Everybody’s worst nightmares when it comes to surveillance keep coming true. I’ve started to suspect the “I got nothing to hide” attitude that many privacy advocates criticize is at some level a defense mechanism for the realization that you’re completely owned and completely powerless. In other words, they know that if they really sat down and thought about what was in their Google searches, DNS lookups, or credit card purchases they would be very disturbed, so they choose not to think about it to maintain sanity. People are smarter than we give them credit for.
Because many on HN know and consciously recognize the facts here, my question would be: how do you all cope with surveillance?
I'm not seeing the problem. The feds got a search warrant to find searches for the term "guccifer" from before the term existed, and got a direct hit on the actual culprit. Not some kind of dragnet at all.
The affidavit does not say these were the only Google records, and the rest of the thread in the link talks about how this information was already public knowledge at the time.
Seconded. Essentially hope that you’re such a small fry the machine won’t turn it’s gaze on you. Trying to vote for people who will curb it’s power and support those who blow the whistle or sound the alarm.
Are we really that lacking in creativity that we can't imagine a world in between "Panopticon" and "Oregon Trail"? Legislation that makes this illegal would be a great (and really easy) start.
I disagree with legislation being an easy path forward. legislation takes a long time. for example, we are 12 years into jewel v. NSA. even if you do change the law, lawmakers can create (and other governmental bodies can apply) other, conflicting law. it's very cat-and-mouse in the age of the PATRIOT act, secret courts, etc.
Agreed. Legislation will even take an infinite amount of time to pass when the political parties in power don't want to pass it (despite any ineffective posturing to the contrary).
A court case in the judicial branch does not in any way speak to the difficulty of enacting legislation the legislative branch. Our system of government intentionally separates the creation of laws from their interpretation.
It’s really not that complicated. If sufficient political will existed to enact stronger clearer privacy protections, legislation would be drafted and approved rapidly, and there is no reason Generating that political will is another matter.
> Legislation that makes this illegal would be a great (and really easy) start.
Legislation is really working right now, with Congress sitting on 400+ bills and refusing to vote on them, and with known members of the government, including the actual President of the United States of America, committing crimes and the top law enforcement agent doing worse than nothing about it.
Laws work in a society that values them. Once you throw that away, your authoritarians will do whatever fits their needs. And surprise, the authoritarians are doing just that right now.
Careful in speaking for 'everybody' - because I would imagine in many cases, 'most people' (though probably not 'most HN-ers') are fine with the rules in places so long as they are civic and actually followed, i.e. oversight, Judicial warrants, proportionality etc..
There are absolutely issues of legitimate natural security for many things, then it becomes a matter of how we balance privacy vs. the functional needs of the community.
If the FBI legitimately discovers some crazies trying to make a nuclear bomb, I can imagine a Judge authorizing some kinds of searches which would not otherwise be allowed, and that 'most people' would find that justified.
Of course, widespread surveillance, especially of the arbitrary kind (i.e. catch-alls) and information gathering relegated to local-yocal Police Forces, probably are going to be problematic in the view of 'most people'.
And of course, there is the big hypocritical fact that bothers me a lot about this: that Google, who has absolutely no interest other that 'profit' seems to get a free pass on a lot of things while a national security apparatus, who's objectives are entirely in the realm of 'public service' - even when we don't always agree what those objectives are - are somehow more cynically scrutinized.
So the question is: how much of a threat is Guccifer, and what are reasonable means that we can use to go after him? Which will probably always be a hard question to answer.
I think the reason most people are fine is because they don't see the danger or don't feel that it's real. It's the "it won't happen to me" attitude. But when someone innocent gets caught up in it, then it's too late and there's no remedy.
Like, what if someone finds out they support BLM, drink cola, shop online, and watch movies over the internet, ... oh the horror!
My impression is half of HN are into some sort of espionage or something. 50% of people's darkest secret is they sniff their hand after scratching their arse; and they do that in front of everyone without batting an eyelid.
"But what if they get caught up in something", like what, the scandal over who ate the last snack in the break room?
There are places in the US where one can face significant discrimination (and danger) for being gay or trans, or for questioning their religion. While I'm not as extreme as many on HN about the issue, there are real privacy concerns for many people.
I'm not doubting some people have secrets that they genuinely need to keep, some people are honest-to-goodness terrorists, for example.
Just the narrative that suggests all people should be worried about secrecy; I'll warrant most people's secrets wouldn't cause enough of a stir to dissolve a sugar lump in a hot cup of tea.
You're warranting that, but since you don't know people's secrets, how can you possibly make that determination? With some creativity I can think of many wonderful ways to find out and construct monsters of relatively minor things - the conversations people are willing to have in private are massively different from what they'll go on record saying. How can you not have encountered this difference? Can you really not imagine how even the most innocent of statements or criticisms can be construed by a paranoid power in the worst possible light?
>since you don't know people's secrets, how can you possibly make that determination? //
It's a conversation. You can tell me everyone you know has secretly murdered at least one person and progress things somewhat (I'm being flippant, of course).
Saying things in public is not "being on record" though. Someone has to make the effort to look up about you, and we all wore a stupid costume, got drunk and made a pass at someone, dropped some litter, swore, or whatever ... in a Western Democracy are you going to shame me for normal behaviours, I think you'll struggle.
>Can you really not imagine how even the most innocent of statements or criticisms can be construed by a paranoid power in the worst possible light? //
Yes, what's the motivation? Fascist takeover? We're all in the same boat aren't we: OMG my neighbor looked at porn, let's burn him at the stake??
Sorry, I'm not interested in you making a determination that the private lives and conversations of others are similar to yours, nor do I accept any premise that simply because you've judged people to 'not be terrorists' and the risk of governmental abuse to be low, that there is no real risk of agencies abusing such data. Your justifications are personal, and frankly, should have no bearing on other people's lives. If you can't imagine real cases of private conversation (or DNS lookups, or whatever) being used to profile and target particular groups for fairly undemocratic reasons, then that's a failure of your imagination. We are not all in the same boat, especially if by 'boat' you mean we all socialise with the same people, have the same political beliefs and actions, or even share our sexual orientation.
Mind posting a picture of yourself, from the front, fully nude? And your home address, or at least zip code, too. Shouldn't take too long to do. Not picky about quality, either- a phone camera will be more than fine. But make sure your face is in the shot, of course.
If you don't want to post it publically, let me know and I'll create a temporary email to send it to. I'll be sure to delete it after verifying it.
...
Do you feel disgust in reaction to that request? I suspect most people would.
But why? It's not like it's anything sensitive, like a password. I mean...if you don't send the picture, what are you trying to hide? Are you a terrorist? I'm not even a government agent- I don't have the power to throw you in jail.
But, turns out, even when you don't have anything to hide, there's still some things you don't want to share. That's just human.
What do you consider secrets people genuinely need to keep? And who determines what is considered genuinely need to keep? Also telling you jump directly from genuinely need to keep straight to being terrorists.
Secrets don’t just need to be incriminating, they can also just be embarrassing. People don’t want the world to know they are secretly seeing a lover, or watch a specific type of porn or spend half their time at work browsing HN. Some of those will have real life ramifications.
C) an activist for a movement the government doesn't like?
D) a supporter of C)?
There's also the problem of selective enforcement. Nearly everyone has done something wrong at some point, even if it was a minor traffic offence. If surveillance is good enough, the government will have dirt on close to 100% of people, leaving it in the position of being able to dig up decades of minor offences whenever it doesn't like you.
Selective enforcement is the big one. Our society simply isn't suited for everyone knowing what everyone else is doing. Even if our laws somehow didn't suffer from selective enforcement, people who find some (legal) things that you do immoral can still use that to justify trying to harm you.
I challenge anyone who claims they have no secrets to upload all their cloud files and hard disks inc. browser history and cookies to a s3 blob and share a link on HN.
The reason people are 'fine' with it, is because it's a rational response to a real concern.
Guccifer was hacking into people's accounts, revealing information of a national interest.
So there is some proportional reaction by law enforcement.
"But when someone innocent gets caught up in it, then it's too late and there's no remedy."
Who are these innocents 'caught up in it', for which there 'no remedy'?
It's possible investigators make mistakes while matching DNA just as well, but we don't deny them the right, because it seems the 'science' supports DNA as evidence. So we use it.
I think that is a real but smaller concern - bigger concerns are large dragnets (arbitrary data collection), lack of oversight (no warrants), lack of proportionality (i.e. local Police getting access to all your searches because someone made a 'noise complaint'), and politicization (i.e. Trump getting search records on political enemies etc.).
Personally, I don’t care about what a computer system does with my data (to me, that’s no more bothersome than my underwear seeing my genitalia), but I do care if humans get to look at it. So overall I’m fine with what Google does, but bothered by government spooks looking through my data. I’m okay with humans looking if there’s a process with oversight limiting the search only to what is necessary. From this perspective, I don’t think Google harms my privacy much. I think the biggest privacy risk to me personally is probably from breaches/leaks (eg. if I gave my emails or messages to some dodgy service, and they end up on pastebin). To protect against that risk, I want entities that hold my data
to have strong controls, and I think Google clears that bar.
Personally, the fears around privacy are about harm being done to myself or others with my data. Google would be fine, except that big tech companies like Google sell your data to advertisers, who then use that data to coerce you into buying products and services that you might never have purchased if left to your own devices. That crosses into 'harm' territory.
For a more clear demonstration of harm, think about Facebook and Cambridge Analytica, and the very real and tangible effects that scandal had.
I block ads, and Google doesn’t actually give your data to advertisers, so they don’t get anything from me. Just another case like my underwear seeing my genitalia, to my mind. Computers taking to themselves while I go on living my life.
Cambridge Analytica was a serious problem, although I thought Facebook had cracked down on that kind of thing, and Google did much further in the past.
Re google vs state scrutiny specifically - the big difference between the two - one has an exclusive right to use physical force against individuals, another one - does not.
You're right, but then you have the problem of credibility. If Google's records are credible for this, then what's the chance that somebody will notice if some of those records are manufactured? It's like forging signatures - it's a problem because we trust signatures to some extent.
I don’t think the argument generalises quite that far, but it does go as far as “more information is worse.” The presumption of innocence is a valuable principle to which this applies. We ignore evidence that suggests that someone is guilty of a crime until the court process has finished, and if they’re “probably guilty” we say they’re actually “not guilty” for fairness reasons.
Police can and have forged evidence without having to resort to forcing a company to do so. The latter is more risky as there is a greater likelihood of a leak.
* Scene opens with two federal agents discussing a new case *
Agent 1: There was a shooting on 5th st.
Agent 2: Just use the phone records to look up everyone in the area and then arrest them at their work in front of their boss.
Agent 1: It's ok to do this because the innocent will surely have a way to prove their innocence.
Agent 2: But what if it looks bad that we are arresting so many innocent people?
Agent 1: In every legal system there are always more crimes than can be prosecuted. The discretion of prosecutors is an important legal function. If we arrest someone embarrassing, we'll just find something to charge them with.
Agent 2: Yeah and contact with federal agents also _generates_ more crime, like lying to one of us is a felony, right?
Agent 1: Hope they have the $250k it takes to defend against a federal felony.
In this situation, the privacy violation of becoming a suspect via location history is an utterly negligible problem. What you describe could just as easily happen in a traffic stop (and in fact probably far more likely).
But I think the point being made is that part of the issue is lazy policing/detective work. The concern about privacy is really about the concern of __abuse__ of data. Why many of us want to protect our data is that we do not trust those in power, nor current nor potential future rulers (a big concern). Such instances as the above example are abuse of that data, as well as abuse of power. The thought is that if they are going to abuse us, we're going to make it more difficult. Dragnet operations make the above easier, not the same level of difficulty.
Bad cops are going to be bad cops regardless of the tools you give them. That isn't to say privacy is not a problem, just that I don't think privacy is the primary problem in your example.
Give a bad cop a swat van and they'll raid a teenager's home, kill their dog and brother.
