14 ms·

Data brokers are selling flight information to CBP and ICE

547 points by exiguus 1y ago

anovikov 1y ago
[flagged]
- advisedwang 1y ago
  Why does ICE need to know about domestic flights? They have as much right to that info as every bus ticket.
  - runako 1y ago
    Exactly this. Let's spell it out: Customs & Border Patrol. Immigration and Customs Enforcement. Domestic travel does not involve immigration or customs. No international borders are crossed. Giving CBP line-item access to the movements of Americans makes as much sense as giving the SEC access to healthcare records. There is virtually no reason at all for these organizations to have any knowledge about the movements of people inside the US. They do not get to be super-police just because they want to be.
    - nathanaldensr 1y ago
      And yet Americans are subject to TSA stupidity for all domestic flights. The actual lines of when the federal government does and does not have authority are very blurred, even though I would personally argue they shouldn't have any authority on anything unless expressly granted by the Constitution.
      - foogazi 1y ago
        but domestic flights do track with Transportation Security
      - fmobus 1y ago
        TSA was created after 9/11, and iirc all of the planes involved were domestic flights.
    - ElevenLathe 1y ago
      This is the meat of the "unitary executive" legal theory. Under this theory, CBP is just a convenient name for a part of the executive branch. If any part of the executive branch has the right to (or even just isn't prohibited from using) a piece of data, then its just a matter of the president issuing the right orders so that CBP can too. The same would go for getting medical records over to the SEC. Even if he forgets to issue those orders, the Justice department (also part of the executive) obviously won't charge anyone with any kind of crime, and if they did he could pardon them or arrest the judges involved. I happen to believe that this is all just a convoluted way to back into the fuhrerprinzip by way of originalism, but I have no power. Either way, the US is not a liberal democracy any more. Laws do not apply to the powerful. Strength and power are the only things that matter. The Enlightment project is dead in Washington (and most statehouses) and the only question of consequence left is: What will replace it?
      - runako 1y ago
        100%. Neatly incorporated in there is that Congress cannot make any laws to bind the executive in any way. I have a feeling that many people cheering this are going to regret it when the Executive changes hands.
        ryandrake 1y ago
        If the executive branch changes hands, I would be willing to bet money that the Supreme Court will immediately do a 180 and declare all of these things as no longer powers of the executive branch. All of the things that were perfectly OK for Trump to do will suddenly be off limits for a Democrat president.
        ElevenLathe 1y ago
        It's also not at all clear that they intend to let the White House change hands again. One would assume that they have all the power they need to make that happen, and why wouldn't they?
    - almosthere 1y ago
      I think if you're a citizen, then I agree with you. However if you're an alien (legal or not) I think they should be allowed to figure out where you are.
      - runako 1y ago
        They absolutely should, but the onus is on them to figure out a way to do that within the confines of existing law. Existing law notably does not make ICE or CBP a super-agency that can do whatever it wants.
        almosthere 1y ago
        I think data brokers are legal. I think purchasing data is legal. So what is the problem?
      - advisedwang 1y ago
        We should just put ankle bracelets on each non-citizen when they enter. That way we can keep proper tabs on them.
    - SoftTalker 1y ago
      Arguably, because a person of interest may cross the border into the country and then travel around domestically.
      - runako 1y ago
        There has been no credible argument why this logic is acceptable for CBP and ICE but not FBI or DEA. Why are the misdemeanor civil violators ICE chases so important that federal laws no longer apply, when until a year ago it was generally understood that agencies like DEA had guardrails even when trying to apprehend people on felony charges? If this stands, there is no logically consistent rationale for DEA not being able to perform warrantless wiretaps of all communications, etc.
        SoftTalker 1y ago
        There’s a new sheriff in town in case you hadn’t noticed.
    - jibe 1y ago
      Their job is to enforce immigration laws inside the U.S. When illegal immigrants are travelling domestically, it involves ICE. The crime starts when the border is crossed, it doesn't end once you are illegally in the country and travelling domestically.
      - runako 1y ago
        One can use this logic to create an omnibus surveillance apparatus covering all aspects of communications, commerce, etc. We do not give other law enforcement similar deference, even though it might help them in some fraction of cases. For example: SEC could prosecute more insider trading if it was able to wiretap all domestic communications.
  - FuriouslyAdrift 1y ago
    Because all of the 9/11 flights were domestic. One of the duties of ICE is investigating terrorism (along wiht transnational criminal organizations). Air travel in the United States is mamanged by Federal law, not state. This is solidly in the Federal law enforcement wheelhouse. Anything that crosses state boundries is ALSO under Federal law.
    - deleted 1y ago
      [deleted]
  - deleted 1y ago
    [deleted]
leblancfg 1y ago
The amount and extent of data that is available out there by brokers for purchase by literally any company is *mind-boggling*. However bad you think it is, multiply that by 10.
- jeffbee 1y ago
  I would say that in general the HN crowd doesn't understand the industry at all, and they need to change the direction of their understanding, rather than the magnitude. Your basic hackernews believes that e.g. Google is out there selling all your personal information. But compared to these other industries the tech industry is almost airtight. It has long been possible for someone to pick up the phone and order, in any format they want, transaction data as narrowly targeted as they wish. Credit card line items for 35-year-old dentists living on the 400 block of Elm street in local town? By end of day.
