That's a fallacy by both choice and externality.
There are cases in which there is no choice but to use specific corporate products, or in which choices are made without an individual's consent or involvement.
Karen Sandler, co-host (with former FSF directory Bradley Kuhn) of the "Free as in Freedom" podcast has an implanted, closed-source proprietary medical device. She can literally chose between non-free software (which includes surveillance), or death.
https://sfconservancy.org/news/2018/mar/26/sandler-fsf-free-...
Emergency medical services, government contracts, third-party contracts by various firms and organisations, third-party use of Gmail either directly or as a hosted email service (see Benjamin Mako Hill's "Google has most of my email because it has all of yours": https://mako.cc/copyrighteous/google-has-most-of-my-email-be...), and the issues of spillover externalities (Amazon Ring doorbell surveillance, third-party tracking of mobile phone SIMs, MACs, and Bluetooth signatures, facial surveillance) mean that, no, actually, you cannot decide not to participate in corporate surveillance.
And, as a final point, both government and corporate surveillance and oppression very often speak to the same underlying dynamic: that of power to defend both itself and its wealth and/or golden geese. Examples are numerous, though the Johnson County War would be a good case history: https://en.wikipedia.org/wiki/Johnson_County_War
Let's please put this canard in its well-deserved grave and bury it.
The overarching point is that it's naive to consider issues of privacy particularly distinct in the public or private sphere. Neither market nor political power are trivial to escape (and they have other things in common). Individual opt-outs will only get you so far from either a Google scale or state scale operation.
"No choice" in the sense that you lose business, lose touch with your high school classmates, or are forced to go out and pick up your own food from the restaurant down the street?
Or "no choice" in the sense that people show up at your door with guns?
What a privilege it is to be able to casually use the same language to describe such disparate outcomes.
Strategems in which individuals are denied the very fundamentals of life, food, shelter, work, engagement in civic, social, commercial, or cultural practices, access to courts, institutions, and the like, without overt threats of violence, are far more effective than guns.
to fight and conquer in all your battles is not supreme excellence; supreme excellence consists in breaking the enemy's resistance without fighting
I would expect that the greater debate on privacy will, over time, hopefully lead to some changes in how we are able to control the data generated by our bodies. Until that happens, I’m going to take the thing that saves my wife’s life with the potential for some shadiness or simple distaste at what may happen to her data, or, I might look at it as her voluntary consent which was fully given with her and my knowledge well ahead of time — helps to save others lives, and some loss of control of that data is actually quite noble.
As you might guess, I started at the abstract, but ended up at the concrete, and my wife really does have such a device, similar to your example. And I also work in big data analytics industry, and get involved in these sorts of discussions pretty often.
Let us agree that I can indeed avoid having a Gmail account. Can I realistically avoid sending email to a Gmail user?
Nope.
There are just too many users. Maybe I can avoid sending mail to <anything>@gmail.com (though not responding to one will invariably be perceived as incredibly rude), but I cannot avoid having Gmail users send email to me. I cannot realistically notice ahead of time that [email protected] is actually using a Gmail server under the hood, and not send the email. I cannot prevent Gmail users from talking about me.
I can reduce my exposure, but there are limits to what I can reasonably do. Your usage of Gmail is hurting my privacy. Okay, not yours, but definitely half of my friend's. I can't realistically ask them to either stop using Gmail, or stop interacting with me, now can I?
Let us agree that individual choices and individual actions don't work.
While I agree with your larger point, I don't agree with this subjective value judgement and am not sure why it's necessary to lump it in with the rest of your (valid) points. Why do I want to see ads for things I'm not interested in? How is that in any way "better?"
What I definitely don't want is unauthorized humans reading my email. (Even so, I have to assume that is exactly what will happen whenever I type or dictate anything into a computer. I've operated on that basis since before GMail, Google, or even the civilian Internet existed.)
And now they have a mighty powerful pattern matching machine, they can easily ask more than where I could possibly spend money. They could ask for my political affiliations, or my sexual orientation, my social network (who knows, I may be related to the second or third degree to some nefarious terrorist?).