I'm tired of this binary perspective. It is common but in bad faith. The tools matter. Different tools enable different levels of abuse. Yes, cops shouldn't abuse citizens and we should do our best to stop that. But do you expect to find a perfect solution? If not, then we should also ensure that when a bad cop slips through, they are limited in the damage they can do.
You are reading way too much into my comment. I was directly speaking to the example given and not making some universal endorsement of empowering cops.
There was nothing in that example that was specifically linked to data collection. You could have had the exact same situation except they are rounding up Black people as suspects. The problem there is bad cops not dangerous tools. The tool is irrelevant in the example.
Nevermind that it had a good end. Recognize that even though there was reasonable doubt as a near impossibility of this man being guilty, the prosecutor still desperately tried to throw him in prison, despite him obviously being the wrong person and the prosecutor almost succeeded!
An amazing reason to never, ever, believe or trust policemen or prosecutors if you're ever on a jury
> But that wasn’t enough for the LAPD and the prosecutor — who had never lost a case and was going to push for the death penalty for Puebla’s murderer.
He did get some compensation:
> In 2007, Juan received $320,000 in a settlement of his civil lawsuit against the LAPD and the city of Los Angeles for false imprisonment, misconduct and defamation. (In 2008, gang member Raul Robledo received a life term for the murder.
But it's outrageous we, the taxpayers, have to pay for police misconduct. Let it come out of their pension fund (and reduce their pensions accordingly).
Data leads to control (in the extreme case, the government knowing all your thoughts can pretty much control your life). Sometimes this control is warranted, like using anonymized data to prevent crimes, with a panel of independent citizens auditing the access to make sure it is benefiting the society at large as opposed to a minority. But sometimes it can be used nefariously. For example the state can push propaganda based on the private data of the citizens, making the government less democratic over time to promote the agenda of a minority. My position is we don’t trust that use is legitimate, and don’t assume that states access to private data is in the benefit of the citizens. The government is always assumed guilty until proven innocent.
> If someone wants to home in and destroy you, they've always been able to do that without total surveillance.
This isn't even about that. Yes, if someone powerful wants to make your life hard, your life is going to be hard.
Now consider what happens if they just don't care whether you live or die. Some system is set up to "solve crimes" as "efficiently" as possible. The same sort of system that gets used to issue YouTube copyright strikes against the original creators or public domain works because Hollywood put a copy in a motion picture, or mark every email sent by a perfectly legitimate small private email server as spam.
The police increase their "solve rate" dramatically -- by putting a ton of innocent people in prison. Because now instead of unsolved crimes they have "evidence" which, even if it's all circumstantial garbage, is enough to coerce guilty pleas out of defendants who can't afford a good lawyer or don't want to risk having the penalty quintupled if they demand their day in court and lose, or would rather spend six months in prison than pay six years worth of wages to a lawyer.
> If the records exist, and you're not guilty of the crime, hope exists that you could be cleared.
Only you can't get access to the records, because they're sensitive for all sorts of reasons, e.g. because having them in the aggregate would allow you to locate people in witness protection or unmask undercover law enforcement or case targets for espionage or theft. So you can't give access to everything to everybody, which means it only gets used as evidence for the prosecution because they can get it and you can't.
> Doesn't it make more sense for one's worst fear to be accused of something for which you are innocent but have no alibi?
In principle they still have to prove your guilt even if you don't have an alibi. Think about it, a large proportion of crimes are committed at night when most people are at home asleep.
Meanwhile, data under your control is generally only useful as evidence of guilt, because otherwise they just argue that it was under your control. If your phone was at the location of the crime, they argue you were there. If your phone was at home 200 miles from the location of the crime, they argue you knew you were about to commit a crime and left your phone at home. It's used to hurt you but not to help you.
As an Aussie it's becoming increasingly clear that my wish to run my own servers in order to maintain some semblance of privacy is quite likely going to become a massive liability to my freedom, if the current state of affairs continues much longer.
To be clear, by hosting a website I'm liable to "authorities" wanting to access everything anyway. By using a website in this increasingly fascist world, it becomes increasingly likely that my websites/mail servers will look "interesting", simply because I'm not "toeing the line"
Court orders are a last resort. Often, law enforcement will just ask providers to kindly share the information they want access to, and the providers comply. No warrants needed.
"Asking politely" is a euphemism. The company has a desire to receive government contracts, or to not be subject to adverse regulations, and is thereby given the choice to submit or be the subject of retaliation.
In reality it's an end-run around the court system. If the government officially penalized them for not complying, various parties would have standing to assert their rights. So the punishment isn't officially tied to the failure to submit, but the threat is still there.
I think it is more complicated that. It's more like asking your neighbor to borrow some sugar. Nothing nefarious, but your neighbor might later ask to borrow your ratchet set. The concern is how strong is this relationship and if there is real quid pro quo going on. It gets gray real fast when you are your neighbor's boss and control his raises.
"Oh, your new office building looks nice. Did your construction firm get all the necessary permits? Are you sure? All of them? Oh, and I see you have a lot of new employees. A lot of them. I bet it would tie up your HR department for quite a while if the INS came by and requested documentation that all those employees are authorized to work in the US, wouldn't it?
"Anyway, I've come to ask whether you could do a favor for us."
In Australia, you currently just have to suggest a peaceful protest for a search warrant to be issued against you. There are quite a few people who've been dragged off because of this. It's my understanding that everything is collected and analysed during these searches.
> is quite likely going to become a massive liability to my freedom
Compounding this is the advent of “hate crimes”, or rather the utterance of forbidden words. Now a days you can be hauled off in jail in many countries simply by expressing a wrong opinion, let alone hosting a service where others are allowed to do the same.
I can't possibly imagine why people might be upset by the "utterance of forbidden words" like "<insert slur>s like you deserve to be murdered by the state" and want legal protection from it.
You mean authoritarian world. Most people couldn’t name one tenet of fascism regarding finance, labor, etc.
Fascism is financially left wing but socially right, which is the opposite of liberal capitalism—regardless of whether the capitalistic govt is authoritarian.
yes I realize most people use it as a buzzword. And no I don’t want an authoritarian govt.
Let them work hard even if you have nothing to hide. I'd refuse to disclose any private info up until the law requires me to. Intimidation is a trick they use to cut down on work.
Encrypt everything. We know they keep copies of encrypted data for a long time hoping for the day that breaking the encryption becomes easy for reading later. In the meantime, flood everything with mundane data, but encrypted. Make it expensive for them to keep it all, and the an absolute waste of time when they do get it decrypted.
> I'd refuse to disclose any private info up until the law requires me to.
This doesn't work as well as you'd expect.
I know Queensland law requires you to unlock your phone for a cop, or you face prison time. I'd expect there's similar laws for disclosure of encryption keys.
I don't know if I'm willing to "make it hard for them" if that means facing jail time.
>Judge North’s comments do make it clear, however, that if you answer questions where you acknowledge ownership of a mobile phone, then there is a potential for self-incrimination.
Could the answer be encrypted hird-party de-centralized mini-services being sprinkled accross various locations through-out the world? Perhaps the "authorities" would be able to crack one such mini-service, but it would never get them all due to how it limits jurisdictional access. I'm just thinking out aloud... Does things like this already exist (outside TOR nodes, of course)?
Only if it becomes ordinary to use such a service.
TOR protected the spies it was made for, only because there was a substantial amount of other, less interesting, traffic.
The mere act of straying outside the norm is what makes you vulnerable. Protecting the data itself is secondary to making the data seem uninteresting to begin with.
That's quite hard because it is lack of motivation for people to build such mini-services with risk of being sued. It is quite easy to get some illegal stuff when you host a service without review which is almost impossible for individual service provider to do.
There is one way which may reduce the risk. Build your whole system in RAM including OS. When totally power off, everything is volatilized. To lower the cost of RAM, one could just put the OS and service in RAM, but let the encrypted data in drive with key in RAM/RAM-disk.
The difficulty here is building a OS in RAM. There are some tricks but most of them need a host which may contribute to vulnerability.
It is a combination of feeling powerless and feeling afraid.
The majority is more afraid of what will happen if the government does not find the information to catch the person trying to hurt them, than they are about the government finding information about them and hurting them with it.
Remember it is majority rules. Not even 80/20 but 51/49. You only need 51 percent of people to have less to hide. And people in the majority are typically not the ones that have things to hide for legitimate reasons. It is the people in the minority that are innocent of any wrongdoing , but be undesirable for some reason, that have something to fear.
Not OP, but at least in oz we live in a representative democracy. That means that though 51% may support the current government, any one piece of legislation only needs to have the support of the majority in parliament. It could have zero support in the community.
It happens often enough when people are polled on the legislation itself, rather than party preferences, people overwhelmingly support positions which may even be antithetical to both sides of parliament. Climate change legislation has enjoyed overwhlming support in oz for years, even amongst a slim majority on the right.
People overwhelming support environmental protections. But our parliament this week, under cover of covid, pushed through a massive regression in environemntal protections without even letting their own party discuss the legislation, let alone the opposition or the media.
> The maps have exceeded their designers high expectations all decade long. In 2018, for example, Wisconsin voters re-elected a Democratic U.S. senator, backed Evers for governor over two-term Republican incumbent Scott Walker, placed Democrats in every elected statewide office, and preferred Democratic assembly candidates by a margin of 190,000 votes. Republicans held the chamber, 64-35. They won 64 percent of the seats, with 46 percent of the votes.
It would be difficult to call Wisconsin a democracy with a straight face at this point.
> [in 2018] They [Democrats] won 53 percent of the vote and only 36 percent of the seats. However, that can be explained in part by the fact that Democrats had far more seats in which they weren’t running against a Republican opponent. Nearly half of the votes the Democrats earned were in districts where their candidates didn’t face significant opposition. In contested races, Republicans won more votes than Democrats.
If you get 90% of votes for one seat where there is virtually no opposition, that has no bearing to the other seat where you lost 48% to 52%.
That's actual democracy, and even direct democracy. This is also confirmed by the 17th Amendment:
> Legislation isn't based on majority votes though...
This only makes it worse. This year 51% of the population voted for Party B, so they have 51% of the legislature. They vote as a block, so they vote in anything supported by the majority of the coalition that Party B represents. So then you get bad laws that are only supported by 26% of people (51% of 51%). Next year Party A has 51% of the legislature, but not the Presidency, so they can't repeal it.
A possible solution to this would be to allow for the repeal of any law that wouldn't currently have what it takes to pass, i.e. anyone can resubmit any existing law as a new bill and if it fails to pass both houses and earn the President's signature, it effects repeal of the existing law.
It's even worse then that. The parties aren't even majority rule: everyone compromises on some issues, and is forced to select based on availability (which is determined by financials not democracy) and fear of the other side rather then positive belief, so I would argue that 26% is likely closer to 10% or less for many issues.
And then of course there is the large chunk of people who find the views of both parties so uninspiring or outright disgusting to not want to vote at all.
Its really surprising when any popular legislation is passed in any form, even watered down, in this mess of a system. Obviously though that is by design.
There can be filters and data can be anonymized, with all access recorded and audited by an independent panel. However that is not the current state of the surveillance state in the US. I think the majority would poll for the system with the safeguards in place as opposed to the current system that relies on trusting the state. Also the damage can be more subtle like the state pushing propaganda based on the private data of the citizens.
Right now we habe regressive privacy, where people with more power have more privacy. We should have progressive privacy. Power over others is power to hurt others, and for a democracy to work, such power must be tempered by transparency and oversight, while the default for the masses should be strict privacy protections.
Federalism was about ensuring a very specific type of majority minority balance was kept, and is weak in most cases, and checks and balances in the USA broke down the moment ideologically coherent parties became a thing, exactly as had always been feared.
I'd like to see polls on that. From what I've seen, people who worry about their privacy do things about it (like avoid google, pay cash, etc.) while people who don't care about privacy put evidence of their own crimes on facebook like idiots. Painting everyone with this giant brush of hypocrisy is over-simplifying a complex mix of people.