  - sofixa 1y ago
    > Your basic hackernews believes that e.g. Google is out there selling all your personal information To add to this, any mention of "telemetry" is taken to mean your PII being taken by bad actors to abuse, instead of what it is in 99% of cases, which is usage statistics. (X% of our users use feature A, it merits investment). It can be both, but there's usually no place for differentiation, just pitchforks.
    - ctoth 1y ago
      > It can be both, but there's usually no place for differentiation Fool me once, shame on you. Fool me 153,927,861 times, shame on me. The place for differentiation, the place for "oh this is probably fine", the benefit of the doubt is, of course, lost. Because someone (you? people shaped like you?) who misuse telemetry destroyed trust. > It can be both should instead be "it usually is both and you the user have no way to know anyway."
    - mvieira38 1y ago
      The industry betrayed consumers' trust to the point where no project can be trusted to be mindful of data anymore. Even Proton Mail ended up ratting to the French, and that was just IP and session info, so who can we even trust to get "good telemetry"?
neuroelectron 1y ago
So what else is new? Have you heard about Palantir? The government literally sells (or gives) our private data to them. This should be illegal as they don't actually own this data legally as it's not covered by EULA which is generally how data brokers get around privacy violations and governments around unreasonable search and seizure. But hey, it makes Silicon Valley money.
gnabgib 1y ago
Little discussion 2 months ago (43+7 points, 2+3 comments) https://news.ycombinator.com/item?id=43949975 https://news.ycombinator.com/item?id=43949975 https://news.ycombinator.com/item?id=43952971 https://news.ycombinator.com/item?id=43952971
willguest 1y ago
It's amazing to me that the market for data is so well hidden from public view. So many large companies are mining and trading data on a daily basis - you would think that a data marketplace would have been a thing by now, especially with all the noise about "decentralisation" (yes, I know, crypto shill bros). I've been touting this as a business model for years. Better still, I'd like to see it done with behavioural models (in the open). That would really blow the lid off the industry. Imagine people charging companies, instead of simply being the product...
- Hilift 1y ago
  Is it really that hidden? In 2021, a guy went to another person's home to exact revenge for something 50 years earlier. Security video showed him holding the PeopleFinders folder. What should surprise people is their governments are selling some of the data.
  - sixothree 1y ago
    Yes! It is hidden. Go and get your data from this company. Report the results.
  - willguest 1y ago
    Thank you for making my point. Here's some research aided by Perplexity, which estimates that the global data market is valued at about $1.7 Trillion, with data monetization growing at about 17.6% CAGR: https://www.perplexity.ai/search/today-i-would-like-to-try-and-RqA5olJ0TqmESmC4acovDA https://www.perplexity.ai/search/today-i-would-like-to-try-a... (138 sources) Also, Meta can identify you based on your movement and a few pieces of social data (all of which is in the open). Tel Aviv airport has been running behavioural monitoring for about a decade, predicting crimes before they happen. You mention a case from 2021, which is about $5 trillion ago, and think that the government selling data is surprising. This is mature market that already knows everything about everyone, especially in the US, and is more concerned with what to do with it. The faucet is open, the ground floor is flooded, and we're discussing the different types of fish that have moved into our apartment.
- 1y ago
tgsovlerkhgsel 1y ago
This could actually be interesting because in many past egregious data broker cases, the offenders had no business in the EU so they could just laugh as they were handed one 20M fine after the other (e.g. Clearview), or they were making way more than 4% of their revenue in profit from privacy violations so they could just risk the fine. But here, the controller of the data is the airline, the transfer to the data broker might be illegal, and an airline is the worst company to commit GDPR violations with: They have a lot of global revenue but a relatively thin margin, very little of that margin comes from data abuse (so they can't just shrug off the GDPR fine as a small cost of doing shady business), and they are reachable in the EU (worst case a member state can ground and confiscate their planes, and essentially ban them from flying to the EU by threatening to confiscate any other plane that lands). And yes, Germany will impound a plane to get debts paid: https://www.reuters.com/article/world/thai-prince-to-pay-bond-on-jet-impounded-in-germany-idUSTRE770149/ https://www.reuters.com/article/world/thai-prince-to-pay-bon...
- manquer 1y ago
  While airlines are the obvious source for such data sets , there are a number of other sources. The barcode in the boarding pass contains all the information that airlines know about you [1]. It is after all only encoded and not encrypted and so many companies manufacture readers for it. Airports check-in systems, or it could be from the baggage handling system , the duty free shop or the airport lounge and so on. There are so many different players who have access to most or all of the data it would hard to prove it came any one source at all. That is just the barcodes on the boarding pass, passport scanners are like couple of hundred dollars ans airport shops/car rentals use them all the time. Many airports use facial scanning these days and don’t even ask for boarding pass/passport/visa during boarding at all . There are auxiliary sources which could be used in conjunction with other sources like Uber booking and so on. [1] https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/ https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
  - sealeck 1y ago
