3 ms·

House passes bill requiring warrant to purchase data from third parties

64 points by c420 3y ago

toomuchtodo 3y ago
This is a solid effort, but the root cause is unregulated data brokers and their ability to aggregate, store, and sell this data. It’s not that the government should require a warrant; these companies should not exist. Edit: to the question “How would you define a data broker for these purposes?” that was deleted, I would defer to the CFPB’s criteria: https://www.consumerfinance.gov/about-us/newsroom/remarks-of-cfpb-director-rohit-chopra-at-white-house-roundtable-on-protecting-americans-from-harmful-data-broker-practices/ https://www.consumerfinance.gov/about-us/newsroom/remarks-of...
- deleted 3y ago
  [deleted]
- bilbo0s 3y ago
  This is so true. Because in practice, this bill does nothing. Senior administration officials said the measure would blind U.S. intelligence outfits from getting information easily purchased by foreign intelligence operations Right. And I'm supposed to believe that our intel people won't just use the data banks of British Intel or DGSE is that it? Heck, our law enforcement people could use Homeland Security databases after the information is disseminated. Without banning the practice of data aggregation in and of itself, you stop nothing. ETA: Now I think about it, I guess it does stop a local sheriff from having his/her own database. But it does nothing to stop them from searching DHS databases and getting the same information. And of course, as far as federal intelligence and law enforcement, well, they would be custodians of the databases so... yeah.
- ultrarunner 3y ago
  Hearing the phrase "unregulated data brokers" conjures images of PCI compliance and the conclusion that it will become so expensive to store data that Google et al will be forever cemented as the only firms capable of operating. What should be focused on more is the word "brokers" and the regulation of selling other people's data to third parties. I suspect that saying "no one should be able to sell people's data behind their back" would catch a lot more traction than "we should regulate this fuzzy idea of companies we don't think you should like." It would also solve the actual problem at hand. Either way, the government accessing the data should absolutely require a warrant.
  - em-bee 3y ago
    government accessing the data should absolutely require a warrant most importantly, it removes one potential lucrative buyer, making the business less profitable.
autoexec 3y ago
> “In practice, these standards make it impossible for the [intelligence community], law enforcement to acquire a whole host of readily available information that they currently rely on,” an administration official said. It doesn't make anything impossible to get, even if there weren't clear workarounds, all the data is as accessible as it was so long as they get a warrant rubber stamped by a judge. > “It can be impossible to know what’s in a data set before one actually obtains a data set,” the official continued. “So you’d be barred from getting that which you don’t even know.” He says this as if law enforcement going on fishing expeditions isn't a dystopian nightmare that should never be allowed in the first place.
- deleted 3y ago
  [deleted]
xyst 3y ago
There needs to be a way to track who is reading and storing my information. Maybe I need to spin up my own IdP and track every time an authorized Sp reads my data.
- cj 3y ago
  If you’re willing to spend a couple weekends on it, I’d recommend anyone (who’s tech savvy enough) using consumer Gmail to buy Google Workspace Enterprise for personal email. Been doing this for years. It’s something like $25/mo and gives you access to Google Admin where you can see logs and reports. Don’t think there’s prebuilt log reports for SPs calling APIs but pretty sure it’s possible to query that sort of data or log it into Google cloud
deleted 3y ago
[deleted]
polski-g 3y ago
How does the federal government have authority to regulate state warrant requirements?
- torstenvl 3y ago
  First, that isn't what it's doing. It's regulating the nation-wide market for data, which it can do under the commerce clause. However, the Fourth, Fifth, and Sixth Amendments apply to the states via the Fourteenth Amendment, which explicitly states that "Congress shall have power to enforce, by appropriate legislation, the provisions of this article." So state warrant requirements are not completely out of the reach of Congress.
turnsout 3y ago
Any chance of this passing the Senate?
sschueller 3y ago
Isn't the whole issue that the data is being collected by private entities indefinitely for profit? Data leaks will happen and at this point private industry can be just as bad as the state. What happens when private prisons purchase such information? Or other private institutions that have taken over government responsibilities?