Its been 1.5 decades since the patriot act of the same rehashed tropes and fear mongering. Most citizens accept the high level surveillance for high level hackers and criminals. The fear of ‘they’re going to track Joe Schmoe to a strip club and ruin his family life’ hasn’t come close to materializing. Call us when it does. Until then, the dialog between elite tech bubbles like hn or slashdot of 15 years ago and the rest of the country won’t be productive.
This is the point the tech community needs to focus on. If we want the general public to care about these issue, we need to communicate the repercussions in ways that doesn't just allude to the ideals of "freedom" and "privacy". You need concrete examples of how this can and will go wrong in the short term for normal law-abiding citizens and they need to be scarier than "the government will know your porn searches" which clearly hasn't motivated anyone.
> I’ve started to suspect the “I got nothing to hide” attitude that many privacy advocates criticize is at some level a defense mechanism for the realization that you’re completely owned and completely powerless.
Based on what? Why is it so hard for everyone to believe that the regular public, who haven't spent much time thinking about the complex implications of the eroding of privacy, just doesn't care that much? If they think about it at all, they calculate that is extremely unlikely it will ever negatively impact them.
Whether they're right or wrong, that's what they think. Now what makes you think they're actually being driven by some kind of defense mechanism?
I spend most of my free time on my homelab and figuring out self-hosted alternatives. For everyone of us that does this and tries to fix a bug, report an issue, write some tooling, or add some tutorial for open source projects, the lower the barrier for others.
For each of us that runs their own physical servers (and make your less technical friends use them!) we grow stronger.
Use matrix.org (or whatever you believe in), self-host email, promote cryptocurrency.
I don't know. It's not as easy to set up as Whatsapp, where you just need your phone number and everything else "just works", and doesn't have the added functionality of Discord, with custom emotes, voice and streaming and servers to effortlessly participate in multiple communities with their own separate channels. My family keeps messaging me on whatsapp because that's where all their friends are and they don't want to switch apps just to talk to me, and my friends are far more comfortable with our online hangout space being discord instead. Element is still rough as a client, and for my self-hosted homeserver I had to put in a couple hours to get video and voice calls working. Unless Matrix magically becomes 10x as polished within a couple years I don't see it becoming popular outside privacy enthusiasts.
So maybe it's two years. Or three. But I think we'll get there at some point. A beauty is that while they do have funding, everything's done in the open and it's not a VC-funded company that's gonna drop the ball once they get acquired by someone who ends up killing the product or taking it in the wrong direction.
The more we try to use it, the faster that will happen. Meet someone new and if you're going to stay in touch, propose Matrix as your first preference and eventually settle on what both of you feel OK with. Every little bit helps spreading awareness and eventually adoption.
I don't see why Discord would be the first of its kind to be that big eternally.
I advice against them, generally. Only if transactions in your country are severely limited, but then you live in an unfree country already. Cryptocurrencies have a tendency to be abused for speculation, and are bad for the environment.
My worry isn't my own government; I'm worried about [some] other governments, and very large corporations.
I can’t understand how one can care about privacy for communication but not when it comes to money.
Money is a means of communication; we use it as a medium and metric for communicating value.
Unless we have truly fungible cryptocurrency as an alternative to corporate or government digital currency, all our private finances are inseparable from the surveillance machine that is now slowly emerging from adtech and fusing with capital control/KYC/AML systems.
Don’t look at where you are today, but where we are as a global community in 10 years.
The only trail it leaves is to financial institutions (who can see the transactions), and the government. The former need to be held accountable by law, by the latter. I believe the GDPR may aid us there.
Now, in a free society, I don't see a good reason why one should be afraid the government can snoop around my financial transactions. I believe I currently live in such a free society. If I want, I can buy a dildo or latex costume in an Amsterdam sex shop within an hour tomorrow, and I am not going to have to be shy about that. I don't live in a country where, for example, gay people get beaten up regularly. I'm not gay myself, btw, but I've experimented a fair share with my sexuality when I was younger. I also used to buy legal drugs online, and I just paid by IBAN. Do I want my employer to know such? Well, I'd like to have the choice to do so, and I have this choice as it is.
I can think of some very good reasons to use cryptocurrency in my free country, and none of these are valid from a legal PoV (avoiding taxation, buy illegal drugs/weapons/etc ie. criminal behaviour). By using cryptocurrency where other means work perfectly fine, I add noise to the cryptocurrency data, and it isn't in my interest to add this noise as I am not a proponent of things such as avoiding taxation or criminal behaviour.
Furthermore, nothing what you say addresses the other points:
> Cryptocurrencies have a tendency to be abused for speculation, and are bad for the environment.
These cons still exist, and need to be put on the weight with the privacy aspect. Which can be a valid argument in an unfree society, such as for example Belarus or China.
The FBI can't see what you searched for without a warrant. They can find out that somebody searched for dcleaks, but they can't find who searched for dcleaks unless they have a warrant for the specific user. This isn't my worst nightmare, not even close.
The US intelligence community agencies can access the data directly from Google via PRISM without a warrant, correlate it with their stored XKeyscore/MARINA data, and provide that to the FBI for parallel construction.
If you read a number of federal search warrant applications, you will see how flimsy and inaccurate they often are. Judges aren’t in the habit of saying no to the FBI very often.
> In response to outcry over PRISM, the U.S. director of national intelligence has released some details. Among other things, he says the government "does not unilaterally obtain information from the servers of U.S. electronic communication service providers" and that PRISM-related activities are conducted "under court supervision."
“unilaterally” is how the first is true: the providers participate and generate the data dumps for them. “supervision” is how the second is true: supervision is NOT a warrant.
You have to be careful with the wording. I never claimed they had direct access. PRISM is a program that allows them to download account contents via a special app, which is integrated by these companies, with the cooperation of the companies participating.
Google joined the PRISM program on 14 January, 2009, and were assigned the identifier prefix P3.
PRISM collection does not require real search warrants, as it falls under Section 702 authorization, authorized by congress in 2018 until 2023 presently.
They do indeed get the account information downloads directly from the participating companies. They do not have direct access to the companies’ servers (outside of the servers that run the PRISM integration, and perhaps not even direct access to those other than being able to submit PRISM data request jobs).
The net effect is the same.
Note that being American or being located in the US is insufficient protection against PRISM due to the way Section 702 works in practice as applied by the NSA. This is one of the reasons cited by Snowden about why he came forward: this secret new interpretation of FISA gutted previous warrantless search protections for Americans, sidestepping them entirely.
> PRISM is a program that allows them to download account contents via a special app, which is integrated by these companies, with the cooperation of the companies participating.
The FBI sends a data request for specific accounts' data to the data provider. The data provider's lawyers review the request and if nothing is amiss, they configure a wiretap on those accounts that sends data to the FBI. http://www.nytimes.com/2013/06/08/technology/tech-companies-...
> Note that being American or being located in the US is insufficient protection against PRISM due to the way Section 702 works in practice as applied by the NSA.
Huh? There is no secret interpretation that allows Section 702 requests to violate the Fourth Amendment. The only program in Snowden's leaks that illegally collected Americans' data was the phone metadata program.
>Because many on HN know and consciously recognize the facts here, my question would be: how do you all cope with surveillance?
I also had this "I've nothing to hide instance" - not that I don't have my own nudes on my phone/Google drive/WhatsApp/telegram but because I know there are very corrupt people whoes greed knows no limit.
Surveillance is obviously going to harm my privacy but I am prepared to give it away for greater good atleast the terrorists and other corrupt government officials will not be able to hide behind the privacy which commoners have demanded for themselves.
This is an actual privacy concern. I often see people here on HN take issue with sites recording how much you spent on the page and which products you clicked - for marketing purposes, I have nothing to hide here. But the emails and searches is a different thing.
Is it? There's nothing in this disclosure that says they were fishing. It just says they identified the searches. It's entirely conceivable they had referer logs from the Guccifer site showing hits from Google at specific times and subpoenaed all correlated searches. Law enforcement being able to retrieve this kind of information when it's part of a legitimate criminal investigation is good. The worst nightmare is that broad powers get abused but in this case they caught the right guy.
Is this not the FBI's own report? Why would they admit to something of questionable legality? That's like trusting the internal investigation from a police department.
An internal investigation from a police department should be conducted by a department which is not directly related to the people (police officers) who are being investigated. The reason for this, is to avoid conflict of interest. If such doesn't happen in your country, that makes your country less free than it IMO should be, but don't assume its like this everywhere in the world.
OP seems to be implying that this disclosure is incriminating of some kind overly aggressive search tactic. I'm saying it doesn't seem to imply that at all. This isn't proof of their innocence, it just isn't proof of their guilt. They _might_ be guilty of something, but there's currently no reason to think that.
Even if it just for one person (which does appear to be what they asked for to me), asking for their entire search histories from all their devices seems like fishing. Particularly since they used it to charge him with new crimes (lying to FBI, etc) rather than the crime they were supposedly searching for.
No. That's SOP. If someone is a suspect in a serious crime, they'll search your house, your car, your office and subpoena your phone records. And this was a national security case so you know they're going all out to find every conspirator.
Do any of you ever think the spooks are engaged in a slow deliberate release of information to employ the concept discussed here? https://www.youtube.com/watch?v=2-Kii-P7vwQ
How easy is it for an intelligence service to inject packets and extract packets from their telecom network to do the real hacking whilst simultaneously trying to find a Patsy?
I really do wonder how many Patsy's have had their ego's exploited and got tricked into doing things so the spooks can control, manipulate, & exploit their targets for their own means.
Think about it, there are so many ways to control people and its been going on for tens of thousands of years when looking at religions putting the fear of god into people who dared to step out of line.
I am doing everything I can, depending on how much free time I have. Using Qubes OS, Whonix, buying GNU/Linux phones etc... Searching with DuckDuckGo, using Firefox, OpenStreeMap etc...
The most likely explanation here is that Google was conducting its own investigation into Russian disinformation and discovered the suspicious search queries. They then turned the anonymous query records over to the FBI with the understanding that they would then generate the necessary court order to request Google de-anonymize them. That is why the second sentence explicitly says "records from Google."
I've done this dance before. It is the cleanest way to turn over evidence of a crime that is discovered in a private investigation.
Here’s the scary part to me. They say they identified searches from certain networks and make it sound like those were the ONLY searches for those terms. However, it seems obvious they took his IP address, went through his search history, picked relevant terms, and presented it like they started by finding out who searched for specific terms.
I call bullshit. There’s no way he’s the only one that searched for those terms in that time period, right?
IMO they’d say that explicitly if it was the case. In reality I bet lots of people searched for those individual terms and linking a combo back to a pair of /24s seems iffy to me. Why can’t they link it back to his exact IP?
If the answer is that Google and Facebook have logs and the ISP doesn’t, that’s another whole conversation, especially if they can be linked back to a specific individual like in this case. I doubt anyone would be ok with having a lifetime search history.
At the time the terms likely did not have statistically significant search volume. I'm not going to say he was the only one, but the other three might have been people who then corrected their search from "dcleaks" to "dc voltage leak" or something.
If you search for "[government agency] mailing address" three days before they receive anthrax in the mail, it isn't a slam dunk case. But if it was also mailed from your zip code, you had placed 6 phone calls to that agency in the prior month, etc. it makes you a pretty damn good candidate.
I don't know. But everything the FBI got from Google was also given to the defense. If it was a popular set of terms, the defense would have raised that argument.
There has been some interest throughout the last five years. The first big spike was the first week of May, 2016. However, there were smaller peaks in March and April.
This is known as circumstantial evidence and I think part of what scares the shit out of people is seeing posts like yours arguing that purely circumstantial evidence should be used in this way.
Imagine being the unibombers neighbor and getting arrested for the crimes because you searched for the same things he did.
The heart of the case is the presentation of evidence. There are two types of evidence -- direct and circumstantial.
Direct evidence usually is that which speaks for itself: eyewitness accounts, a confession, or a weapon.
Circumstantial evidence usually is that which suggests a fact by implication or inference: the appearance of the scene of a crime, testimony that suggests a connection or link with a crime, physical evidence that suggests criminal activity.
In direct evidence, a witness relates what they directly experienced.