    I agree that they can get the data through other means. Not so sure about > There are so many different players who have access to most or all of the data it would hard to prove it came any one source at all. Because a prosecutor can obtain copies of all emails talking about this, they can examine your bank accounts for payments from data brokers, they can require legal to give them copies of any contracts, they can look at audit logs from the production database and airlines aren't Evil Inc -- stuff will inevitably leak and get out. You can't cover yourself that well as a CEO looking to make a quick buck...
almosthere 1y ago
What's the lede on this story, that data brokers are selling this data or that the purchasers are ICE/CBP?
- toss1 1y ago
  The lede is buried, and only half said: >>"Movement unrestricted by governments is a hallmark of a free society. " The other half of the lede is that this govt is using Insert_Method of restricting the movements of it's residents. At this point, any persecuted activity, e.g., obtaining reproductive healthcare with a link to a person in a Red State, requires opsec procedures comparable to a CIA dark op just to not get persecuted.
AlexandrB 1y ago
I don't get it. Why would CBP and ICE need to buy this from a data broker? The TSA is right there scanning everyone's boarding pass as part of going through security.
- DistractionRect 1y ago
  Probably because the tsa isn't able/allowed to hand out access willy nilly. It's kinda like how the police need warrants to request cellphone data, but cellphone companies could sell realtime data to third parties who in turn sold it to the police. https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17081684
  - AlexandrB 1y ago
    It's fine to speculate, but I really wish the article had made it explicit given that the EFF has actual lawyers on staff.
- Beretta_Vexee 1y ago
  Because there is probably a well-defined regulatory framework for accessing data collected by the TSA, whereas there are few or no requirements when the same data is purchased from a broker. It is not even certain that the data actually comes from the TSA. It could come from airlines, payment companies, etc. There is no guarantee of quality when purchasing data from a broker.
  - mrweasel 1y ago
    The regulatory angle at least explains part of my wondering. I'm not really surprised that they have access to this information, I'm just surprised that they buy it, rather than just demanding it be handed over.
    - pornel 1y ago
      Buying has no accountability, no judges. Probably not even a proper paper trail. They're spending public money, so the cost doesn't matter to them either. With this administration they can get unlimited funding.
ujkhsjkdhf234 1y ago
People would be surprised at how cheap data is. My company is offered credit card purchases with demographics, occupation, income level, down to the zip code for what is basically pennies. We didn't buy it but that's what advertisers know about you.
- andrew_lettuce 1y ago
  If they're selling it why wouldn't you name your company here?
  - ujkhsjkdhf234 1y ago
    Why would I?
ourmandave 1y ago
An important part of data collection is dealing with edge cases. That's why I schedule all my travel with a layover in South Sudan.
maCDzP 1y ago
Does anyone here have some tips how to ”opt out” from this?
- pnw 1y ago
  It doesn't seem like you can. The airlines actually own the clearing house (ARC) that is selling the data.
  - dawnerd 1y ago
    You can. I emailed ARC and they complied with my request. Helps if you're in California and mention your rights. You can also opt out of them sharing your data. Any consequences to this I guess I'll find out later this year when I'm flying a lot (guessing absolutely zero).
- Melatonic 1y ago
  That's what I'm wondering - maybe a way to opt out when purchasing flights per airline?
- dawnerd 1y ago
  Yes, email privacy@arccorp.com and cc legalteam@arccorp.com You'll get a response from their legal counsel requesting some information for them to verify your request.
jandrewrogers 1y ago
People don't grasp how easy it is to build data models like this even without privileged first-party data access. In 2012 I created a killer prototype that demonstrated that you could accurately reconstruct most people's flight history at scale from social media and/or ad data. Probably the first of its kind. This has been possible for a long time. A quick sketch of how it worked: We filtered out all spatiotemporal edges in the entity graph with an implied speed of <300 kilometers per hour or <200 kilometers distance, IIRC. This was the proxy for "was on a plane". It also implicitly provided the origin and destination. These edges can be correlated with both public flight data and maintenance IoT data from jet engines to put entities on a specific flight. People overlook the extent to which innocuous industrial IoT data can be used as a proxy for relationships in unrelated domains. In rare cases, there was more than one plausible commercial flight. Because we had their flight history, we assumed in these cases that it was the primary airline they had used in the past, either generally or for that specific origin and destination. This almost always resolved perfectly. This was impressively effective and it didn't require first-party data from airlines or particularly sophisticated analytics. Space and time are the primary keys of reality.
- wingspar 1y ago
  Honestly asking, How did you validate your results?
  - fsckboy 1y ago
    i don't have any special knowledge in this area, but just thinking about it idly while sitting here, "robbing their homes while they are away" comes to mind as a good proxy.
    - iterance 1y ago
      That seems like a risk, but not a validation method, unless you are feeling particularly bold.
    - animal_spirits 1y ago
      Reminds me of this news story of footballer John Terry who's house was robbed because he posted a picture of him on holiday. The insurance company tried to use a 'reasonable care' clause of home insurance to deny his insurance claim. - https://www.blakefire-security.co.uk/blog/social-media-and-john-terrys-burglary/ https://www.blakefire-security.co.uk/blog/social-media-and-j...
blindriver 1y ago