That last one is very worrying. Especially since recently, my country (France) is being eerily harsh with political opponents. I've just read a story about a journalist (whose income happens to come from YouTube & donations), who is being judged for… gang theft (the pun also works in French), risking up to 75.000€ in fines and 5 years of imprisonment, just because he covered the unhooking of a 8€ portrait of our current president in a Town Office (which usually have president's portraits, but this is not mandatory). Unhooking, they reportedly did not even take the portrait.
So yeah, I'm more and more worried about giving our governments the means to apply their increasing insanity. Sure, having an individual reading my private email is unacceptable, but that risk is getting smaller and smaller, in comparison, to the mass surveillance that automation enables.
You'll have to detail this particular implication.
I for one would think the opposite.
* also FWIW, IIRC, they don't read email for ads any more.
Karen's and my 2019 FOSDEM keynote (and accompanying podcasts) discuss her struggles with the medical device industry and how those struggles relate to the larger set of choices related to technology that we make. This isn't an issue that lends itself well to short-form discussion. The issues are quite complex:
https://archive.fosdem.org/2019/schedule/event/full_software...
https://archive.fosdem.org/2019/interviews/bradley-m-kuhn-ka...
http://faif.us/cast/2019/jan/13/0x60/
http://faif.us/cast/2019/feb/19/0x61/
But it was far too specific (and frankly too obscure) to serve as a general basis for argument. Pacemakers used to run on plutonium. Should that influence the larger debate over nuclear power versus fossil fuels?
If someone has to use a pacemaker or insulin pump that runs proprietary software, that's unfortunate as far as it goes, but the patient himself/herself is fundamentally fortunate to have that option. It would perhaps be better to focus on developing open-source alternatives than to rail against a particular manufacturer's policy... except the (captive) regulators will have something to say about that, won't they? Specifically, what they will have to say about the idea of an open-source pacemaker is "No."
What you are complaining about in this specific instance isn't corporate policy, but government policy. I'm actually very sympathetic to your argument, personally. I've made the point many times that any sufficiently-dominant corporation is indistinguishable from a government. But you need to be careful to identify the party who is actually forcing or denying choice.
Not specific enough. What they would most likely object to is code you can modify. Code you can inspect on the other hand is a whole 'nother business. And one could easily guarante their pacemaker runs the code the manufacturer says it runs, by having reproducible builds, signing the source & binary, and have the device itself communicate (at least) a version number.
Being able to modify the source would be potentially even better, but if we could at least inspect it, then we would know of bugs & vulnerabilities (some of which have affected Karen Sandler in the past), and the manufacturer would have no choice but be shamed and correct the error.
If you require home internet access to do your 30k salary job, you move into an apartment, and they tell you you have one option for internet access, you have literally been restricted to a single corporate product and subject to surveillance.
Example: Doorbell Cams taking video of you walking by, uploading it to a corporate database, identifying you using photo recognition algorithms and your location using the home's address, and using that information to sell you things.
This should not be taken for granted -- in the UK I was twice (very politely) asked to leave because I was taking a picture and apparently a gov't building was in the background (and you need a permission to photograph those!!) and the second time because a school volleyball competition was played in the background. This is stupid because if I did it with a phone instead of a DSLR no one would notice.
Maybe some limits on commercial photography in public spaces makes sense, but I would not go as far as putting strong limits on it altogether. My 2c.
In my opinion, we need to start treating data about users as intellectual property. Generally speaking, you don't have to worry about intellectual property when you're doing something personal. I can say "Just do it" all I want. In the same vein, I can make casual observations about random people on the street without having to worry about violating their privacy (that guy has cool shoes!). But if I start to use "just do it" in my business marketing materials, I'll be in trouble. Similarly, if I start keeping a database of somebody's shoes every time I see them so I can try to sell them something, that should be illegal.
All of our legal precedent about privacy, law enforcement surveillance, commercial data gathering, etc, really dates to the 1800's and early 1900's when things were fundamentally different. There is a qualitative difference when information can be automatically processed in aggregate.