Circumstantial evidence, by contrast, consists of a fact or set of facts which, if proven, will support the creation of an inference that the matter asserted is true.
Direct evidence, often in the form of eyewitness testimony, can be extraordinarily weak. On the contrary, DNA evidence, for example, is 100% circumstantial.
What do you mean by “purely” circumstantial evidence? “A popular misconception is that circumstantial evidence is less valid or less important than direct evidence ... Many successful criminal prosecutions rely largely or entirely on circumstantial evidence”: https://en.wikipedia.org/wiki/Circumstantial_evidence
> wholly, exclusively. a selection based purely on merit
---
> A popular misconception is that circumstantial evidence is less valid or less important than direct evidence
because you know ... knowing that a person's phone was in the vicinity at a specific time in a specific area is as strong as a video of person A killing person B.
Such a common "misconception".
Furthermore, we know that people get wrongly convicted. We know this because they get exonerated down the road. It's also a tautology. "It's ok to use circumstantial evidence to get convictions because the legal system currently uses circumstantial evidence to get convictions".
Some of us don't want to go to jail because we happened to be driving through the wrong place at the wrong time.
Usually this would be circumstantial evidence because you have to infer it was actually person A and B in the video, and it actually depicted the murder. There could be alternative explanations, such as "that was my twin" or "we were performing a murder on stage".
Indeed, the common metaphor for the strongest possible evidence in any case—the "smoking gun"—is an example of proof based on circumstantial evidence Similarly, fingerprint evidence, videotapes, sound recordings, photographs, and many other examples of physical evidence that support the drawing of an inference, i.e., circumstantial evidence, are considered very strong possible evidence
> But I can’t think of a prior case where the feds unambiguously acknowledged using Google search logs this way: to, apparently, zero in on people who searched the wrong word at the wrong time.
They're not actually using it to zero in on someone, though. What they're doing is using it to build a case against someone they already suspect: Roger Stone.
Unfortunately, building a case in FBI terms often means entrapping someone in a crime related to the investigation itself, when they can't get any proof of the actual crime they are supposed to be investigating.
This reminds me of reading “Abraham Lincoln, vampire hunter” where they used his real correspondence to make it look convincing like he was some kind of American vampire hunter. It was amazing.
The reality is that when you have unrestricted access to anyone’s life, you can make them a criminal, whether by framing or surreptitiously surveillance. There’s a reason why a principle of our legal system is that you must first have reasonable suspicion of a crime before you investigate.
There is a glaring legal disconnect with popular web services, where they are not responsible for the content you post, yet the content does not really belong to you, for if it did belong to you, the service would have no right to give it up to police, that information being your property. This double standard allows tech giants to profit precisely at the expense of our fundamental rights. For further proof, ask yourself why they can arbitrarilly censor users despite claiming no responsibility for that content, because "they can do what they want with their platform". It is one or the other: they act like tbey own and are responsible for content, but without the legal ramifications of that reaponsibility.
Can someone answer whether this includes deleted search histories? I specifically go through and delete my search history. I’ve never searched anything illegal to my knowledge. But according to this you never know what will be illegal in the future.
You cannot delete your search history in any meaningful way from google. You can delete it locally and they have some account tools. They also have all of their request logs, trends, and other compiled data. The best thing you can do is set up your own VPN and do other steps to anonymize as a constant practice.
Maybe I wasn't clear, to protect your privacy you cannot have "normal" traffic. There are some browser plugs, I think chrome banned them, but you can still build them and install them yourself that will constantly make random searches in the background and click every advertising link on a page. If you have "normal" traffic, something like that may help.
There is no free lunch in this problem. You have to consistently protect yourself and your household network to avoid tracking. Also you will probably never be able to stop it fully. Understanding the ecosystem and how tracking works will help a lot and understanding your individual tolerance for tracking is crucial. I personally think it's hygienic to test out anti-tracking measures and I go for sprints with all of them running but also I use the internet like a nearly normal user a lot of the time.
If you want to take steps to learn more a good place to start is using an old computer or raspberry pi and try out some network level filtering like PiHole, having separate networks for IoT devices/mobile devices/home users/guests and doing routing to a VPN you set up yourself via a cloud host selectively for traffic, times of day, and device.
It does. Deleting your search history disassociates it from your Google account, but it is still associated with the first 24 bits of your IP address (this is considered anonymized because there are usually many different people who use IPs in that range.)
I suspect these IP address ranges are used for Mobile data as well so probably shared between multiple users. I recognised the TMO IP because I've used TMO 4G proxies that have IP addresses in a similar range. It should disturb you that someone in Florida may have searched for 'wrong' terms and then that was used as justification to investigate another person in Florida who happened to share the same IP range as the wrong searcher.
“Don’t be evil” presumes a lot when there are organizations that have machine guns and legal jurisdiction over you, and a public, decades-long track record of doing evil.
TBH, I think this is the wrong situation to trot out "Don't be evil."
Law enforcement has always been able to subpoena this type of information. From phone companies, credit card companies, ISPs, etc. If Google wants to legally operate in the United States then they don't have any choice but to comply.
The bigger issue, IMO, is that nobody has any idea who else has access to this information. Google can share this information with anybody. It's entirely on good faith that people trust them not to.
That’s exactly my point: it’s entirely naive and insufficient for Google alone to promote “Don’t be evil” if, at any time, known-racist and known-politicized “law enforcement” in the US can do whatever evil they wish with the data they’ve collected. When PRISM came along, they had no choice but to comply or suffer the same fate as Joseph Nacchio.
One would have to be a total fool to think that an internal prohibition on evil would be at all meaningful, even if somehow it were strictly adhered to. Literally nobody at Google is willing to be imprisoned to defy the orders of the nation in which its situated.
(Before you point out that it requires judicial oversight: please read a dozen federal search warrants. The standard for search warrants is hilaribad, and feds suffer no consequences whatsoever for putting whatever fantasies they want into their applications for same.)
Always? It struck me that it was a genuine creed for a burgeoning tech company who recognised established tech companies were evil, and so were themselves endeavouring to be "not evil".
The worst people you'll ever meet are always very forthcoming with insisting that they aren't monsters-- well before you've had any cause to question their integrity.
Consider their business model from day 1. It didn't take long before the allegations of email data mining started to surface.
And when the government finds out that they can't conduct investigations, they'll just pass regulations that require collection of data.
Take private owner gun sales. You have to collect the information of the person you're selling it to. You can't not collect it, and if you take the attitude that you won't, you yourself can be held criminally liable.
If we had cryptoanarchy -- unbreakable encryption, with everything on device, anonymous, and any server services using some future form of fully homomorphic encryption, and with financial transactions done with pseudo-anonymous cryptocoin, you'd find this to be a very unstable situation, and most world governments, even European governments, would quickly pass laws to require the ability to track identity, de-anonymize, and subpoena logs.
There is no way any of the Western democracies are going to move to a system where all records of activity are ephemeral and un-subpoenable.
You’re right – but at least when the government passes regulations that require collection of data, there is a public debate and a public record of precisely what must be collected and why.
Everybody’s worst nightmares when it comes to surveillance keep coming true. I’ve started to suspect the “I got nothing to hide” attitude that many privacy advocates criticize is at some level a defense mechanism for the realization that you’re completely owned and completely powerless. In other words, they know that if they really sat down and thought about what was in their Google searches, DNS lookups, or credit card purchases they would be very disturbed, so they choose not to think about it to maintain sanity. People are smarter than we give them credit for.
Because many on HN know and consciously recognize the facts here, my question would be: how do you all cope with surveillance?
I'm not seeing the problem. The feds got a search warrant to find searches for the term "guccifer" from before the term existed, and got a direct hit on the actual culprit. Not some kind of dragnet at all.
The affidavit does not say these were the only Google records, and the rest of the thread in the link talks about how this information was already public knowledge at the time.
Just what you said. I ignore it because I know the other option is living offline and maybe off grid.
Seconded. Essentially hope that you’re such a small fry the machine won’t turn it’s gaze on you. Trying to vote for people who will curb it’s power and support those who blow the whistle or sound the alarm.
Are we really that lacking in creativity that we can't imagine a world in between "Panopticon" and "Oregon Trail"? Legislation that makes this illegal would be a great (and really easy) start.
I disagree with legislation being an easy path forward. legislation takes a long time. for example, we are 12 years into jewel v. NSA. even if you do change the law, lawmakers can create (and other governmental bodies can apply) other, conflicting law. it's very cat-and-mouse in the age of the PATRIOT act, secret courts, etc.
Agreed. Legislation will even take an infinite amount of time to pass when the political parties in power don't want to pass it (despite any ineffective posturing to the contrary).
A court case in the judicial branch does not in any way speak to the difficulty of enacting legislation the legislative branch. Our system of government intentionally separates the creation of laws from their interpretation.
It’s really not that complicated. If sufficient political will existed to enact stronger clearer privacy protections, legislation would be drafted and approved rapidly, and there is no reason Generating that political will is another matter.
> Legislation that makes this illegal would be a great (and really easy) start.
Legislation is really working right now, with Congress sitting on 400+ bills and refusing to vote on them, and with known members of the government, including the actual President of the United States of America, committing crimes and the top law enforcement agent doing worse than nothing about it.
Laws work in a society that values them. Once you throw that away, your authoritarians will do whatever fits their needs. And surprise, the authoritarians are doing just that right now.
Is there really no chance we can find technical solutions to these problems?
> I ignore it because I know the other option is living offline and maybe off grid.
Better option is using simple privacy tools. VPN, incognito browsing, vetting apps and permissions and avoid Google services.
Careful in speaking for 'everybody' - because I would imagine in many cases, 'most people' (though probably not 'most HN-ers') are fine with the rules in places so long as they are civic and actually followed, i.e. oversight, Judicial warrants, proportionality etc..
There are absolutely issues of legitimate natural security for many things, then it becomes a matter of how we balance privacy vs. the functional needs of the community.
If the FBI legitimately discovers some crazies trying to make a nuclear bomb, I can imagine a Judge authorizing some kinds of searches which would not otherwise be allowed, and that 'most people' would find that justified.
Of course, widespread surveillance, especially of the arbitrary kind (i.e. catch-alls) and information gathering relegated to local-yocal Police Forces, probably are going to be problematic in the view of 'most people'.
And of course, there is the big hypocritical fact that bothers me a lot about this: that Google, who has absolutely no interest other that 'profit' seems to get a free pass on a lot of things while a national security apparatus, who's objectives are entirely in the realm of 'public service' - even when we don't always agree what those objectives are - are somehow more cynically scrutinized.
So the question is: how much of a threat is Guccifer, and what are reasonable means that we can use to go after him? Which will probably always be a hard question to answer.
I think the reason most people are fine is because they don't see the danger or don't feel that it's real. It's the "it won't happen to me" attitude. But when someone innocent gets caught up in it, then it's too late and there's no remedy.
Like, what if someone finds out they support BLM, drink cola, shop online, and watch movies over the internet, ... oh the horror!
My impression is half of HN are into some sort of espionage or something. 50% of people's darkest secret is they sniff their hand after scratching their arse; and they do that in front of everyone without batting an eyelid.
"But what if they get caught up in something", like what, the scandal over who ate the last snack in the break room?
There are places in the US where one can face significant discrimination (and danger) for being gay or trans, or for questioning their religion. While I'm not as extreme as many on HN about the issue, there are real privacy concerns for many people.
I'm not doubting some people have secrets that they genuinely need to keep, some people are honest-to-goodness terrorists, for example.
Just the narrative that suggests all people should be worried about secrecy; I'll warrant most people's secrets wouldn't cause enough of a stir to dissolve a sugar lump in a hot cup of tea.
You're warranting that, but since you don't know people's secrets, how can you possibly make that determination? With some creativity I can think of many wonderful ways to find out and construct monsters of relatively minor things - the conversations people are willing to have in private are massively different from what they'll go on record saying. How can you not have encountered this difference? Can you really not imagine how even the most innocent of statements or criticisms can be construed by a paranoid power in the worst possible light?