I have given up keeping my data private from the government. It’s impossible to avoid, so I signed up for Clear, etc because I know they have that information already. Frankly, Clear and TSA-Pre makes my life so much easier and since I don’t commit crimes I’m not very worried… just a little worried.
- dawnerd 1y ago
  For me its not about keeping my data private so much, more about making it harder for them to just have blanket easy access. I have a passport, precheck, global entry... they know who I am and where I go. But if I can make it just a little harder for the other gov agencies to know what I'm doing that's a win in my book. I hate the excuse "since I don't commit crimes". It's not about that. If they want your info that you're not directly giving them, they can get a warrant.
- sixothree 1y ago
  > I don’t commit crimes What if it affects your ability to get work? Have you ever made or viewed any posts that could be considered political or made comments on a political post? What agenda do you support with those actions?
AtlasBarfed 1y ago
Data brokers listen to everything, track your movements, buying habits, internet history, apps, app usage, buying habits, etc. Terms of service are meaningless if they keep the extent as secret as possible. Facebook has demonstrably shown this and as shocking as it is they are restrained compared to lots of companies. Especially when you can out source the full evil to a wholly owned subsidiary for plausible deniability. And if private corpse know something, many foreign governments know all of it.
- andrew_lettuce 1y ago
  And who are these shadowy data brokers listening to everything. Heavy on the FUD, light on any details...
  - AtlasBarfed 1y ago
    Carnivore was happening almost thirty years ago. Are you even that old? Since then everyone carries a device that tracks gps, usage, has a microphone and camera, that can be remotely turned on. Every site and app has a ToS that enables data collection. And there are thousands of companies collecting and aggregating and reselling. State actors can bypass air gaps, hide in HDD firmware, and that is 10 year old capabilities. And now they have usable AI to read the fire hose.
Ekaros 1y ago
Siding the topic. Does anyone have any estimate how much does a regular company make for selling this data? I do not mean those focusing on advertising. But companies that willingly sell their customers data and habits?
fallinditch 1y ago
As far as I know there is no definitive guide for how to carry out a 'digital privacy reset' or 'digital rebirth' - but your LLM should be able to give you good instructions. To do it properly, not only would you have to change all your logins and email accounts, but simultaneously start using a new computer and phone. Also, move home. In other words: very hard to achieve. But I wonder if there is a set of achievable actions one can take that gets you to 'very good privacy'?
- nemomarx 1y ago
  What about the records of your purchase of that new home? Do you need to again get a new bank? what about credit history
- pjc50 1y ago
  Of course, in ICE land, ditching your old identity is a disaster, because now you can't prove you're a citizen. Papers please.
btown 1y ago
It's funny to see ARC just being described as a "data broker," which strongly implies that it doesn't play a role in facilitating the actual underlying consumer activity. ARC and IATA absolutely do play such a role, as the financial clearinghouses for ensuring that travel agents (online and offline) and airlines can pay each other, and as gatekeepers/certification bodies for agencies to ensure these financial systems aren't abused. Now, they absolutely do sell access to data to third parties, governmental and nongovernmental. But the reason they have this data isn't because they buy it to resell it; they are fully part of the funds flow for the underlying transaction. Whether they should be allowed to sell or share non-anonymized data on passenger records and prices paid is a very good question, but at the very least this is about as first-party as data gets. https://www.altexsoft.com/blog/airline-reporting-corporation-billing-and-settlement-plan/ https://www.altexsoft.com/blog/airline-reporting-corporation... describes some of these flows. (Here be dragons.)
- ujkiolp 1y ago
  this counters none of the points covered in the article
  - darig 1y ago
    [dead]
  - btown 1y ago
    ...nor is it meant to? Two things can be true simultaneously: (a) it is worrisome that a company is selling PII at scale to government entities who would otherwise need to request that data through accountable warrant processes, and (b) we shouldn't call every such company a "data broker" lest we dilute the specificity of that term, particularly when the companies in question participate in the funds flow of the customer transaction.
raincom 1y ago
Who funded many data brokers in the first place? Lots of three letter agencies, through intermediaries. Modern phones + social media = zero cost surveillance for the big brother.
- leptons 1y ago
  >Who funded many data brokers in the first place? Lots of three letter agencies okay... >zero cost surveillance for the big brother How is it "free" if they are the ones funding the data brokers?
identigral 1y ago
https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-Li... is a useful place to start for opting out. As of this writing, this list does not include Airlines Reporting Corporation (ARC), a data broker mentioned in the article.
unglaublich 1y ago
How do I get access to a data broker? I'm curious what info I can get about myself and others in exchange for money.
josefritzishere 1y ago
Selling... as in my tax dollars are being wasted on this???
black_13 1y ago
[dead]
theLegionWithin 1y ago
what percentage of illegals travel on airplanes?
- DaSHacka 1y ago
  Well, 100% of the ones sent to El Salvador
aussieguy1234 1y ago
Chilling things here, however - I guess that the US government in general would have access to flight info? at least those going to or travelling within the US.
noobermin 1y ago
Just remember, as they're detaining citizens now they will eventually come for you.
- DaSHacka 1y ago
  Not everyone is an immigrant, illegal or otherwise.
saubeidl 1y ago
For any EU citizens that might've taken flights in the US, this seems like it would be a good time to send that nightmare GDPR letter: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