I don't really care about individual corporate -- or LE -- surveillance actors if the data is partitioned over many and requires real subpoena power or active, limited sharing. If there's thousands of cameras owned by homes and businesses in my town, and everyone uses the pictures on their own for their own purposes, and law enforcement occasionally asks for and/or subpoenas the data when it'd be particularly useful and there's at least some suspicion-- that's great.
On the other hand, when we automatically read license plates and form a big database about where everyone goes every day, that's not so great. When individuals are all subject to mass-scale surveillance that we use with data processing and machine learning to manipulate those people-- that's not so great either.
The horror.
The threat isn't corporations. The threat is when the government goes rogue as governments tend to do unpredictably from time to time. The threat materialises in the government using private corporation data to target arbitrary minorities (although usually the educated, wealthy, foreign and free-spirited).
People seem to think that because it "could never happen here" they can just ignore the possibility. Then it turns out that that sometimes it can.
Privacy isn't just about the world as it stands today. Privacy is an acknowledgement that the present and the future are linked and that the future may be profoundly different from today. People aggressively selling you things is more harassment.
In a thread about surveillance, why are you drawing a dichotomy between different surveillers and basically giving one a pass? They're both prongs of the same threat! On the collection side, every bit vacuumed up commercially is available for use by the government. And on the use side, there is little difference between a government proper and corporations that have achieved enough power to exert de facto governmental control - especially when colluding through a common third party.
> corporations that have achieved enough power to exert de facto governmental control
Might be a failure of the imagination, but I really can't see myself ever getting involuntarily dragged out of my apartment by McDonalds employees. The worst I've ever seen a corporation do is set the police on someone. As long as the government is functioning sensibly a rogue corp can only do so much.
On the large scale, I do not want these entities to have access to weapons-grade behavioural models. On the small scale, I do not want them to have compromising information about individual behaviour. They will use whatever leverage they gain to enrich themselves far beyond their utility.
"want". Do you actually desire them, or were you persuaded/tricked into it? :)
Also do not underestimate the influence of corporations:
* https://en.wikipedia.org/wiki/William_Randolph_Hearst#Spanis...
* https://www.newyorker.com/news/daily-comment/kochland-examin...
It seems to me that if an advertiser can convince me to spend money then I wish they'd done it sooner. I can easily imagine having bought my first smartphone after seeing an ad. It wouldn't be a trick.
Corporations are worth keeping an eye on, but governments are more unreliable, less governable and generally have larger professional military. And if a corporation acts it is usually in concert with a government.
Are you an American? :)
1. Persistent psychological manipulation (advertising), including political manipulation, based on knowing your weaknesses better than you know yourself.
2. Punitive insurance rates based on unreasonable inferences, especially for mandatory insurances. Like say doubling your auto insurance rate for buying more than a few beers per week. Or your health insurance going up due to buying power tools.
3. Blacklisted and prevented from working industry wide. A good concrete example I got from HN just the other day: https://en.wikipedia.org/wiki/Consulting_Association .
4. Prevented from or price-gouged when using vital services. For example - the unbanked (ChexSystems), recent Internet censorship (Visa/MC), Internet service ("six strikes").
The issue isn't the straw man of being "dragged out of your apartment by McDonalds employees", but rather being prohibited from buying food due to being uniformly banned from McDonalds, Burger King, and Walmart - say you've previously shoplifted but have served your sentence, are simply wrongly accused, or perhaps just didn't respect a sign saying to take off your sunglasses.
I know you're likely to respond to these by defining them away as not being problems in your paradigm, but paradigms are only as good as their constructive results. Our current politicatastrophe is basically due to people clinging to their chosen paradigm way past its utility. FWIW our modern society is indistinguishable from a "Libertarian Paradise" where USG is a private corporation that owns everything and who've you've contracted with to be here. An axiomatic approach of morality-by-construction doesn't work - the only way is to judge qualitative situation.
Is it just supposed to be self-evident that those inferences are unreasonable?
