
The privacy wars are about to get a whole lot worse - dredmorbius
http://www.locusmag.com/Perspectives/2016/09/cory-doctorowthe-privacy-wars-are-about-to-get-a-whole-lot-worse/
======
ryandrake
> Eventually, some lawyer is going to convince a judge that, say, 1% the
> victims of a deep-pocketed company’s breach will end up losing their houses
> to identity thieves as a result of the data that the company has leaked, and
> that the damages should be equal to 1% of all the property owned by a 53
> million (or 500 million!) customers whom the company has wronged. It will
> take down a Fortune 100 company, and transfer billions from investors and
> insurers to lawyers and their clients.

This highlights a major problem with tort law: It's monetary damages or GTFO.
In other words, it's nearly impossible to make a case for damages when there
is no obvious monetary aspect of the harm done. I can't sue Home Depot for
giving up my credit card info to hackers unless I can prove that it led to
someone running up my credit card bill. Either this needs to change, or it
should be a crime for companies to release customers' personal information to
unauthorized third parties.

Part of the problem is how these data breaches are framed in the media. It's
always "Company X was HACKED!" and "Company Y SUFFERED a major data breach!".
They're portraying the negligent company as the victim! It should be "Company
A carelessly released their customers' data." or "Company B failed to protect
10 million credit card numbers." Once we stop pretending these companies are
victims, we can start making and enforcing tougher privacy laws.

~~~
ahartman00
"They're portraying the negligent company as the victim!"

While I agree that things like sql injection are negligent, there were also
credit card hacks/leaks(and an nsa leak) that were the result of malicious
contractors. Saying "dont hire bad people" is easy, but how do you do that?

And the standard for best practices is constantly moving in our industry, how
do we decide when it is negligence, and when there was nothing that could be
done.

Not saying people are being harmed by this, Im just saying its not so black
and white. In some cases the companies that were hacked couldnt have
reasonably stopped it. I mean, how do you prevent contractors from setting up
something that steals credit card numbers? You hired the contractors because
you dont have those skills in house.

~~~
CaptSpify
Do you regularly hire contractors and then never look over the work they do?
Because I don't, and frankly, that's kind of idiotic. The data is your
responsibility, not theirs. They also have no interest in the longevity of
your company, why would you trust them without checking what they are doing?
As a customer, I don't care how Home-Depot handed out my CC info, I care that
they did.

Sure some hacks happened despite companies putting forth their best effort,
but hand-waving the responsibility to contractors is not the answer.

~~~
ahartman00
"Do you regularly hire contractors and then never look over the work they do?"

I dont when it comes to software. For say legal services, I dont have many
options, as I am not an expert. The point I was trying to make is that
sometimes people hire contractors because they dont have the expertise. How
are they supposed to review something they dont understand? Saying every
organization should have top notch IT on staff so this doesnt happen is hand-
waving as well.

~~~
CaptSpify
There's a famous saying along the lines of "If you are rich, hire two
accountants. One to keep track of your books, and another to keep track of the
first guy"

If you provide sensitive information to _anyone_ that you don't have legal
recourse against, then I don't really have any sympathy for you. If you make a
bad business decision and it leaks my info, I'm not upset because someone took
it without your approval, I'm upset because it was leaked.

There's a cost/benefit risk to everything. If you want to take the route of
working with contractors, you have to weight the risks for that as well.

~~~
ahartman00
"If you are rich, hire two accountants. One to keep track of your books, and
another to keep track of the first guy"

Brilliant, I hadnt heard of/thought of that.

"There's a cost/benefit risk to everything. If you want to take the route of
working with contractors, you have to weight the risks for that as well."

True, I would just like to point out that hiring your own staff might no work
out either...

~~~
CaptSpify
Oh absolutely. The other side isn't necessarily better, it just comes with a
different set of risks/costs/benefits. You have to weigh those against each
other to see which makes more sense for your situation.

But if you take the less safe/secure option, you can't expect much sympathy.