>since you don't know people's secrets, how can you possibly make that determination? //
It's a conversation. You can tell me everyone you know has secretly murdered at least one person and progress things somewhat (I'm being flippant, of course).
Saying things in public is not "being on record" though. Someone has to make the effort to look up about you, and we all wore a stupid costume, got drunk and made a pass at someone, dropped some litter, swore, or whatever ... in a Western Democracy are you going to shame me for normal behaviours, I think you'll struggle.
>Can you really not imagine how even the most innocent of statements or criticisms can be construed by a paranoid power in the worst possible light? //
Yes, what's the motivation? Fascist takeover? We're all in the same boat aren't we: OMG my neighbor looked at porn, let's burn him at the stake??
Sorry, I'm not interested in you making a determination that the private lives and conversations of others are similar to yours, nor do I accept any premise that simply because you've judged people to 'not be terrorists' and the risk of governmental abuse to be low, that there is no real risk of agencies abusing such data. Your justifications are personal, and frankly, should have no bearing on other people's lives. If you can't imagine real cases of private conversation (or DNS lookups, or whatever) being used to profile and target particular groups for fairly undemocratic reasons, then that's a failure of your imagination. We are not all in the same boat, especially if by 'boat' you mean we all socialise with the same people, have the same political beliefs and actions, or even share our sexual orientation.
Mind posting a picture of yourself, from the front, fully nude? And your home address, or at least zip code, too. Shouldn't take too long to do. Not picky about quality, either- a phone camera will be more than fine. But make sure your face is in the shot, of course.
If you don't want to post it publically, let me know and I'll create a temporary email to send it to. I'll be sure to delete it after verifying it.
...
Do you feel disgust in reaction to that request? I suspect most people would.
But why? It's not like it's anything sensitive, like a password. I mean...if you don't send the picture, what are you trying to hide? Are you a terrorist? I'm not even a government agent- I don't have the power to throw you in jail.
But, turns out, even when you don't have anything to hide, there's still some things you don't want to share. That's just human.
I knew someone would take that line - I've been naked in public, but that's different to actively passing information to someone with an axe to grind.
Not wanting to send you a picture is pretty orthogonal to worrying about the off chance that some gov official will at some point see me naked.
What address do you want me to send to?
What do you consider secrets people genuinely need to keep? And who determines what is considered genuinely need to keep? Also telling you jump directly from genuinely need to keep straight to being terrorists.
Secrets don’t just need to be incriminating, they can also just be embarrassing. People don’t want the world to know they are secretly seeing a lover, or watch a specific type of porn or spend half their time at work browsing HN. Some of those will have real life ramifications.
What if you are:
A) gay, and in the closet?
B) a recreational drug user?
C) an activist for a movement the government doesn't like?
D) a supporter of C)?
There's also the problem of selective enforcement. Nearly everyone has done something wrong at some point, even if it was a minor traffic offence. If surveillance is good enough, the government will have dirt on close to 100% of people, leaving it in the position of being able to dig up decades of minor offences whenever it doesn't like you.
Selective enforcement is the big one. Our society simply isn't suited for everyone knowing what everyone else is doing. Even if our laws somehow didn't suffer from selective enforcement, people who find some (legal) things that you do immoral can still use that to justify trying to harm you.
>finds out they support BLM
better, what if they find that they don't support BLM!
Maybe by looking at the flag outside your house?
I challenge anyone who claims they have no secrets to upload all their cloud files and hard disks inc. browser history and cookies to a s3 blob and share a link on HN.
Sometimes people aren't aware what can be pieced together from the information they haven't the need to hide.
The reason people are 'fine' with it, is because it's a rational response to a real concern.
Guccifer was hacking into people's accounts, revealing information of a national interest.
So there is some proportional reaction by law enforcement.
"But when someone innocent gets caught up in it, then it's too late and there's no remedy."
Who are these innocents 'caught up in it', for which there 'no remedy'?
It's possible investigators make mistakes while matching DNA just as well, but we don't deny them the right, because it seems the 'science' supports DNA as evidence. So we use it.
I think that is a real but smaller concern - bigger concerns are large dragnets (arbitrary data collection), lack of oversight (no warrants), lack of proportionality (i.e. local Police getting access to all your searches because someone made a 'noise complaint'), and politicization (i.e. Trump getting search records on political enemies etc.).
Personally, I don’t care about what a computer system does with my data (to me, that’s no more bothersome than my underwear seeing my genitalia), but I do care if humans get to look at it. So overall I’m fine with what Google does, but bothered by government spooks looking through my data. I’m okay with humans looking if there’s a process with oversight limiting the search only to what is necessary. From this perspective, I don’t think Google harms my privacy much. I think the biggest privacy risk to me personally is probably from breaches/leaks (eg. if I gave my emails or messages to some dodgy service, and they end up on pastebin). To protect against that risk, I want entities that hold my data to have strong controls, and I think Google clears that bar.
Personally, the fears around privacy are about harm being done to myself or others with my data. Google would be fine, except that big tech companies like Google sell your data to advertisers, who then use that data to coerce you into buying products and services that you might never have purchased if left to your own devices. That crosses into 'harm' territory.
For a more clear demonstration of harm, think about Facebook and Cambridge Analytica, and the very real and tangible effects that scandal had.
I block ads, and Google doesn’t actually give your data to advertisers, so they don’t get anything from me. Just another case like my underwear seeing my genitalia, to my mind. Computers taking to themselves while I go on living my life.
Cambridge Analytica was a serious problem, although I thought Facebook had cracked down on that kind of thing, and Google did much further in the past.
> who then use that data to coerce you into buying products and services that you might never have purchased if left to your own devices.
That’s not what coercion means.
coerce: persuade (an unwilling person) to do something by using force or threats
Don’t cheapen the word by misusing it.
cheap·en
/ˈCHēpən/
verb
reduce the price of.
"the depreciation of the dollar would cheapen U.S. exports"
synonyms: reduce, lower, lower in price, cut, mark down, discount, depreciate, devalue, depress, put down, keep down, slash, axe
So words cost money now? News to me.
> coerce: transitive verb. To bring about or gain by pressure, threat, or force.
There is a pressure exerted by controlling someone's environment. The use of the word fits.
I think “persuasion” is a good neutral term in this case. That’s what it’s called when someone tries to convince you of something.
Re google vs state scrutiny specifically - the big difference between the two - one has an exclusive right to use physical force against individuals, another one - does not.
If someone wants to home in and destroy you, they've always been able to do that without total surveillance.
If the records exist, and you're not guilty of the crime, hope exists that you could be cleared.
Doesn't it make more sense for one's worst fear to be accused of something for which you are innocent but have no alibi?
You're right, but then you have the problem of credibility. If Google's records are credible for this, then what's the chance that somebody will notice if some of those records are manufactured? It's like forging signatures - it's a problem because we trust signatures to some extent.
I don't exactly disagree in one sense, but this argument seems like it kind of generalizes to the idea that "better is worse", which I can't agree to.
The more technical details of recordkeeping or surveillance that there are, the more likely a frame-up will have flaws that people notice.
I don’t think the argument generalises quite that far, but it does go as far as “more information is worse.” The presumption of innocence is a valuable principle to which this applies. We ignore evidence that suggests that someone is guilty of a crime until the court process has finished, and if they’re “probably guilty” we say they’re actually “not guilty” for fairness reasons.
Police can and have forged evidence without having to resort to forcing a company to do so. The latter is more risky as there is a greater likelihood of a leak.
* Scene opens with two federal agents discussing a new case *
Agent 1: There was a shooting on 5th st.
Agent 2: Just use the phone records to look up everyone in the area and then arrest them at their work in front of their boss.
Agent 1: It's ok to do this because the innocent will surely have a way to prove their innocence.
Agent 2: But what if it looks bad that we are arresting so many innocent people?
Agent 1: In every legal system there are always more crimes than can be prosecuted. The discretion of prosecutors is an important legal function. If we arrest someone embarrassing, we'll just find something to charge them with.
Agent 2: Yeah and contact with federal agents also _generates_ more crime, like lying to one of us is a felony, right?
Agent 1: Hope they have the $250k it takes to defend against a federal felony.
* The agents laugh *
* Scene end
> If we arrest someone embarrassing, we'll just find something to charge them with.
Or as they currently do: lie about their detainees doing crimes and/or plant contraband
In this situation, the privacy violation of becoming a suspect via location history is an utterly negligible problem. What you describe could just as easily happen in a traffic stop (and in fact probably far more likely).
> could just as easily happen in a traffic stop
Well it clearly does....
But I think the point being made is that part of the issue is lazy policing/detective work. The concern about privacy is really about the concern of __abuse__ of data. Why many of us want to protect our data is that we do not trust those in power, nor current nor potential future rulers (a big concern). Such instances as the above example are abuse of that data, as well as abuse of power. The thought is that if they are going to abuse us, we're going to make it more difficult. Dragnet operations make the above easier, not the same level of difficulty.
Bad cops are going to be bad cops regardless of the tools you give them. That isn't to say privacy is not a problem, just that I don't think privacy is the primary problem in your example.
Give a bad cop a club and they'll beat someone.
Give a bad cop a gun and they'll shoot someone.
Give a bad cop a swat van and they'll raid a teenager's home, kill their dog and brother.
I'm tired of this binary perspective. It is common but in bad faith. The tools matter. Different tools enable different levels of abuse. Yes, cops shouldn't abuse citizens and we should do our best to stop that. But do you expect to find a perfect solution? If not, then we should also ensure that when a bad cop slips through, they are limited in the damage they can do.
You are reading way too much into my comment. I was directly speaking to the example given and not making some universal endorsement of empowering cops.
There was nothing in that example that was specifically linked to data collection. You could have had the exact same situation except they are rounding up Black people as suspects. The problem there is bad cops not dangerous tools. The tool is irrelevant in the example.
> If the records exist, and you're not guilty of the crime, hope exists that you could be cleared.
But if no records exist, you will not be a suspect in the first place.
Not really. Stone was already a suspect, this was a fishing expedition to confirm their suspicions.
Let me introduce you to this story:
https://nypost.com/2017/09/23/how-curb-your-enthusiasm-saved...
Nevermind that it had a good end. Recognize that even though there was reasonable doubt as a near impossibility of this man being guilty, the prosecutor still desperately tried to throw him in prison, despite him obviously being the wrong person and the prosecutor almost succeeded!
An amazing reason to never, ever, believe or trust policemen or prosecutors if you're ever on a jury
> But that wasn’t enough for the LAPD and the prosecutor — who had never lost a case and was going to push for the death penalty for Puebla’s murderer.
He did get some compensation:
> In 2007, Juan received $320,000 in a settlement of his civil lawsuit against the LAPD and the city of Los Angeles for false imprisonment, misconduct and defamation. (In 2008, gang member Raul Robledo received a life term for the murder.
But it's outrageous we, the taxpayers, have to pay for police misconduct. Let it come out of their pension fund (and reduce their pensions accordingly).
Data leads to control (in the extreme case, the government knowing all your thoughts can pretty much control your life). Sometimes this control is warranted, like using anonymized data to prevent crimes, with a panel of independent citizens auditing the access to make sure it is benefiting the society at large as opposed to a minority. But sometimes it can be used nefariously. For example the state can push propaganda based on the private data of the citizens, making the government less democratic over time to promote the agenda of a minority. My position is we don’t trust that use is legitimate, and don’t assume that states access to private data is in the benefit of the citizens. The government is always assumed guilty until proven innocent.
> If someone wants to home in and destroy you, they've always been able to do that without total surveillance.
This isn't even about that. Yes, if someone powerful wants to make your life hard, your life is going to be hard.
Now consider what happens if they just don't care whether you live or die. Some system is set up to "solve crimes" as "efficiently" as possible. The same sort of system that gets used to issue YouTube copyright strikes against the original creators or public domain works because Hollywood put a copy in a motion picture, or mark every email sent by a perfectly legitimate small private email server as spam.