I've always thought that this was an interesting argument. If there is some form of correlation with beer consumption and and car accidents, wouldn't it make sense to adjust your estimated risk based on that information?
I do find it self-evident that that would be a bad thing, but I also have a hard time putting my finger on why.
Directing focus at "people who drink a lot of beer" means considering people who who drink a lot of beer at home as guilty by association, ultimately due to the subjective priorities of whomever pushed for that model.
Obviously in the expected value sense, charging on correlations is lucrative for the company (as is any justification for raising prices on a set of customers if your competitors do it too). But in the exact same way as saying certain zip codes are more likely to default on a loan, which we rightfully reject.
Why would we reject that zip codes are more likely to default on a loan? Seems like information I would like to be aware of if I was a home lender.
I certainly look at crime rates of a community before I live there. While a bad crime rate certainly doesn't make potential neighbors "guilty by association", it certainly increases the likelihood that one of my neighbors might be actually guilty.
Nope. Because it's flawed reasoning. If many people who get into accidents were driving drunk and everyone who drives drunk buys beer it might seem logical to increase rates for everyone who buys beer, but people who drive drunk are only a small percentage of the people who are beer buyers. That kind of reasoning seems more likely to be a weak justification to raise rates for a large number of people than a reasonable response to a trend.
If the insurance companies could arbitrarily raise rates due to a trend that doesn't exist, than they would have already done so. These companies know their margin and they don't bid above that if they want to be competitive.
that assumes that all companies involved aren't doing the same thing. Corporations figured out a long time ago that when one of their competitors does something that makes them more money at the expense of their customers they could start doing the same thing to their own customers and profits increase for everyone without risking prices being driven down by a truly competitive market. The insurance industry in particular is has a long history of shady practices from good old fashioned collusion and price fixing to new techniques like data mining to charge customers different rates depending on where they live, what jobs they have, or how often they're willing to change insurance companies.
In my view, the insurance industry looks competitive, which means that even though these shady practices happen they can't effectively dictate the entire market.
One of the tendencies of the neo-puritanism that has become prominent in the last decade is a real willingness to abandon any boundaries that have kept corporations from using certain kinds of information against individuals -- boundaries that were in large part legislated during the civil rights era.
It's the job of the insurance company to accurately assess risk and charge me that plus their margin. If the companies can more accurately assess risk, than that makes insurance a less volatile and therefore cheaper market.
Insurance companies don't have access to the actual root causes of accidents. They have no measure of my driving skill or risk tolerance or attention span. They just estimate based on some really primitive data they have about me. What's the harm in including more data?
For example, EU corporations are required by GDPR to comply with deletion requests, unless they are asked to retain the data by a government.
Especially in modern society government and corporate interests are increasingly interweaving. And I'm no more comforted by governments having access to dystopic levels of personal information than I am by corporations having that access. It just so happens that, in practice, there's no difference anyhow.
[1] - https://en.wikipedia.org/wiki/PRISM_(surveillance_program)
It was a f---ing web-form for sending targeted, narrowly-scoped, legal notices. Nothing more, nothing less. It was not some magical all-seeing Eye of Sauron that gave the NSA a backdoor into every word you ever said online, your blood type, and the number of nose hairs that you plucked this morning.
The really illegal backdoor, unscoped intercepts, including the cable taps, were done without the consent of most (all?) of the companies in question, and were not done through PRISM, but rather through physical access to, say, cross-datacenter cables, straight up hacking, and similar means.[1]
[1] See: SSL added and removed here :v) https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her...
To start with "IS, not WAS". PRISM hasn't gone anywhere and the most reasonable path here is to expect it's only substantially grown - as it already was doing at the time of its initial reveal. This [1] is a snippet of the PRISM collection overview. Data is sent straight from the partners to a DITU - data intercept technology unit which then processes the data in various ways before being sent on for further processing to appropriate nodes and ultimately becoming searchable through PRISM.