------
Frondo
I used to feel strongly about not trading my privacy away for some
convenience. For a long time I took a luddite pride in not being on various
services, having a dumb phone, keeping it turned off, etc. Over time, though,
I've found myself having a change of heart. What started as little
inconveniences have turned into big ones, as I'm more and more out of touch
with my peers, contemporaries, and family. I don't like that. And for what?
Companies can still track me, my data's still out there.

But I still care about privacy. It's a basic human right. What I've realized
is that our laws are lousy at enshrining that right--companies can largely do
what they want, etc.,--and we're lousy as a society at recognizing the value
of that right.

So I'm curious, are there any cities, counties, states with any sort of
legislative efforts going on to strengthen the citizens' rights to privacy and
ownership of data? Is there anyone we can look to as a model for "privacy and
data ownership done right," something to work toward implementing at a
national level?

Is there any awareness group working to raise these issues in a way that's
actually accessible to the general public? (Are they doing a good job at it?)

I don't want to give up, and I don't want to check out. I like my shiny
devices and assistants now, they make my life easier in little ways all the
time. How can we balance that with the basic human right to own our data and
retain our privacy?

~~~
Paul-ish
> Companies can still track me, my data's still out there.

I don' think this is right. When you were being a "luddite" you probably had
less data collected about you, but you couldn't see that. All you can see is
the cool tech stuff you are missing out on, so you feel that keenly.

I think the reason a lot of people give up their privacy is that they feel
like they have lost it already, so they might as well "Get what they can" from
it. I don't think this is the right way to think about things. Not every
company is sharing data with every other company (yet), so each new
toy/app/gadget you used by a different company creates a new entry in some
database about you.

~~~
ACS_Solver
Yes, I think this is right. I have very privacy-conscious tech habits, and
companies have some data on me, but probably far less than on the typical user
of modern services. Some ways I protect myself:

1\. Google account - I have one because it's required for Android, but I have
never used Gmail, do not search from my Google account or ever log into it
from my browser.

2\. Facebook or any subsidiaries - never.

3\. General Web browsing - reject 3rd party cookies automatically, browse with
uBlock Origin, disabled JavaScript (via ScriptSafe) with selective enabling of
scripts, Privacy Badger.

4\. Only enter my real name online for things I explicitly need/want
associated with me. Only enter my real address if actually needed for a
delivery or other reason.

5\. My mail client is set not to load remote images, which protects me from
those 1x1 tracking images.

Many of these make the Internet a better experience, and certainly protect my
privacy to a large degree. Yes, corporations have some data on me, but not
much, and it's not all correct. I also don't feel I'm missing out on too much
cool tech stuff, a lot of the privacy-unfriendly stuff is entirely
unnecessary, for me at least, or replaced by alternatives that are not much
worse.

~~~
Sylos
> 1\. Google account - I have one because it's required for Android, but I
> have never used Gmail, do not search from my Google account or ever log into
> it from my browser.

I haven't run stock Android in a while (and instead just CyanogenMod), but I'm
pretty sure that it's not actually required, i.e. you can skip account
creation during setup and then install alternative app stores like F-Droid,
Aptoide or Amazon.

If we include CyanogenMod or other ROMs, then it's definitely possible,
though. I do own and use an Android phone and deleted my Google-account
probably half a year ago...

~~~
ACS_Solver
I also prefer Cyanogen, although I like having access to the Google Play store
even on that. While that's tied to my Google account, it's an informed choice,
I am fine with Google knowing what Play Store apps I have installed, and I use
F-Droid at the same time for some other apps.

One of the great things about Cyanogen is maintaining tight control even over
Google's apps and how much they track me.

~~~
ryukafalz
> One of the great things about Cyanogen is maintaining tight control even
> over Google's apps and how much they track me.

Are you sure? How much is Play Services tracking you?

I run MicroG on my own phone, personally. It's a FOSS implementation of (most
of) the Play Services APIs.

[https://microg.org/](https://microg.org/)

------
sounds
I'm waiting to see if this gets traction on HN. In case it doesn't, and so I
can propose something only to the few who dig to the bottom of the comments:

The problem is social. A technological solution will not suffice.

~~~
dredmorbius
I'd really like to see your extended thoughts, and this is getting better
traction than I'd hoped when submitting it.