547 points by exiguus 1y ago

anovikov 1y ago

[flagged]

advisedwang 1y ago
Why does ICE need to know about domestic flights? They have as much right to that info as every bus ticket.
- runako 1y ago
  Exactly this. Let's spell it out: Customs & Border Patrol. Immigration and Customs Enforcement. Domestic travel does not involve immigration or customs. No international borders are crossed. Giving CBP line-item access to the movements of Americans makes as much sense as giving the SEC access to healthcare records. There is virtually no reason at all for these organizations to have any knowledge about the movements of people inside the US. They do not get to be super-police just because they want to be.
  - nathanaldensr 1y ago
    And yet Americans are subject to TSA stupidity for all domestic flights. The actual lines of when the federal government does and does not have authority are very blurred, even though I would personally argue they shouldn't have any authority on anything unless expressly granted by the Constitution.
    - foogazi 1y ago
      but domestic flights do track with Transportation Security
    - fmobus 1y ago
      TSA was created after 9/11, and iirc all of the planes involved were domestic flights.
  - ElevenLathe 1y ago
    This is the meat of the "unitary executive" legal theory. Under this theory, CBP is just a convenient name for a part of the executive branch. If any part of the executive branch has the right to (or even just isn't prohibited from using) a piece of data, then its just a matter of the president issuing the right orders so that CBP can too. The same would go for getting medical records over to the SEC. Even if he forgets to issue those orders, the Justice department (also part of the executive) obviously won't charge anyone with any kind of crime, and if they did he could pardon them or arrest the judges involved. I happen to believe that this is all just a convoluted way to back into the fuhrerprinzip by way of originalism, but I have no power. Either way, the US is not a liberal democracy any more. Laws do not apply to the powerful. Strength and power are the only things that matter. The Enlightment project is dead in Washington (and most statehouses) and the only question of consequence left is: What will replace it?
    - runako 1y ago
      100%. Neatly incorporated in there is that Congress cannot make any laws to bind the executive in any way. I have a feeling that many people cheering this are going to regret it when the Executive changes hands.
      - ryandrake 1y ago
        If the executive branch changes hands, I would be willing to bet money that the Supreme Court will immediately do a 180 and declare all of these things as no longer powers of the executive branch. All of the things that were perfectly OK for Trump to do will suddenly be off limits for a Democrat president.
        ElevenLathe 1y ago
        It's also not at all clear that they intend to let the White House change hands again. One would assume that they have all the power they need to make that happen, and why wouldn't they?
  - almosthere 1y ago
    I think if you're a citizen, then I agree with you. However if you're an alien (legal or not) I think they should be allowed to figure out where you are.
    - runako 1y ago
      They absolutely should, but the onus is on them to figure out a way to do that within the confines of existing law. Existing law notably does not make ICE or CBP a super-agency that can do whatever it wants.
      - almosthere 1y ago
        I think data brokers are legal. I think purchasing data is legal. So what is the problem?
    - advisedwang 1y ago
      We should just put ankle bracelets on each non-citizen when they enter. That way we can keep proper tabs on them.
  - SoftTalker 1y ago
    Arguably, because a person of interest may cross the border into the country and then travel around domestically.
    - runako 1y ago
      There has been no credible argument why this logic is acceptable for CBP and ICE but not FBI or DEA. Why are the misdemeanor civil violators ICE chases so important that federal laws no longer apply, when until a year ago it was generally understood that agencies like DEA had guardrails even when trying to apprehend people on felony charges? If this stands, there is no logically consistent rationale for DEA not being able to perform warrantless wiretaps of all communications, etc.
      - SoftTalker 1y ago
        There’s a new sheriff in town in case you hadn’t noticed.
  - jibe 1y ago
    Their job is to enforce immigration laws inside the U.S. When illegal immigrants are travelling domestically, it involves ICE. The crime starts when the border is crossed, it doesn't end once you are illegally in the country and travelling domestically.
    - runako 1y ago
      One can use this logic to create an omnibus surveillance apparatus covering all aspects of communications, commerce, etc. We do not give other law enforcement similar deference, even though it might help them in some fraction of cases. For example: SEC could prosecute more insider trading if it was able to wiretap all domestic communications.
- FuriouslyAdrift 1y ago
  Because all of the 9/11 flights were domestic. One of the duties of ICE is investigating terrorism (along wiht transnational criminal organizations). Air travel in the United States is mamanged by Federal law, not state. This is solidly in the Federal law enforcement wheelhouse. Anything that crosses state boundries is ALSO under Federal law.
  - deleted 1y ago
    [deleted]
- deleted 1y ago
  [deleted]

leblancfg 1y ago

The amount and extent of data that is available out there by brokers for purchase by literally any company is *mind-boggling*. However bad you think it is, multiply that by 10.