An example of a DITU is here [2]. Microsoft provides unencrypted access to the NSA to user emails. One slightly tricky thing here was Microsoft deciding to roll out a new 'alias' feature enabling users to send emails under an alias. The DITU for outlook there ensured that NSA tracking would remain consistent regardless of the identity chosen by the user. Finally this [3] is a snip of the slide revealing the scope of data available from various partners. [3]
And yes, there is supposed to be a formal request where an analyst requests our secret court system approve a search before they carry it out. That process is unsurprisingly a rubber stamp - the court approves 99.97% of all requests. But more importantly this is something with no meaningful oversight. As Snowden emphasized, "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
So, yes it would be much closer to calling PRISM the all-seeing-eye than it would be to a system for sending out warrants. These systems are the reason that the Utah data center was built with storage estimated on the order of exabytes. One exabyte being a million terabytes.
[1] - https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
[2] - https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
[3] - https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
The data that is sent into the PRISM system is data that is sent by cloud providers, in response to a targeted warrant. The data is not collected whole-sale - it is targeted to a particular individual. That's the whole bloody point of warrants.
Once it's been sent by the cloud providers to the NSA, it ends up in a searchable database. I don't understand what is remotely controversial about that. The source of the data was not whole-sale collection - it was targeted warrants. That it becomes searchable afterwards is not relevant to anything. There is nothing illegal about police retaining data, and maybe even putting it in a searchable database, as long as that data was legally obtained - at least, in the United States.
> And yes, there is supposed to be a formal request where an analyst requests our secret court system approve a search before they carry it out. That process is unsurprisingly a rubber stamp - the court approves 99.97% of all requests. But more importantly this is something with no meaningful oversight.
I'm not sure you understand what the purpose of search warrants is.
Search warrants are overwhelmingly rubber-stamped by courts, regardless of whether it's a secret FISA court, or a local judge who works two days a week in Small Town, AK. The point of having to get a search warrant is not to obstruct the work of police. The courts don't interpret that to be their job.
The point of having to get a search warrant is to prevent fishing expeditions, and to make sure that police are conducting a narrow, targeted search. Most judges will rubber-stamp a search warrant for Bob Joe, based on incredibly flimsy testimony. Most judges will tell a police department to go pound sand if they wanted a search warrant for an entire town.
As long as those FISA courts were dealing with search warrants of the first kind (And all evidence points to this), rubber-stamping them would not have been any different from how regular courts rubber-stamp targeted search warrants.
> "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
You are conflating two separate parts of PRISM, in a misleading manner.
The first part is how it requests data from cloud providers. It does so by targeted warrant. This is incredibly similar to how regular police operate. They get a targeted warrant, a judge rubber-stamps it, and they serve it. It is incredibly likely that this is not illegal.
The second part is that after it has retrieved the data, that data goes in a database, where every Tom, Dick, and Harry that works for a TLA can search for it (And go on fishing expeditions, in the already-retrieved set of data). This is also not illegal. If you think it is, please point me to legislature, or court precedent that implies that information obtained by the police in a warrant cannot be put into a searchable database.
You are conflating the two, by making it sound like every Tom, Dick, and Harry that works for a TLA can go on an untargeted, whole-sale, unwarranted fishing expedition on Hotmail.com. The simple fact is, they can't. Not via PRISM, at least. This is why the NSA was conducting criminal tapping of cross-datacenter links - because PRISM only let them serve targeted warrants, and they wanted raw, whole-sale, untargeted, backdoor access to your data. That, for some reason, most of the firms implicated in the leaked NSA files were not granting them, hmm...
[1] - https://www.washingtonpost.com/investigations/us-intelligenc...
If you don't feel comfortable with the government having that data, I wouldn't suggest giving it to private corporations. Even if they are standing up to gov, it means things can change. I think Snowden uses the phrase "turn key tyranny".
On one hand, I hear ya and agree.
But the reality is, the deck has been reshuffled such that while we're focused on that front door about rights are being sucked out the back by the likes of Big Tech, social norms, etc.
Yeah, the means differ. But in the end, the ends are the same.