I half agree with you: technological solutions _alone_ will not suffice,
though they may be part of the solution.

But additionally, legal reforms, economic reforms, and social reforms need to
be part of this.

Legal reforms to limit the ability of organisations to access, appropriate,
store, exchange, and act based on exfiltrated data.

Economic reforms, as noted, to change the business model of publishing from
ads-supported media.

Social reforms such that people push back on this. That's less a burden than
necessary, IMO, as awareness of the _scope_ of invasion seems highly
developed, though responses to that are presently limited.

In concert with the above, provided _and mandated_ technical means for people
to protect their information, and to keep corporations and other organisations
from grabbing and using it in the first place.

------
EGreg
I like Cory Doctorow. I really do, and I agree that this is a problem. But as
I argue, the genie is already out of the bottle, the cat is out of the bag and
the barn door is open. What we should focus on instead is mechanisms for
mitigating and punishing malicious use of data, AS WELL AS putting the
surveillance to good use, eg body cameras for on-duty police officers:

[http://magarshak.com/blog/?p=169](http://magarshak.com/blog/?p=169)

~~~
thisisimpo
With parallel construction and such, it might be hard to punish malicious
use...

~~~
hx87
Punish parallel construction, perhaps?

------
dredmorbius
My thought on this, for some time, has been that people need ways to
effectively express, legally and technically, their disagreement and
noncooperation with such terms.

An alternative model for funding both innovative reasearch and creative
content (writing, music, film/video, visual, and other arts) also seems
increasingly essential. Information _and culture_ are _public_ goods, and
cash-on-the-barrelhead (or bitcoin-through-the-anonymised-exchange)
transactions are largely not appropriate for them.

I am very much hoping this all dies in a fire. I'm increasingly concerned as
to just how all-encompassing that fire may turn out to be.

~~~
abstractbeliefs
Well, the most effective response is already here: don't use the service.

While that can be a big ask for many services, we're also doing a great job of
replicating the functionality of many closed services in an open way. As long
as the FOSS/hobby tech world still cares, we'll keep biting away at the new
markets closed services create.

~~~
AlexandrB
> As long as the FOSS/hobby tech world still cares, we'll keep biting away at
> the new markets closed services create.

I think _nibbling_ away is more accurate. There are still no privacy-conscious
alternatives to the big 3 social networks (Facebook/Twitter/LinkedIn) and none
on the horizon. Yes technological alternatives exist, but not practical ones
as I'm not likely to run into someone using Diaspora in real life.

This is similar to GNU/Linux vs. Windows on desktop where Linux gained a
little bit of market share but was never a real alternative when it mattered.
That defeat is all the worse in retrospect as Windows 10 is now a great vector
of privacy invasion for Microsoft.

From a social justice POV, "just don't use the service" may be practical for
those with a lot of education and opportunities for employment, but is a non-
starter for someone who needs LinkedIn to find work or whose landlord expects
to snoop through their Facebook account. We need a solution that helps
everyone, not just those with the know-how and economic freedom to use niche
alternatives.

~~~
tome
> There are still no privacy-conscious alternatives to the big 3 social
> networks (Facebook/Twitter/LinkedIn)

I'm not a member of LinkedIn so I'm constantly a bit confused by it. Does it
offer anything compelling besides a list of the places you've worked and
studied? Why couldn't I get the same benefit by putting up a static web page
with a content form? Am I missing out on something?

~~~
throwanem
Discoverability and messaging. If you like hearing from a range of recruiters,
putting a keyword-filter-friendly resume on LinkedIn is a good way to make
that happen. The quality varies pretty widely, but at least some of them are
worth talking to in my experience.

(Stack Overflow Careers is another good spot if you're interested, with in my
experience a lower incoming message rate but a somewhat higher average lead
quality, and none of the irritation that LinkedIn generally creates in its
users.)

------
gavinpc
Why doesn't Firefox ship with third-party cookies disabled? What would it
break that isn't user-hostile?