jeffbee 1y ago
I would say that in general the HN crowd doesn't understand the industry at all, and they need to change the direction of their understanding, rather than the magnitude. Your basic hackernews believes that e.g. Google is out there selling all your personal information. But compared to these other industries the tech industry is almost airtight. It has long been possible for someone to pick up the phone and order, in any format they want, transaction data as narrowly targeted as they wish. Credit card line items for 35-year-old dentists living on the 400 block of Elm street in local town? By end of day.
- sofixa 1y ago
  > Your basic hackernews believes that e.g. Google is out there selling all your personal information To add to this, any mention of "telemetry" is taken to mean your PII being taken by bad actors to abuse, instead of what it is in 99% of cases, which is usage statistics. (X% of our users use feature A, it merits investment). It can be both, but there's usually no place for differentiation, just pitchforks.
  - ctoth 1y ago
    > It can be both, but there's usually no place for differentiation Fool me once, shame on you. Fool me 153,927,861 times, shame on me. The place for differentiation, the place for "oh this is probably fine", the benefit of the doubt is, of course, lost. Because someone (you? people shaped like you?) who misuse telemetry destroyed trust. > It can be both should instead be "it usually is both and you the user have no way to know anyway."
  - mvieira38 1y ago
    The industry betrayed consumers' trust to the point where no project can be trusted to be mindful of data anymore. Even Proton Mail ended up ratting to the French, and that was just IP and session info, so who can we even trust to get "good telemetry"?

neuroelectron 1y ago

So what else is new? Have you heard about Palantir? The government literally sells (or gives) our private data to them. This should be illegal as they don't actually own this data legally as it's not covered by EULA which is generally how data brokers get around privacy violations and governments around unreasonable search and seizure. But hey, it makes Silicon Valley money.

gnabgib 1y ago

Little discussion 2 months ago (43+7 points, 2+3 comments) https://news.ycombinator.com/item?id=43949975 https://news.ycombinator.com/item?id=43949975 https://news.ycombinator.com/item?id=43952971 https://news.ycombinator.com/item?id=43952971

willguest 1y ago

It's amazing to me that the market for data is so well hidden from public view. So many large companies are mining and trading data on a daily basis - you would think that a data marketplace would have been a thing by now, especially with all the noise about "decentralisation" (yes, I know, crypto shill bros). I've been touting this as a business model for years. Better still, I'd like to see it done with behavioural models (in the open). That would really blow the lid off the industry. Imagine people charging companies, instead of simply being the product...

Hilift 1y ago
Is it really that hidden? In 2021, a guy went to another person's home to exact revenge for something 50 years earlier. Security video showed him holding the PeopleFinders folder. What should surprise people is their governments are selling some of the data.
- sixothree 1y ago
  Yes! It is hidden. Go and get your data from this company. Report the results.
- willguest 1y ago
  Thank you for making my point. Here's some research aided by Perplexity, which estimates that the global data market is valued at about $1.7 Trillion, with data monetization growing at about 17.6% CAGR: https://www.perplexity.ai/search/today-i-would-like-to-try-and-RqA5olJ0TqmESmC4acovDA https://www.perplexity.ai/search/today-i-would-like-to-try-a... (138 sources) Also, Meta can identify you based on your movement and a few pieces of social data (all of which is in the open). Tel Aviv airport has been running behavioural monitoring for about a decade, predicting crimes before they happen. You mention a case from 2021, which is about $5 trillion ago, and think that the government selling data is surprising. This is mature market that already knows everything about everyone, especially in the US, and is more concerned with what to do with it. The faucet is open, the ground floor is flooded, and we're discussing the different types of fish that have moved into our apartment.
1y ago

tgsovlerkhgsel 1y ago

This could actually be interesting because in many past egregious data broker cases, the offenders had no business in the EU so they could just laugh as they were handed one 20M fine after the other (e.g. Clearview), or they were making way more than 4% of their revenue in profit from privacy violations so they could just risk the fine. But here, the controller of the data is the airline, the transfer to the data broker might be illegal, and an airline is the worst company to commit GDPR violations with: They have a lot of global revenue but a relatively thin margin, very little of that margin comes from data abuse (so they can't just shrug off the GDPR fine as a small cost of doing shady business), and they are reachable in the EU (worst case a member state can ground and confiscate their planes, and essentially ban them from flying to the EU by threatening to confiscate any other plane that lands). And yes, Germany will impound a plane to get debts paid: https://www.reuters.com/article/world/thai-prince-to-pay-bond-on-jet-impounded-in-germany-idUSTRE770149/ https://www.reuters.com/article/world/thai-prince-to-pay-bon...

manquer 1y ago
While airlines are the obvious source for such data sets , there are a number of other sources. The barcode in the boarding pass contains all the information that airlines know about you [1]. It is after all only encoded and not encrypted and so many companies manufacture readers for it. Airports check-in systems, or it could be from the baggage handling system , the duty free shop or the airport lounge and so on. There are so many different players who have access to most or all of the data it would hard to prove it came any one source at all. That is just the barcodes on the boarding pass, passport scanners are like couple of hundred dollars ans airport shops/car rentals use them all the time. Many airports use facial scanning these days and don’t even ask for boarding pass/passport/visa during boarding at all . There are auxiliary sources which could be used in conjunction with other sources like Uber booking and so on. [1] https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/ https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
- sealeck 1y ago
  I agree that they can get the data through other means. Not so sure about > There are so many different players who have access to most or all of the data it would hard to prove it came any one source at all. Because a prosecutor can obtain copies of all emails talking about this, they can examine your bank accounts for payments from data brokers, they can require legal to give them copies of any contracts, they can look at audit logs from the production database and airlines aren't Evil Inc -- stuff will inevitably leak and get out. You can't cover yourself that well as a CEO looking to make a quick buck...

