. They obtain this location from SDKs that they deploy via apps you may already be using. And if you want to get more dystopian remember that Texas allows citizens to sue anyone for "aiding or abetting a post-heartbeat abortion" [4], meaning that driving your friend Rebeca to a clinic can land you in a lawsuit for at least $10k by people who do this as their day job. Even if you're not sued, remember that companies have been reliably predicting whether you're pregnant for at least 10 years [5] and using it to influence your behavior in their favor. This one may be the one with the "least bad" consequences but, paradoxically, the one that better drives home the point since nothing here is criminal. [1] https://archive.is/r6c7b https://archive.is/r6c7b [2] https://www.vice.com/en/article/pkbxp8/grindr-location-data-priest-weaponization-app https://www.vice.com/en/article/pkbxp8/grindr-location-data-... [3] https://www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood https://www.vice.com/en/article/m7vzjb/location-data-abortio... [4] https://www.cbsnews.com/news/texas-abortion-law-bounty-hunters-citizens/ https://www.cbsnews.com/news/texas-abortion-law-bounty-hunte... [5] https://archive.is/Z4x2f https://archive.is/Z4x2f

Swizec 3y ago

> I’m wondering: is there a good list of data privacy failure consequences? The ultimate example is how 1940’s Germany used 1930’s Germany’s census data. In 1933 it didn’t seem so bad to tick a box with your religious affiliation …

dredmorbius 3y ago
The Netherlands as well. Dutch census religious affiliation data were used by the imposed regime 1940--45. Several Dutch officials enacted wholesale destruction of those records as the occupation became obviously imminent, which saved many, though the Jewish population of the Netherlands fell from 154,887 in 1941 to 14,346 in 1947. The point being it's not necessarily your own government you need be worried about. In another variant on this, surveillance records kept by the East German Ministry for State Security (Ministerium für Staatssicherheit, a/k/a the Stasi) and Soviet KGB were acquired by successor governments (unified German and post-Soviet states including Ukraine). See: <https://www.wilsoncenter.org/blog-post/unearthing-soviet-secrets-ukraines-archives https://www.wilsoncenter.org/blog-post/unearthing-soviet-sec...> (I'm trying without success to find a reference to the destruction of Dutch census records, though I'm pretty certain this did actually happen.)
- endgame 3y ago
  > Dutch census records I'm pretty sure I saw this spelled out years ago in a groups.google.com post, but the amnesiac search engines of today are not yielding it up to me. I did find these articles: https://jacquesmattheij.com/if-you-have-nothing-to-hide/ https://jacquesmattheij.com/if-you-have-nothing-to-hide/ https://medium.com/@hansdezwart/during-world-war-ii-we-did-have-something-to-hide-40689565c550 https://medium.com/@hansdezwart/during-world-war-ii-we-did-h... And one of them references http://web.archive.org/web/20150812120743/https://stadsarchief.amsterdam.nl/presentaties/amsterdamse_schatten/oproer/aanslag_bevolkingsregister/index.nl.html http://web.archive.org/web/20150812120743/https://stadsarchi... (archive link, site is no longer up).
- MereInterest 3y ago
  There was a dedicated effort by the Dutch resistance to destroy the records of the civil registries. During the occupation, forged documents could be checked against the records in the civil registry. By bombing the civil registry office, the forged papers could no longer be validated against the civil registry, and would pass inspection. [0] https://en.wikipedia.org/wiki/1943_bombing_of_the_Amsterdam_civil_registry_office https://en.wikipedia.org/wiki/1943_bombing_of_the_Amsterdam_...

isanjay 3y ago

Amy Boyer ?