( _edit_ Chrome, IE, Safari, I understand, but privacy is one of Firefox's
main differentiators.)

~~~
craigsmansion
According to Gervase Markham of Mozilla: "If you believe you have a right to
access all the free content on the Internet while blocking the ads which fund
it, you continue to believe that [..]"

Mozilla seems to not want to interfere with online advertising practices.

~~~
Silhouette
_" If you believe you have a right to access all the free content on the
Internet while blocking the ads which fund it, you continue to believe that
[..]"_

Thanks, I will. I've been using the Internet since before online advertising
became a big deal. I've run web sites of varying scales, often with original
content, sometimes with original content that cost a lot of time and/or money
to produce. I've also contributed widely to many more web sites and other
online forums. I've paid for things online. I've charged for things online.

And I've never once, in all that time, relied on ads to fund any of my or my
various businesses' contributions.

Online advertising has served a useful purpose in some cases, and I sympathise
with those who have chosen to rely on it as a funding model and are now losing
out because of ad blockers and the like. But online advertising has also led
to huge amounts of ad-ridden junk clogging up any forum it can invade. It has
led to serious degradation in both the performance and the security of the
greatest information-sharing medium in the history of the world. Perhaps worst
of all, it has led to a culture where _other ways_ of compensating those whose
work we truly value and of discovering new material of interest are a lot
harder than they might have been. None of those are positive influences, and
I'm not at all sure that online advertising hasn't done far more harm than
good overall, even taking into account the great value that some ad-funded
content and services have offered to some people.

~~~
CaptSpify
[https://utcc.utoronto.ca/~cks/space/blog/web/AdSupportedWebD...](https://utcc.utoronto.ca/~cks/space/blog/web/AdSupportedWebDeathView)

> essentially all of the ad supported sites I visit are diversions

The web existed fine before ads, and could exist just fine (if not better)
after ads.

------
Sylos
I mean, it's already happening. People walk around with smartphones, tablets
and laptops which constantly record audio for their virtual assistants, and I
have not once consented to having my voice recorded by any of those devices.

~~~
shostack
Has this actually been verified that they are recording without people's
knowledge or consent and sending that data home vs just listening locally for
a specific wake up word?

Don't get me wrong... I think it is horrid and the trend is worrisome, but I
haven't seen conclusive proof this is happening yet.

~~~
TazeTSchnitzel
_Hey Siri_ is completely local. If you turn on Airplane Mode, it still works.

However, it can mishear you sometimes and thereby send a snippet of your
conversation to Apple, I suppose.

~~~
gnud
Also, Siri is a real name used by real people.

I would object less if the phrase was 'hey Apple-bot'.

~~~
yogiSays4words
Seriously

------
lloyddobbler
_> >When a backlash began, the app vendors and smartphone companies had a
rebuttal ready: ‘‘You agreed to let us do this. We gave you notice of our
privacy practices, and you consented.’’

This ‘‘notice and consent’’ model is absurd on its face, and yet it is
surprisingly legally robust. As I write this in July of 2016, US federal
appellate courts have just ruled on two cases that asked whether End User
Licenses that no one read and no one understands and no one takes seriously
are enforceable._

Just playing devil's advocate here - but I wonder if Cory has tried to claim
that he doesn't have to pay his mortgage because he signed a lot of legal
documents, but he didn't read or understand them.

------
pcunite
There is coming a point in time where every person must have a _mark_ in order
to buy or sell. It will be your access and citizen membership to a new global
order.

Enjoy your temporary freedom. History has a nasty way of modernizing itself.

~~~
jgaosgxy
Isn't this already happening? I got a tour from one of the techs at a major
general store on how they track users "to enhance user experience". It's both
impressive and terrifying. Using simple things like tracking the wireless
signals on your smartphone they can see exactly when you pass or enter the
store, which departments you visit and stay longest, etc. The system is even
linked up to a camera at checkout so they have your picture linked to all
other details they gathered.