almosthere 1y ago

What's the lede on this story, that data brokers are selling this data or that the purchasers are ICE/CBP?

toss1 1y ago
The lede is buried, and only half said: >>"Movement unrestricted by governments is a hallmark of a free society. " The other half of the lede is that this govt is using Insert_Method of restricting the movements of it's residents. At this point, any persecuted activity, e.g., obtaining reproductive healthcare with a link to a person in a Red State, requires opsec procedures comparable to a CIA dark op just to not get persecuted.

AlexandrB 1y ago

I don't get it. Why would CBP and ICE need to buy this from a data broker? The TSA is right there scanning everyone's boarding pass as part of going through security.

DistractionRect 1y ago
Probably because the tsa isn't able/allowed to hand out access willy nilly. It's kinda like how the police need warrants to request cellphone data, but cellphone companies could sell realtime data to third parties who in turn sold it to the police. https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17081684
- AlexandrB 1y ago
  It's fine to speculate, but I really wish the article had made it explicit given that the EFF has actual lawyers on staff.
Beretta_Vexee 1y ago
Because there is probably a well-defined regulatory framework for accessing data collected by the TSA, whereas there are few or no requirements when the same data is purchased from a broker. It is not even certain that the data actually comes from the TSA. It could come from airlines, payment companies, etc. There is no guarantee of quality when purchasing data from a broker.
- mrweasel 1y ago
  The regulatory angle at least explains part of my wondering. I'm not really surprised that they have access to this information, I'm just surprised that they buy it, rather than just demanding it be handed over.
  - pornel 1y ago
    Buying has no accountability, no judges. Probably not even a proper paper trail. They're spending public money, so the cost doesn't matter to them either. With this administration they can get unlimited funding.

ujkhsjkdhf234 1y ago

People would be surprised at how cheap data is. My company is offered credit card purchases with demographics, occupation, income level, down to the zip code for what is basically pennies. We didn't buy it but that's what advertisers know about you.

andrew_lettuce 1y ago
If they're selling it why wouldn't you name your company here?
- ujkhsjkdhf234 1y ago
  Why would I?

ourmandave 1y ago

An important part of data collection is dealing with edge cases. That's why I schedule all my travel with a layover in South Sudan.

maCDzP 1y ago

Does anyone here have some tips how to ”opt out” from this?

pnw 1y ago
It doesn't seem like you can. The airlines actually own the clearing house (ARC) that is selling the data.
- dawnerd 1y ago
  You can. I emailed ARC and they complied with my request. Helps if you're in California and mention your rights. You can also opt out of them sharing your data. Any consequences to this I guess I'll find out later this year when I'm flying a lot (guessing absolutely zero).
Melatonic 1y ago
That's what I'm wondering - maybe a way to opt out when purchasing flights per airline?
dawnerd 1y ago
Yes, email privacy@arccorp.com and cc legalteam@arccorp.com You'll get a response from their legal counsel requesting some information for them to verify your request.

jandrewrogers 1y ago

People don't grasp how easy it is to build data models like this even without privileged first-party data access. In 2012 I created a killer prototype that demonstrated that you could accurately reconstruct most people's flight history at scale from social media and/or ad data. Probably the first of its kind. This has been possible for a long time. A quick sketch of how it worked: We filtered out all spatiotemporal edges in the entity graph with an implied speed of <300 kilometers per hour or <200 kilometers distance, IIRC. This was the proxy for "was on a plane". It also implicitly provided the origin and destination. These edges can be correlated with both public flight data and maintenance IoT data from jet engines to put entities on a specific flight. People overlook the extent to which innocuous industrial IoT data can be used as a proxy for relationships in unrelated domains. In rare cases, there was more than one plausible commercial flight. Because we had their flight history, we assumed in these cases that it was the primary airline they had used in the past, either generally or for that specific origin and destination. This almost always resolved perfectly. This was impressively effective and it didn't require first-party data from airlines or particularly sophisticated analytics. Space and time are the primary keys of reality.

wingspar 1y ago
Honestly asking, How did you validate your results?
- fsckboy 1y ago
  i don't have any special knowledge in this area, but just thinking about it idly while sitting here, "robbing their homes while they are away" comes to mind as a good proxy.
  - iterance 1y ago
    That seems like a risk, but not a validation method, unless you are feeling particularly bold.
  - animal_spirits 1y ago
    Reminds me of this news story of footballer John Terry who's house was robbed because he posted a picture of him on holiday. The insurance company tried to use a 'reasonable care' clause of home insurance to deny his insurance claim. - https://www.blakefire-security.co.uk/blog/social-media-and-john-terrys-burglary/ https://www.blakefire-security.co.uk/blog/social-media-and-j...

blindriver 1y ago

I have given up keeping my data private from the government. It’s impossible to avoid, so I signed up for Clear, etc because I know they have that information already. Frankly, Clear and TSA-Pre makes my life so much easier and since I don’t commit crimes I’m not very worried… just a little worried.

dawnerd 1y ago
For me its not about keeping my data private so much, more about making it harder for them to just have blanket easy access. I have a passport, precheck, global entry... they know who I am and where I go. But if I can make it just a little harder for the other gov agencies to know what I'm doing that's a win in my book. I hate the excuse "since I don't commit crimes". It's not about that. If they want your info that you're not directly giving them, they can get a warrant.
sixothree 1y ago
> I don’t commit crimes What if it affects your ability to get work? Have you ever made or viewed any posts that could be considered political or made comments on a political post? What agenda do you support with those actions?