The police increase their "solve rate" dramatically -- by putting a ton of innocent people in prison. Because now instead of unsolved crimes they have "evidence" which, even if it's all circumstantial garbage, is enough to coerce guilty pleas out of defendants who can't afford a good lawyer or don't want to risk having the penalty quintupled if they demand their day in court and lose, or would rather spend six months in prison than pay six years worth of wages to a lawyer.
> If the records exist, and you're not guilty of the crime, hope exists that you could be cleared.
Only you can't get access to the records, because they're sensitive for all sorts of reasons, e.g. because having them in the aggregate would allow you to locate people in witness protection or unmask undercover law enforcement or case targets for espionage or theft. So you can't give access to everything to everybody, which means it only gets used as evidence for the prosecution because they can get it and you can't.
> Doesn't it make more sense for one's worst fear to be accused of something for which you are innocent but have no alibi?
In principle they still have to prove your guilt even if you don't have an alibi. Think about it, a large proportion of crimes are committed at night when most people are at home asleep.
Meanwhile, data under your control is generally only useful as evidence of guilt, because otherwise they just argue that it was under your control. If your phone was at the location of the crime, they argue you were there. If your phone was at home 200 miles from the location of the crime, they argue you knew you were about to commit a crime and left your phone at home. It's used to hurt you but not to help you.
As an Aussie it's becoming increasingly clear that my wish to run my own servers in order to maintain some semblance of privacy is quite likely going to become a massive liability to my freedom, if the current state of affairs continues much longer. To be clear, by hosting a website I'm liable to "authorities" wanting to access everything anyway. By using a website in this increasingly fascist world, it becomes increasingly likely that my websites/mail servers will look "interesting", simply because I'm not "toeing the line"
> To be clear, by hosting a website I'm liable to "authorities" wanting to access everything anyway
In America at least, a search of this nature has to be very narrow in order to be valid, even the secret ones.
In America, the validity of a search is rarely an impediment to carrying it out.
This is from Mapp v. Ohio, an old Warren Court decision establishing the exclusionary rule. It has long since been hacked to the bone.
I so wish you were right but this is very much not correct.
If you believe this is true in practice, I've got a bridge to sell you.
In case any were curious of the origin of this phrase: https://en.wikipedia.org/wiki/George_C._Parker
Court orders are a last resort. Often, law enforcement will just ask providers to kindly share the information they want access to, and the providers comply. No warrants needed.
Sure, but asking politely is hardly the mark of tyranny, and has nothing to do with the sort of scenario I'm replying on.
"Asking politely" is a euphemism. The company has a desire to receive government contracts, or to not be subject to adverse regulations, and is thereby given the choice to submit or be the subject of retaliation.
In reality it's an end-run around the court system. If the government officially penalized them for not complying, various parties would have standing to assert their rights. So the punishment isn't officially tied to the failure to submit, but the threat is still there.
https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveilla...
I think it is more complicated that. It's more like asking your neighbor to borrow some sugar. Nothing nefarious, but your neighbor might later ask to borrow your ratchet set. The concern is how strong is this relationship and if there is real quid pro quo going on. It gets gray real fast when you are your neighbor's boss and control his raises.
Also in this case, it's not even your sugar. You're giving out someone else's sugar, so why the hell would you care?
"Oh, your new office building looks nice. Did your construction firm get all the necessary permits? Are you sure? All of them? Oh, and I see you have a lot of new employees. A lot of them. I bet it would tie up your HR department for quite a while if the INS came by and requested documentation that all those employees are authorized to work in the US, wouldn't it?
"Anyway, I've come to ask whether you could do a favor for us."
"Say, that's a nice business you have there. It'd be a shame if anything happened to it."
And it's the organised crime that is associated with mafia tactics...
In Australia, you currently just have to suggest a peaceful protest for a search warrant to be issued against you. There are quite a few people who've been dragged off because of this. It's my understanding that everything is collected and analysed during these searches.
> is quite likely going to become a massive liability to my freedom
Compounding this is the advent of “hate crimes”, or rather the utterance of forbidden words. Now a days you can be hauled off in jail in many countries simply by expressing a wrong opinion, let alone hosting a service where others are allowed to do the same.
I can't possibly imagine why people might be upset by the "utterance of forbidden words" like "<insert slur>s like you deserve to be murdered by the state" and want legal protection from it.
> increasingly fascist world
You mean authoritarian world. Most people couldn’t name one tenet of fascism regarding finance, labor, etc. Fascism is financially left wing but socially right, which is the opposite of liberal capitalism—regardless of whether the capitalistic govt is authoritarian. yes I realize most people use it as a buzzword. And no I don’t want an authoritarian govt.
I urge you to read through https://en.wikipedia.org/wiki/Definitions_of_fascism before dispensing with any additional wisdom on what is obviously a very nuanced topic that depends a on great deal of context.
Let them work hard even if you have nothing to hide. I'd refuse to disclose any private info up until the law requires me to. Intimidation is a trick they use to cut down on work.
Encrypt everything. We know they keep copies of encrypted data for a long time hoping for the day that breaking the encryption becomes easy for reading later. In the meantime, flood everything with mundane data, but encrypted. Make it expensive for them to keep it all, and the an absolute waste of time when they do get it decrypted.
Throw in some legitimate random data to really mess with them. Everybody needs some good entropy seed material.
> I'd refuse to disclose any private info up until the law requires me to.
This doesn't work as well as you'd expect.
I know Queensland law requires you to unlock your phone for a cop, or you face prison time. I'd expect there's similar laws for disclosure of encryption keys.
I don't know if I'm willing to "make it hard for them" if that means facing jail time.
This is true in relation to a search warrant afaik:
https://www.hallpayne.com.au/blog/2019/january/mobile-phone-...
>Judge North’s comments do make it clear, however, that if you answer questions where you acknowledge ownership of a mobile phone, then there is a potential for self-incrimination.
Could the answer be encrypted hird-party de-centralized mini-services being sprinkled accross various locations through-out the world? Perhaps the "authorities" would be able to crack one such mini-service, but it would never get them all due to how it limits jurisdictional access. I'm just thinking out aloud... Does things like this already exist (outside TOR nodes, of course)?
Only if it becomes ordinary to use such a service.
TOR protected the spies it was made for, only because there was a substantial amount of other, less interesting, traffic.
The mere act of straying outside the norm is what makes you vulnerable. Protecting the data itself is secondary to making the data seem uninteresting to begin with.
That's quite hard because it is lack of motivation for people to build such mini-services with risk of being sued. It is quite easy to get some illegal stuff when you host a service without review which is almost impossible for individual service provider to do.
There is one way which may reduce the risk. Build your whole system in RAM including OS. When totally power off, everything is volatilized. To lower the cost of RAM, one could just put the OS and service in RAM, but let the encrypted data in drive with key in RAM/RAM-disk.
The difficulty here is building a OS in RAM. There are some tricks but most of them need a host which may contribute to vulnerability.
It is a combination of feeling powerless and feeling afraid.
The majority is more afraid of what will happen if the government does not find the information to catch the person trying to hurt them, than they are about the government finding information about them and hurting them with it.
Remember it is majority rules. Not even 80/20 but 51/49. You only need 51 percent of people to have less to hide. And people in the majority are typically not the ones that have things to hide for legitimate reasons. It is the people in the minority that are innocent of any wrongdoing , but be undesirable for some reason, that have something to fear.
Legislation isn't based on majority votes though...
Sorry, it’s not clear if this is meant in sarcasm—- maybe I’m misinterpreting, but how exactly is legislation passed if not by majority vote?
Not OP, but at least in oz we live in a representative democracy. That means that though 51% may support the current government, any one piece of legislation only needs to have the support of the majority in parliament. It could have zero support in the community.
It happens often enough when people are polled on the legislation itself, rather than party preferences, people overwhelmingly support positions which may even be antithetical to both sides of parliament. Climate change legislation has enjoyed overwhlming support in oz for years, even amongst a slim majority on the right.
People overwhelming support environmental protections. But our parliament this week, under cover of covid, pushed through a massive regression in environemntal protections without even letting their own party discuss the legislation, let alone the opposition or the media.
Representatives are not always representative.
See: Wisconsin.
https://www.msn.com/en-us/news/politics/wisconsin-e2-80-99s-...
> The maps have exceeded their designers high expectations all decade long. In 2018, for example, Wisconsin voters re-elected a Democratic U.S. senator, backed Evers for governor over two-term Republican incumbent Scott Walker, placed Democrats in every elected statewide office, and preferred Democratic assembly candidates by a margin of 190,000 votes. Republicans held the chamber, 64-35. They won 64 percent of the seats, with 46 percent of the votes.
It would be difficult to call Wisconsin a democracy with a straight face at this point.
> It would be difficult to call Wisconsin a democracy with a straight face at this point.
I think you don't understand how things are working. Senators are elected by the people, at the seat level. You can see what's happening here in this post: https://www.washingtonpost.com/politics/2018/12/04/several-l...
> [in 2018] They [Democrats] won 53 percent of the vote and only 36 percent of the seats. However, that can be explained in part by the fact that Democrats had far more seats in which they weren’t running against a Republican opponent. Nearly half of the votes the Democrats earned were in districts where their candidates didn’t face significant opposition. In contested races, Republicans won more votes than Democrats.
If you get 90% of votes for one seat where there is virtually no opposition, that has no bearing to the other seat where you lost 48% to 52%.
That's actual democracy, and even direct democracy. This is also confirmed by the 17th Amendment:
https://constitution.congress.gov/constitution/amendment-17/
> The Senate of the United States shall be composed of two Senators from each State, elected by the people thereof, for six years
> Legislation isn't based on majority votes though...
This only makes it worse. This year 51% of the population voted for Party B, so they have 51% of the legislature. They vote as a block, so they vote in anything supported by the majority of the coalition that Party B represents. So then you get bad laws that are only supported by 26% of people (51% of 51%). Next year Party A has 51% of the legislature, but not the Presidency, so they can't repeal it.
A possible solution to this would be to allow for the repeal of any law that wouldn't currently have what it takes to pass, i.e. anyone can resubmit any existing law as a new bill and if it fails to pass both houses and earn the President's signature, it effects repeal of the existing law.
It's even worse then that. The parties aren't even majority rule: everyone compromises on some issues, and is forced to select based on availability (which is determined by financials not democracy) and fear of the other side rather then positive belief, so I would argue that 26% is likely closer to 10% or less for many issues.
And then of course there is the large chunk of people who find the views of both parties so uninspiring or outright disgusting to not want to vote at all.
Its really surprising when any popular legislation is passed in any form, even watered down, in this mess of a system. Obviously though that is by design.
There can be filters and data can be anonymized, with all access recorded and audited by an independent panel. However that is not the current state of the surveillance state in the US. I think the majority would poll for the system with the safeguards in place as opposed to the current system that relies on trusting the state. Also the damage can be more subtle like the state pushing propaganda based on the private data of the citizens.
Right now we habe regressive privacy, where people with more power have more privacy. We should have progressive privacy. Power over others is power to hurt others, and for a democracy to work, such power must be tempered by transparency and oversight, while the default for the masses should be strict privacy protections.
Ah! Hence the federalism and checks and balances, the two we widely derided concepts.
We already know ways to prevent the majority from imposing tyranny on the minority, we just decided that more absolute power is convenient.
Federalism was about ensuring a very specific type of majority minority balance was kept, and is weak in most cases, and checks and balances in the USA broke down the moment ideologically coherent parties became a thing, exactly as had always been feared.
I'd like to see polls on that. From what I've seen, people who worry about their privacy do things about it (like avoid google, pay cash, etc.) while people who don't care about privacy put evidence of their own crimes on facebook like idiots. Painting everyone with this giant brush of hypocrisy is over-simplifying a complex mix of people.
> Painting everyone with this giant brush of hypocrisy is over-simplifying a complex mix of people.
Was momokoko saying that anyone was a hypocrite?
many people still don't realize google has been scraping and tracking everything you've ever bought, for years
https://myaccount.google.com/purchases
That's in your emails. Every email service provider has those records.