In the country I live it's also very popular for every store to have their own
plastic card you gather points on at every purchase (e.g. for discounts or
freebies). This is an easy way of matching your purchases with all the other
personal information they gather.

~~~
TerminalJunkie
NY Times had an article in 2013 about this very thing. [1] But the amazing
thing was, when users/customers found out that they were being tracked and the
level of detail found in the tracking methods, some of them complained. They
were quoted as saying "creepy", and "way over the line."

If users knew how much of their entire lives could be pieced together by
browser tracking, cookies, and the same techniques that advertisement
companies use to target groups of people, I feel that they would say the same
thing.

[1] [http://www.nytimes.com/2013/07/15/business/attention-
shopper...](http://www.nytimes.com/2013/07/15/business/attention-shopper-
stores-are-tracking-your-cell.html)

------
filman82
Great illustration of the pervasiveness in personal data collection that IoT
will bring to our future. Check out ProjectVRM from Harvard
[https://cyber.harvard.edu/projectvrm/Main_Page](https://cyber.harvard.edu/projectvrm/Main_Page).
Vendor Relationship Management is a concept focused on empowering users in
their relationship with service providers. The basic idea being that services
(supply side) are in control of the relationship in Web and IoT services
today, but historically, control shifts over time to users (demand side).

"You agreed to let us do this. We gave you notice of our privacy practices,
and you consented."

The EU regards privacy as a right and the recently passed General Data
Protection Rule (GDPR) enforces this right for EU citizens worldwide. US
companies are slow to realize this and there will be a flood of litigation
from Europe against US companies that service EU citizens when this law takes
effect in 2018. GDPR implements many of the concepts of VRM and has the stated
objective of putting users in charge of their widely-defined personal
information. Consent has to be explicit and opt-in prior to collection, so IoT
companies would have to make sure that they either differentiated EU citizens
and required consent prior to capture or implement standardized policies that
respect GDPR across the board.

My thinking is that the disruptive companies of tomorrow will have user trust
and personal data collection transparency as a key differentiator. The problem
is that the technology to enable this easily isn't there yet. Privacy and
personal data management are complex and remain the domain of health companies
subject to HIPAA and European privacy wonks. My team is working on a platform
to bring easy and transparent personal data management (including consent) to
all services that collect personal information. Check it out - www.carbn.io

------
mathiasben
from the article - "Notice and consent is an absurd legal fiction."

it shouldn't be. "Notice and consent" should instead be a class taught in high
schools. The ability to read, understand and NEGIOTIAGE these agreements
should be within the mental grasp of everyone.

~~~
dredmorbius
There are far too many ToSes for any person to be able to _read_ them, let
alone _negotiate_ each.

This problem was solved in an earlier age of commerce through a Uniform
Commercial Code (throughout most of the US), or equivalent statutory or case
law in other domains. Essentially, contracts were reduced to a common set of
standard components. Exceptions might be allowed for specific cases, including
unilateral "contracts of adhesion", but these too were generally limited.

In particular, ordinary transactional terms are limited by:

1\. The scope and extent of the transaction. The term is for a single purchase
or transaction, not an ongoing "relationship", with few exceptions (utilities,
rental agreements, subscriptions).

2\. There's a limit to the data exchanged. In general, _the minimum amount of
data required for a transaction is what 's provided_. Even where personal
information was taken down, it was recorded on _and remained on_ paper forms,
rarely being converted to electronic form. This is no longer the case, where,
say, a license number (or a license held as surity) for, say, an hourly boat
or bicycle hire might be scanned electronically, OCRd, entered into a
database, and matched with other records.

3\. As noted above, information _one_ organisation gathered on you was only
rarely shared with others. This is no longer the case. As my awareness of such
practices has spread, I've become vastlty less interested in transactions in
which I'm aware my information _is_ being exchanged: magazine subscriptions,
credit or debit card purchases, anything with an email or postal code, etc.
For a good decade or more, I refused to sign electronic signature pads. I
still generally balk at this.