AtlasBarfed 1y ago

Data brokers listen to everything, track your movements, buying habits, internet history, apps, app usage, buying habits, etc. Terms of service are meaningless if they keep the extent as secret as possible. Facebook has demonstrably shown this and as shocking as it is they are restrained compared to lots of companies. Especially when you can out source the full evil to a wholly owned subsidiary for plausible deniability. And if private corpse know something, many foreign governments know all of it.

andrew_lettuce 1y ago
And who are these shadowy data brokers listening to everything. Heavy on the FUD, light on any details...
- AtlasBarfed 1y ago
  Carnivore was happening almost thirty years ago. Are you even that old? Since then everyone carries a device that tracks gps, usage, has a microphone and camera, that can be remotely turned on. Every site and app has a ToS that enables data collection. And there are thousands of companies collecting and aggregating and reselling. State actors can bypass air gaps, hide in HDD firmware, and that is 10 year old capabilities. And now they have usable AI to read the fire hose.

Ekaros 1y ago

Siding the topic. Does anyone have any estimate how much does a regular company make for selling this data? I do not mean those focusing on advertising. But companies that willingly sell their customers data and habits?

fallinditch 1y ago

As far as I know there is no definitive guide for how to carry out a 'digital privacy reset' or 'digital rebirth' - but your LLM should be able to give you good instructions. To do it properly, not only would you have to change all your logins and email accounts, but simultaneously start using a new computer and phone. Also, move home. In other words: very hard to achieve. But I wonder if there is a set of achievable actions one can take that gets you to 'very good privacy'?

nemomarx 1y ago
What about the records of your purchase of that new home? Do you need to again get a new bank? what about credit history
pjc50 1y ago
Of course, in ICE land, ditching your old identity is a disaster, because now you can't prove you're a citizen. Papers please.

btown 1y ago

It's funny to see ARC just being described as a "data broker," which strongly implies that it doesn't play a role in facilitating the actual underlying consumer activity. ARC and IATA absolutely do play such a role, as the financial clearinghouses for ensuring that travel agents (online and offline) and airlines can pay each other, and as gatekeepers/certification bodies for agencies to ensure these financial systems aren't abused. Now, they absolutely do sell access to data to third parties, governmental and nongovernmental. But the reason they have this data isn't because they buy it to resell it; they are fully part of the funds flow for the underlying transaction. Whether they should be allowed to sell or share non-anonymized data on passenger records and prices paid is a very good question, but at the very least this is about as first-party as data gets. https://www.altexsoft.com/blog/airline-reporting-corporation-billing-and-settlement-plan/ https://www.altexsoft.com/blog/airline-reporting-corporation... describes some of these flows. (Here be dragons.)

ujkiolp 1y ago
this counters none of the points covered in the article
- darig 1y ago
  [dead]
- btown 1y ago
  ...nor is it meant to? Two things can be true simultaneously: (a) it is worrisome that a company is selling PII at scale to government entities who would otherwise need to request that data through accountable warrant processes, and (b) we shouldn't call every such company a "data broker" lest we dilute the specificity of that term, particularly when the companies in question participate in the funds flow of the customer transaction.

raincom 1y ago

Who funded many data brokers in the first place? Lots of three letter agencies, through intermediaries. Modern phones + social media = zero cost surveillance for the big brother.

leptons 1y ago
>Who funded many data brokers in the first place? Lots of three letter agencies okay... >zero cost surveillance for the big brother How is it "free" if they are the ones funding the data brokers?

identigral 1y ago

https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-Li... is a useful place to start for opting out. As of this writing, this list does not include Airlines Reporting Corporation (ARC), a data broker mentioned in the article.

unglaublich 1y ago

How do I get access to a data broker? I'm curious what info I can get about myself and others in exchange for money.

josefritzishere 1y ago

Selling... as in my tax dollars are being wasted on this???

black_13 1y ago

[dead]

theLegionWithin 1y ago

what percentage of illegals travel on airplanes?

DaSHacka 1y ago
Well, 100% of the ones sent to El Salvador

aussieguy1234 1y ago

Chilling things here, however - I guess that the US government in general would have access to flight info? at least those going to or travelling within the US.

noobermin 1y ago

Just remember, as they're detaining citizens now they will eventually come for you.

DaSHacka 1y ago
Not everyone is an immigrant, illegal or otherwise.

saubeidl 1y ago

For any EU citizens that might've taken flights in the US, this seems like it would be a good time to send that nightmare GDPR letter: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...