Its been 1.5 decades since the patriot act of the same rehashed tropes and fear mongering. Most citizens accept the high level surveillance for high level hackers and criminals. The fear of ‘they’re going to track Joe Schmoe to a strip club and ruin his family life’ hasn’t come close to materializing. Call us when it does. Until then, the dialog between elite tech bubbles like hn or slashdot of 15 years ago and the rest of the country won’t be productive.
This is the point the tech community needs to focus on. If we want the general public to care about these issue, we need to communicate the repercussions in ways that doesn't just allude to the ideals of "freedom" and "privacy". You need concrete examples of how this can and will go wrong in the short term for normal law-abiding citizens and they need to be scarier than "the government will know your porn searches" which clearly hasn't motivated anyone.
> I’ve started to suspect the “I got nothing to hide” attitude that many privacy advocates criticize is at some level a defense mechanism for the realization that you’re completely owned and completely powerless.
Based on what? Why is it so hard for everyone to believe that the regular public, who haven't spent much time thinking about the complex implications of the eroding of privacy, just doesn't care that much? If they think about it at all, they calculate that is extremely unlikely it will ever negatively impact them.
Whether they're right or wrong, that's what they think. Now what makes you think they're actually being driven by some kind of defense mechanism?
I spend most of my free time on my homelab and figuring out self-hosted alternatives. For everyone of us that does this and tries to fix a bug, report an issue, write some tooling, or add some tutorial for open source projects, the lower the barrier for others.
For each of us that runs their own physical servers (and make your less technical friends use them!) we grow stronger.
Use matrix.org (or whatever you believe in), self-host email, promote cryptocurrency.
https://searx.github.io/searx/
I choose to hope the war is not fully lost, yet. But the borders are closing in.
I host my own matrix, but getting my friends and family to make the switch is proving difficult...
I see it as a long-term project. For now it's mostly me and a few other nerdy friends, and otherwise it's mostly like a "new IRC".
Maybe in a year or so it'll be mature to bring people over.
I don't know. It's not as easy to set up as Whatsapp, where you just need your phone number and everything else "just works", and doesn't have the added functionality of Discord, with custom emotes, voice and streaming and servers to effortlessly participate in multiple communities with their own separate channels. My family keeps messaging me on whatsapp because that's where all their friends are and they don't want to switch apps just to talk to me, and my friends are far more comfortable with our online hangout space being discord instead. Element is still rough as a client, and for my self-hosted homeserver I had to put in a couple hours to get video and voice calls working. Unless Matrix magically becomes 10x as polished within a couple years I don't see it becoming popular outside privacy enthusiasts.
So maybe it's two years. Or three. But I think we'll get there at some point. A beauty is that while they do have funding, everything's done in the open and it's not a VC-funded company that's gonna drop the ball once they get acquired by someone who ends up killing the product or taking it in the wrong direction.
The more we try to use it, the faster that will happen. Meet someone new and if you're going to stay in touch, propose Matrix as your first preference and eventually settle on what both of you feel OK with. Every little bit helps spreading awareness and eventually adoption.
I don't see why Discord would be the first of its kind to be that big eternally.
not just difficult. you're now that paranoid guy who wants to be special.
I think it can be beneficial to offer your server, but maybe for onboarding it's a good middleground to point to matrix.org
> promote cryptocurrency
I advice against them, generally. Only if transactions in your country are severely limited, but then you live in an unfree country already. Cryptocurrencies have a tendency to be abused for speculation, and are bad for the environment.
My worry isn't my own government; I'm worried about [some] other governments, and very large corporations.
I can’t understand how one can care about privacy for communication but not when it comes to money.
Money is a means of communication; we use it as a medium and metric for communicating value.
Unless we have truly fungible cryptocurrency as an alternative to corporate or government digital currency, all our private finances are inseparable from the surveillance machine that is now slowly emerging from adtech and fusing with capital control/KYC/AML systems.
Don’t look at where you are today, but where we are as a global community in 10 years.
The only trail it leaves is to financial institutions (who can see the transactions), and the government. The former need to be held accountable by law, by the latter. I believe the GDPR may aid us there.
Now, in a free society, I don't see a good reason why one should be afraid the government can snoop around my financial transactions. I believe I currently live in such a free society. If I want, I can buy a dildo or latex costume in an Amsterdam sex shop within an hour tomorrow, and I am not going to have to be shy about that. I don't live in a country where, for example, gay people get beaten up regularly. I'm not gay myself, btw, but I've experimented a fair share with my sexuality when I was younger. I also used to buy legal drugs online, and I just paid by IBAN. Do I want my employer to know such? Well, I'd like to have the choice to do so, and I have this choice as it is.
I can think of some very good reasons to use cryptocurrency in my free country, and none of these are valid from a legal PoV (avoiding taxation, buy illegal drugs/weapons/etc ie. criminal behaviour). By using cryptocurrency where other means work perfectly fine, I add noise to the cryptocurrency data, and it isn't in my interest to add this noise as I am not a proponent of things such as avoiding taxation or criminal behaviour.
Furthermore, nothing what you say addresses the other points:
> Cryptocurrencies have a tendency to be abused for speculation, and are bad for the environment.
These cons still exist, and need to be put on the weight with the privacy aspect. Which can be a valid argument in an unfree society, such as for example Belarus or China.
The FBI can't see what you searched for without a warrant. They can find out that somebody searched for dcleaks, but they can't find who searched for dcleaks unless they have a warrant for the specific user. This isn't my worst nightmare, not even close.
The US intelligence community agencies can access the data directly from Google via PRISM without a warrant, correlate it with their stored XKeyscore/MARINA data, and provide that to the FBI for parallel construction.
If you read a number of federal search warrant applications, you will see how flimsy and inaccurate they often are. Judges aren’t in the habit of saying no to the FBI very often.
> The US intelligence community agencies can access the data directly from Google via PRISM without a warrant
No, they can't. That's a bunch of conspiracy theory gobbledygook not supported by any documents. https://www.cnet.com/news/no-evidence-of-nsas-direct-access-...
If you are an American or in the US, they must obtain a warrant to get your data from Google.
From that URL:
> In response to outcry over PRISM, the U.S. director of national intelligence has released some details. Among other things, he says the government "does not unilaterally obtain information from the servers of U.S. electronic communication service providers" and that PRISM-related activities are conducted "under court supervision."
“unilaterally” is how the first is true: the providers participate and generate the data dumps for them. “supervision” is how the second is true: supervision is NOT a warrant.
You have to be careful with the wording. I never claimed they had direct access. PRISM is a program that allows them to download account contents via a special app, which is integrated by these companies, with the cooperation of the companies participating.
Google joined the PRISM program on 14 January, 2009, and were assigned the identifier prefix P3.
PRISM collection does not require real search warrants, as it falls under Section 702 authorization, authorized by congress in 2018 until 2023 presently.
https://www.eff.org/702-spying
They do indeed get the account information downloads directly from the participating companies. They do not have direct access to the companies’ servers (outside of the servers that run the PRISM integration, and perhaps not even direct access to those other than being able to submit PRISM data request jobs).
The net effect is the same.
Note that being American or being located in the US is insufficient protection against PRISM due to the way Section 702 works in practice as applied by the NSA. This is one of the reasons cited by Snowden about why he came forward: this secret new interpretation of FISA gutted previous warrantless search protections for Americans, sidestepping them entirely.
> PRISM is a program that allows them to download account contents via a special app, which is integrated by these companies, with the cooperation of the companies participating.
No, it isn't. Where did you get this ridiculous notion? PRISM is a data integration program between the NSA and the FBI. It shows this right in Snowden's leaked slides. https://zdnet2.cbsistatic.com/hub/i/r/2014/10/05/c3fe17c5-4c...
The FBI sends a data request for specific accounts' data to the data provider. The data provider's lawyers review the request and if nothing is amiss, they configure a wiretap on those accounts that sends data to the FBI. http://www.nytimes.com/2013/06/08/technology/tech-companies-...
> Note that being American or being located in the US is insufficient protection against PRISM due to the way Section 702 works in practice as applied by the NSA.
Huh? There is no secret interpretation that allows Section 702 requests to violate the Fourth Amendment. The only program in Snowden's leaks that illegally collected Americans' data was the phone metadata program.
>Because many on HN know and consciously recognize the facts here, my question would be: how do you all cope with surveillance?
I also had this "I've nothing to hide instance" - not that I don't have my own nudes on my phone/Google drive/WhatsApp/telegram but because I know there are very corrupt people whoes greed knows no limit.
Surveillance is obviously going to harm my privacy but I am prepared to give it away for greater good atleast the terrorists and other corrupt government officials will not be able to hide behind the privacy which commoners have demanded for themselves.
I am skeptical that commoners and govt officials will experience this the same way.
This is an actual privacy concern. I often see people here on HN take issue with sites recording how much you spent on the page and which products you clicked - for marketing purposes, I have nothing to hide here. But the emails and searches is a different thing.
Is it? There's nothing in this disclosure that says they were fishing. It just says they identified the searches. It's entirely conceivable they had referer logs from the Guccifer site showing hits from Google at specific times and subpoenaed all correlated searches. Law enforcement being able to retrieve this kind of information when it's part of a legitimate criminal investigation is good. The worst nightmare is that broad powers get abused but in this case they caught the right guy.
It's also entirely conceivable they didn't, and parallel reconstruction has been well-established to be a part of the US justice system for decades.
https://en.wikipedia.org/wiki/Parallel_construction
Maybe. But there's nothing in this document to say they did.
Is this not the FBI's own report? Why would they admit to something of questionable legality? That's like trusting the internal investigation from a police department.
An internal investigation from a police department should be conducted by a department which is not directly related to the people (police officers) who are being investigated. The reason for this, is to avoid conflict of interest. If such doesn't happen in your country, that makes your country less free than it IMO should be, but don't assume its like this everywhere in the world.
OP seems to be implying that this disclosure is incriminating of some kind overly aggressive search tactic. I'm saying it doesn't seem to imply that at all. This isn't proof of their innocence, it just isn't proof of their guilt. They _might_ be guilty of something, but there's currently no reason to think that.
Even if it just for one person (which does appear to be what they asked for to me), asking for their entire search histories from all their devices seems like fishing. Particularly since they used it to charge him with new crimes (lying to FBI, etc) rather than the crime they were supposedly searching for.
Pardon m’y ignorance but isn’t that normal? If they got a warrant for your house and found new Evidence of new crimes there they’d take and use it.
No. That's SOP. If someone is a suspect in a serious crime, they'll search your house, your car, your office and subpoena your phone records. And this was a national security case so you know they're going all out to find every conspirator.
Do any of you ever think the spooks are engaged in a slow deliberate release of information to employ the concept discussed here? https://www.youtube.com/watch?v=2-Kii-P7vwQ How easy is it for an intelligence service to inject packets and extract packets from their telecom network to do the real hacking whilst simultaneously trying to find a Patsy?
I really do wonder how many Patsy's have had their ego's exploited and got tricked into doing things so the spooks can control, manipulate, & exploit their targets for their own means.
Think about it, there are so many ways to control people and its been going on for tens of thousands of years when looking at religions putting the fear of god into people who dared to step out of line.
Nicely explains why conspiracy theory nuts are on the rise.
"What if the trauma of living through real conspiracies all around us [...] is making people vulnerable to conspiracy theories?"
https://onezero.medium.com/how-to-destroy-surveillance-capit...
> how do you all cope with surveillance
I am doing everything I can, depending on how much free time I have. Using Qubes OS, Whonix, buying GNU/Linux phones etc... Searching with DuckDuckGo, using Firefox, OpenStreeMap etc...
The most likely explanation here is that Google was conducting its own investigation into Russian disinformation and discovered the suspicious search queries. They then turned the anonymous query records over to the FBI with the understanding that they would then generate the necessary court order to request Google de-anonymize them. That is why the second sentence explicitly says "records from Google."
I've done this dance before. It is the cleanest way to turn over evidence of a crime that is discovered in a private investigation.
Here’s the scary part to me. They say they identified searches from certain networks and make it sound like those were the ONLY searches for those terms. However, it seems obvious they took his IP address, went through his search history, picked relevant terms, and presented it like they started by finding out who searched for specific terms.