But until terms of service are _both_ standardised _and_ codified with users'
interests in mind, the present situation will only get worse.

~~~
ahartman00
I like the point about the UCC. I have thought about standardized contracts
myself, though I didnt think to compare it to the UCC.

"But until terms of service are both standardised and codified with users'
interests in mind"

But what about sites with a different revenue model? Say an image hosting site
meant for personal photos, and an image sharing site meant as a platform for
artists to sell their work. You would not want the former allowing any sort of
copyright transfer, but the latter cannot function without it(at least without
the ability for the site to take payment and provide a license). Im not sure
how we could standardize everything. Especially if consumers are not willing
to pay a subscription.

"In particular, ordinary transactional terms are limited by:"

1\. But this would be an ongoing relationship, assuming they continue to use
the service.

2\. Again, subscription fees would be needed to sustain the business.
Otherwise advertising is the only way. And there's an old joke in advertising:
half of all advertising budgets are wasted, the trick is figuring out which
half. I do see your point about a drivers license number not being needed for
a long period of time.

~~~
dredmorbius
There was an attempt to come up with a UCC for services, within the US, though
it failed to garner sufficient support: UCITA.

It's not clear to me how some breadth of interests couldn't be addressed. The
usual T&C generally address limits on liability of the site's owners,
occasionally try to impose binding arbitration or limits on class action suits
(among my complaints against the so-called "Kinder, gentler Reddit", Imzy),
jurisdiction, reverse-engineering clauses, etc.

Allowing users to specify licenses for submitted works would address much of
your concerns. A standard set of merchandise clauses, including, say, escrow,
liability, and chargeback terms, might be among the boilerplate _additions_ to
a standard contract which might be made.

But the point is to make the contracts themselves standard and modular. There
might be a base services contract, a base merchant contract, and a base
rights-for-sale contract, but not infinite variations on each. Also limits on
what sites or users might carve out as grantable or transferable rights.

My point in noting that ordinary commerce is limited to a single sale
transaction is just that: that these are simple _transactions_ and hence the
associated legal binding is also simple. Ongoing relationships are inherently
more complex.

There are alternatives to advertising and subscriptions, including non-market
constructs.

In the example I posed, the value of the drivers license as a hire surity is
that the hirer is quitely likely to return for it. The disadvantage, today, is
that the license has not only the attributes of "valuable to the owner", but
"hive of data which can be used to draw additional relations".

Some years ago I discovered that the purchase of certain over-the-counter
medications required, by store policy though not by local law, presentation of
a drivers license. I held up my license for the clerk to visually examine. He
tried to take it from my hand, which I refused. He wouldn't close the sale
without scanning the card. I walked off without paying and without product.

I've been insisting on respecting my privacy rights for some time, and am not
above forgoing business, taking my business elsewhere, or making others
pointedly uncomfortable for asking questions I won't answer. Sadly, I am an
exception.

------
cassy500
if you need a professional hacker for various hacking needs, i recommend
globalhackteam34@gmail.com. they render a very good service and they are very
good at hacking various things, phones,Facebook, whatsapp, twitter, calls,
emails, websites, social medias and many more. i have used this service before
so i vouch for them. here is their number you can call or text +19542719191

------
Mendenhall
Its way too late, the war is over. Wait till you see what they are going to do
in 50 years with all this info and capability.

------
mtaksrud
This
[https://en.wikipedia.org/wiki/General_Data_Protection_Regula...](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)
will hopefully help when the grace period endes in Q2 2018.

------
miesman
"If you want to opt out that is fine. You can just toil in the hinterlands,
and die young"

[https://www.youtube.com/watch?v=lMChO0qNbkY](https://www.youtube.com/watch?v=lMChO0qNbkY)

------
j2kun
> However, there’s nothing intrinsic to self-driving cars that says that the
> data they gather needs to be retained or further processed. Remember that
> for many years, the server logs that recorded all your inter­actions with
> the web were flushed as a matter of course, because no one could figure out
> what they were good for, apart from debugging problems when they occurred.

Clearly someone who doesn't understand how machine learning works. The
"further use" of the data is obvious: to train and improve the driving
algorithm.

------
bogomipz
The author states:

"Every page with a Google ad was able to both set and read a Google cookie
with your browser (you could turn this off, but no one did), so that Google
could get a pretty good picture of which websites you visited."

This is how cookies work. What is unique in this in the context of Google?
Google didn't invent cookies. What am I missing?