64 points by c420 3y ago

This is a solid effort, but the root cause is unregulated data brokers and their ability to aggregate, store, and sell this data. It’s not that the government should require a warrant; these companies should not exist. Edit: to the question “How would you define a data broker for these purposes?” that was deleted, I would defer to the CFPB’s criteria: https://www.consumerfinance.gov/about-us/newsroom/remarks-of-cfpb-director-rohit-chopra-at-white-house-roundtable-on-protecting-americans-from-harmful-data-broker-practices/ https://www.consumerfinance.gov/about-us/newsroom/remarks-of...

deleted 3y ago
[deleted]
bilbo0s 3y ago
This is so true. Because in practice, this bill does nothing. Senior administration officials said the measure would blind U.S. intelligence outfits from getting information easily purchased by foreign intelligence operations Right. And I'm supposed to believe that our intel people won't just use the data banks of British Intel or DGSE is that it? Heck, our law enforcement people could use Homeland Security databases after the information is disseminated. Without banning the practice of data aggregation in and of itself, you stop nothing. ETA: Now I think about it, I guess it does stop a local sheriff from having his/her own database. But it does nothing to stop them from searching DHS databases and getting the same information. And of course, as far as federal intelligence and law enforcement, well, they would be custodians of the databases so... yeah.
ultrarunner 3y ago
Hearing the phrase "unregulated data brokers" conjures images of PCI compliance and the conclusion that it will become so expensive to store data that Google et al will be forever cemented as the only firms capable of operating. What should be focused on more is the word "brokers" and the regulation of selling other people's data to third parties. I suspect that saying "no one should be able to sell people's data behind their back" would catch a lot more traction than "we should regulate this fuzzy idea of companies we don't think you should like." It would also solve the actual problem at hand. Either way, the government accessing the data should absolutely require a warrant.
- em-bee 3y ago
  government accessing the data should absolutely require a warrant most importantly, it removes one potential lucrative buyer, making the business less profitable.

autoexec 3y ago

> “In practice, these standards make it impossible for the [intelligence community], law enforcement to acquire a whole host of readily available information that they currently rely on,” an administration official said. It doesn't make anything impossible to get, even if there weren't clear workarounds, all the data is as accessible as it was so long as they get a warrant rubber stamped by a judge. > “It can be impossible to know what’s in a data set before one actually obtains a data set,” the official continued. “So you’d be barred from getting that which you don’t even know.” He says this as if law enforcement going on fishing expeditions isn't a dystopian nightmare that should never be allowed in the first place.

deleted 3y ago
[deleted]

xyst 3y ago

There needs to be a way to track who is reading and storing my information. Maybe I need to spin up my own IdP and track every time an authorized Sp reads my data.

cj 3y ago
If you’re willing to spend a couple weekends on it, I’d recommend anyone (who’s tech savvy enough) using consumer Gmail to buy Google Workspace Enterprise for personal email. Been doing this for years. It’s something like $25/mo and gives you access to Google Admin where you can see logs and reports. Don’t think there’s prebuilt log reports for SPs calling APIs but pretty sure it’s possible to query that sort of data or log it into Google cloud

deleted 3y ago

[deleted]

polski-g 3y ago

How does the federal government have authority to regulate state warrant requirements?

torstenvl 3y ago
First, that isn't what it's doing. It's regulating the nation-wide market for data, which it can do under the commerce clause. However, the Fourth, Fifth, and Sixth Amendments apply to the states via the Fourteenth Amendment, which explicitly states that "Congress shall have power to enforce, by appropriate legislation, the provisions of this article." So state warrant requirements are not completely out of the reach of Congress.

turnsout 3y ago

Any chance of this passing the Senate?

sschueller 3y ago

Isn't the whole issue that the data is being collected by private entities indefinitely for profit? Data leaks will happen and at this point private industry can be just as bad as the state. What happens when private prisons purchase such information? Or other private institutions that have taken over government responsibilities?