I call bullshit. There’s no way he’s the only one that searched for those terms in that time period, right?
> There’s no way he’s the only one that searched for those terms
Why not? Why would anyone search for both dcleaks and guccifer months before dcleaks was a web site or guccifer was a persona?
IMO they’d say that explicitly if it was the case. In reality I bet lots of people searched for those individual terms and linking a combo back to a pair of /24s seems iffy to me. Why can’t they link it back to his exact IP?
If the answer is that Google and Facebook have logs and the ISP doesn’t, that’s another whole conversation, especially if they can be linked back to a specific individual like in this case. I doubt anyone would be ok with having a lifetime search history.
> Why can’t they link it back to his exact IP?
Because permanent logs don't contain full addresses, because of GDPR.
https://trends.google.com/trends/explore?date=2016-03-01%202...
What’s the spike on May 5 there? It’s 12 days earlier.
At the time the terms likely did not have statistically significant search volume. I'm not going to say he was the only one, but the other three might have been people who then corrected their search from "dcleaks" to "dc voltage leak" or something.
If you search for "[government agency] mailing address" three days before they receive anthrax in the mail, it isn't a slam dunk case. But if it was also mailed from your zip code, you had placed 6 phone calls to that agency in the prior month, etc. it makes you a pretty damn good candidate.
What was the search volume? That’s relevant and they should have to list it.
I don't know. But everything the FBI got from Google was also given to the defense. If it was a popular set of terms, the defense would have raised that argument.
It wouldn't be popular if they also filtered it to a suspect's geoip range or other qualifiers.
https://trends.google.com/trends/explore?date=today%205-y&ge...
There has been some interest throughout the last five years. The first big spike was the first week of May, 2016. However, there were smaller peaks in March and April.
This is known as circumstantial evidence and I think part of what scares the shit out of people is seeing posts like yours arguing that purely circumstantial evidence should be used in this way.
Imagine being the unibombers neighbor and getting arrested for the crimes because you searched for the same things he did.
All evidence except actual witness testimony is circumstantial.
That's not even close to true.
https://www.americanbar.org/groups/public_education/resource...
The heart of the case is the presentation of evidence. There are two types of evidence -- direct and circumstantial.
Direct evidence usually is that which speaks for itself: eyewitness accounts, a confession, or a weapon.
Circumstantial evidence usually is that which suggests a fact by implication or inference: the appearance of the scene of a crime, testimony that suggests a connection or link with a crime, physical evidence that suggests criminal activity.
https://en.wikipedia.org/wiki/Direct_evidence
In direct evidence, a witness relates what they directly experienced.
Circumstantial evidence, by contrast, consists of a fact or set of facts which, if proven, will support the creation of an inference that the matter asserted is true.
https://youtu.be/4xGluGlQgdA?t=310
Direct evidence, often in the form of eyewitness testimony, can be extraordinarily weak. On the contrary, DNA evidence, for example, is 100% circumstantial.
Isn't witness testimony notoriously unreliable? I trust nobody's memory, including my own.
What do you mean by “purely” circumstantial evidence? “A popular misconception is that circumstantial evidence is less valid or less important than direct evidence ... Many successful criminal prosecutions rely largely or entirely on circumstantial evidence”: https://en.wikipedia.org/wiki/Circumstantial_evidence
https://www.merriam-webster.com/dictionary/purely
> wholly, exclusively. a selection based purely on merit
---
> A popular misconception is that circumstantial evidence is less valid or less important than direct evidence
because you know ... knowing that a person's phone was in the vicinity at a specific time in a specific area is as strong as a video of person A killing person B.
Such a common "misconception".
Furthermore, we know that people get wrongly convicted. We know this because they get exonerated down the road. It's also a tautology. "It's ok to use circumstantial evidence to get convictions because the legal system currently uses circumstantial evidence to get convictions".
Some of us don't want to go to jail because we happened to be driving through the wrong place at the wrong time.
> a video of person A killing person B
Usually this would be circumstantial evidence because you have to infer it was actually person A and B in the video, and it actually depicted the murder. There could be alternative explanations, such as "that was my twin" or "we were performing a murder on stage".
Indeed, the common metaphor for the strongest possible evidence in any case—the "smoking gun"—is an example of proof based on circumstantial evidence Similarly, fingerprint evidence, videotapes, sound recordings, photographs, and many other examples of physical evidence that support the drawing of an inference, i.e., circumstantial evidence, are considered very strong possible evidence
https://en.wikipedia.org/wiki/Circumstantial_evidence
Legal Eagle's latest video contradicts this!
https://www.youtube.com/watch?v=f2kEGj-S1Tc
Wow. Quote:
> But I can’t think of a prior case where the feds unambiguously acknowledged using Google search logs this way: to, apparently, zero in on people who searched the wrong word at the wrong time.
They're not actually using it to zero in on someone, though. What they're doing is using it to build a case against someone they already suspect: Roger Stone.
Today, sure. Tomorrow, it may be what OP said.
Today, federal police randomly snatch protesters off the streets in to unmarked vans. Tomorrow, who knows...
You can always make a slippery slope argument, but it doesn't make it reasonable.
I can't imagine what you are trying to insinuate.
What's the difference between a trend and a slippery slope?
All changes are trends. Assuming that the trend will extrapolate to its logical extreme without supporting evidence is unreasonable, however.
Instead of abstract arguments and unrelated parallels let's get back on track with the specifics here.
Why/why not will scope increase in this particular way? What temptations are there? What safeguards are there?
Unfortunately, building a case in FBI terms often means entrapping someone in a crime related to the investigation itself, when they can't get any proof of the actual crime they are supposed to be investigating.
This reminds me of reading “Abraham Lincoln, vampire hunter” where they used his real correspondence to make it look convincing like he was some kind of American vampire hunter. It was amazing.
The reality is that when you have unrestricted access to anyone’s life, you can make them a criminal, whether by framing or surreptitiously surveillance. There’s a reason why a principle of our legal system is that you must first have reasonable suspicion of a crime before you investigate.
There is a glaring legal disconnect with popular web services, where they are not responsible for the content you post, yet the content does not really belong to you, for if it did belong to you, the service would have no right to give it up to police, that information being your property. This double standard allows tech giants to profit precisely at the expense of our fundamental rights. For further proof, ask yourself why they can arbitrarilly censor users despite claiming no responsibility for that content, because "they can do what they want with their platform". It is one or the other: they act like tbey own and are responsible for content, but without the legal ramifications of that reaponsibility.
Can someone answer whether this includes deleted search histories? I specifically go through and delete my search history. I’ve never searched anything illegal to my knowledge. But according to this you never know what will be illegal in the future.
You cannot delete your search history in any meaningful way from google. You can delete it locally and they have some account tools. They also have all of their request logs, trends, and other compiled data. The best thing you can do is set up your own VPN and do other steps to anonymize as a constant practice.
Won't the absent of traffic on your "normal" accounts make you stand out?
Maybe I wasn't clear, to protect your privacy you cannot have "normal" traffic. There are some browser plugs, I think chrome banned them, but you can still build them and install them yourself that will constantly make random searches in the background and click every advertising link on a page. If you have "normal" traffic, something like that may help.
There is no free lunch in this problem. You have to consistently protect yourself and your household network to avoid tracking. Also you will probably never be able to stop it fully. Understanding the ecosystem and how tracking works will help a lot and understanding your individual tolerance for tracking is crucial. I personally think it's hygienic to test out anti-tracking measures and I go for sprints with all of them running but also I use the internet like a nearly normal user a lot of the time.
If you want to take steps to learn more a good place to start is using an old computer or raspberry pi and try out some network level filtering like PiHole, having separate networks for IoT devices/mobile devices/home users/guests and doing routing to a VPN you set up yourself via a cloud host selectively for traffic, times of day, and device.
It does. Deleting your search history disassociates it from your Google account, but it is still associated with the first 24 bits of your IP address (this is considered anonymized because there are usually many different people who use IPs in that range.)
Anonymous enough that it doesn’t prove you’re innocent, but specific enough for the FBI to use it to identify you. Awesome! /s
Can someone ELI5 this for me and explain why I should/shouldn't be outraged about it? Neither the link nor the existing commentary seems to help.
Don't bother (or maybe bother if you really want to get into both "US politics vs. Roger Stone" or "FBI/Google vs privacy of the individual")
I mean you can see from Google Trends that a ton of searches for Guccifer were happening in that time period: https://trends.google.com/trends/explore?date=today%205-y&ge...
I suspect these IP address ranges are used for Mobile data as well so probably shared between multiple users. I recognised the TMO IP because I've used TMO 4G proxies that have IP addresses in a similar range. It should disturb you that someone in Florida may have searched for 'wrong' terms and then that was used as justification to investigate another person in Florida who happened to share the same IP range as the wrong searcher.
This is why switching from google to duckduckgo isn't as effective as switching to a search engine based in europe.
Sigh.
“Don’t be evil” presumes a lot when there are organizations that have machine guns and legal jurisdiction over you, and a public, decades-long track record of doing evil.
TBH, I think this is the wrong situation to trot out "Don't be evil."
Law enforcement has always been able to subpoena this type of information. From phone companies, credit card companies, ISPs, etc. If Google wants to legally operate in the United States then they don't have any choice but to comply.
The bigger issue, IMO, is that nobody has any idea who else has access to this information. Google can share this information with anybody. It's entirely on good faith that people trust them not to.
That’s exactly my point: it’s entirely naive and insufficient for Google alone to promote “Don’t be evil” if, at any time, known-racist and known-politicized “law enforcement” in the US can do whatever evil they wish with the data they’ve collected. When PRISM came along, they had no choice but to comply or suffer the same fate as Joseph Nacchio.
One would have to be a total fool to think that an internal prohibition on evil would be at all meaningful, even if somehow it were strictly adhered to. Literally nobody at Google is willing to be imprisoned to defy the orders of the nation in which its situated.
(Before you point out that it requires judicial oversight: please read a dozen federal search warrants. The standard for search warrants is hilaribad, and feds suffer no consequences whatsoever for putting whatever fantasies they want into their applications for same.)
Oh yeah, that I agree with.
"Don't be evil," was always a gimmick, IMO.
Not sure there's any real solution, though. As long as there's a government, there's going to be somebody who thinks it's evil.
>"Don't be evil," was always a gimmick, IMO. //
Always? It struck me that it was a genuine creed for a burgeoning tech company who recognised established tech companies were evil, and so were themselves endeavouring to be "not evil".
The worst people you'll ever meet are always very forthcoming with insisting that they aren't monsters-- well before you've had any cause to question their integrity.
Consider their business model from day 1. It didn't take long before the allegations of email data mining started to surface.
People who constantly status-signal over absolutes also raise concerns over hypocrisy and situational ethics.
What do you mean by this?
Yes, always. No company is explicitly, purposefully doing evil.
Also, "evil" is such a subjective word that it's almost meaningless with no context.
Here’s what non-evil thing to do with this information is: don’t collect it. If you collect, don’t store it. If you store it, try to de-identify it.
> Here’s what non-evil thing to do with this information
You do remember that Google is an Ad company, and information is the product, right?
And when the government finds out that they can't conduct investigations, they'll just pass regulations that require collection of data.
Take private owner gun sales. You have to collect the information of the person you're selling it to. You can't not collect it, and if you take the attitude that you won't, you yourself can be held criminally liable.
If we had cryptoanarchy -- unbreakable encryption, with everything on device, anonymous, and any server services using some future form of fully homomorphic encryption, and with financial transactions done with pseudo-anonymous cryptocoin, you'd find this to be a very unstable situation, and most world governments, even European governments, would quickly pass laws to require the ability to track identity, de-anonymize, and subpoena logs.
There is no way any of the Western democracies are going to move to a system where all records of activity are ephemeral and un-subpoenable.
You’re right – but at least when the government passes regulations that require collection of data, there is a public debate and a public record of precisely what must be collected and why.
They zeroed out the last octet of the IP addresses, which is technically de-identification.