I suspect we as a society need new legislation to deal with these sort of issues. Before, much of this was incredibly difficult to impossible so legislation and regulation was entirely avoidable and relatively rare occurence could be dealt with on a case-by-case basis.

At this point, technology has enabled this sort of behavior at mass scale, now revealing far more personal and useful information about individuals.

A feasible model to work from may be go look at the healthcare industry and HIPPA requirements/liabilities and adapt as needed. Certainly not perfect but it's a good starting point for widespread data laws.

The question is, will our representatives actually give teeth to real data protection legislation (not a facade with no teeth only enacted by name) in the US or are they too deeply in bed with industry that they'll protect business rights over real people who suffer real direct damages.

So I originally studied chemical engineering, and one of the common catchphrases is, "regulations are written in blood." The reason there's a requirement to put a pressure relief valve on that tank is because at some point a tank like it didn't have one and it blew up and killed people. However, safety in chemical engineering has been evolving over centuries as we have understood more about the dangers and consequences of dealing with chemical manufacturing.

For software, it feels like we're only at the beginning of understanding the dangers and consequences of the software, business models, and technology our industry has created. Unfortunately, if it follows the same path as other engineering disciplines, we likely will experience decades or centuries of bloodshed before it is regulated appropriately.

But that's not an interpretation of that phrase at all.

It makes me think of signing inescapable contracts with demons, which seem convenient but ultimately doom you for eternity.

Nothing about 'regulations are written in blood' is about convenience. Regulations specifically exist to make things less convenient. The reason such regulations exist is because people did the convenient thing and it killed somebody.

they are convenient solutions

What the hell are you talking about? I'm not libertarian or ranting, I'm saying this is a complex issue and the "LETS REGULATE IT" feels premature given how complex and subtle the issue is, and how hard laws are to change once they're on the books.

Methinks you're projecting more than a little bit. Also your comment is some of the most toxic I've seen on HN in a little while, and I'm not exactly a ray of sunshine on here...

Definitely getting a flag from me, and I think that might be a first.

> I'm saying this is a complex issue and the "LETS REGULATE IT" feels premature given how complex and subtle the issue is, and how hard laws are to change once they're on the books.

There is a difference between "This specific regulation fails to take X into account" or even "This is a complex issue which requires carefully crafted regulation" and your stance which seems to be that regulation is impossible or undesirable due to the complexity of the issue or because it might be annoying to change later. That very much suggests your problem is with regulation itself.

Just out of curiosity, if you think regulating this is a bad idea, what do you propose to fix the problem? Appealing to the good will of companies who would gladly exploit us to make money?

Why do you think I said regulation is impossible or undesirable?

I suppose it was somewhere between when you said that government shouldn't regulate or try to fix the problem until they have a better understanding of it ("this is a complex issue and the "LETS REGULATE IT" feels premature given how complex and subtle the issue is...We need to understand the full scope of the problem, rather than try to fix what isn't fully grasped") and that you don't think the government is capable of doing exactly that. ("I have very little faith in the US government to accurately grasp the subtleties and nuances of the advertising and privacy problems")

I acknowledge that you may have just worded things poorly, or intended your words to mean something else which is why I prefaced by question with "If".

If you actually do think the US government should regulate this, how should that be done given your concerns of their inability to understand the issue and taking into account the fact that any mistakes they make will take effort to correct once it's been put into law?

Are you open to the possibility that you treated me overly harshly, and that I've never actually taken the position you seem to badly want me to have taken? Or is that beyond the pale, and this is exclusively my fault?

To try and contribute to this conversation a small amount, it makes the most sense to me to establish a Professional Engineer like system for the software industry. I don't know all of the details about how these systems work, but a friend of mine is a structural engineer and as he's described it to me it creates a personal ethical obligation that currently feels entirely absent from the software industry.

This ties the regulation to the industry, lets the experts decide what is and isn't okay, while also involving personal ethics and keeping individuals accountable for their decisions.

Keep getting called by a spam bot? A licensed engineer can be tied to that system, and can be punished.

A self driving car had a bug that couldn't tell the difference between a plastic bag and a child, forcing the vehicle into a concrete barrier? Someone stamped that code, and is now accountable.

Is a company using your tracking data to raise your medical bills based on your online food order history? That company's engineers are liable, you can sue them personally.

Again, not sure of the details about how this works in the construction industry, but when you put professionals at personal risk, they tend to care more about the outcomes, and it doesn't end up forcing the US government (specifically legislators) to understand all the details.

I'm fully open to the possibility that I've misinterpreted some of what you've said.

I wouldn't mind seeing that kind of system applied to some software companies. I'm not sure that fully solves the problem, but I really do like the idea of having someone willing to be held accountable for problems.

I think one issue with this would be that companies who keep their activity opaque enough are highly unlikely to be caught by users. A major data leak or a hacked system might be detectable, but a backroom deal to share data with a medical or insurance company would likely go undetected without a whistleblower to expose what was happening. If a bridge collapses, or a fire starts, or a floor sinks, it's a little easier to see when building/fire codes weren't followed.

I think a system like this would be best used when some rules are already in place for what a company can and cannot do. Then a company's certified security/privacy person would be responsible for making sure everything was done in full compliance with whatever guidelines were established. This would probably be needed anyway if you tried to sue the company's engineers later. If nothing they do with your data is actually illegal those lawsuits won't get very far.

I do agree that compliance checking and having that level of accountability could help developers rein in marketing teams, greedy shareholders, and stupid managers who put pressure on them to add tracking and anti-consumer code to their products.

I do worry about what it would mean for small startups, volunteer/personal projects, and single developers. It might be a more secure world if anyone who wants to write an app can't just slap a boilerplate notice that they aren't responsible for anything if you choose to use it, but my guess is that there might also be a lot fewer apps.

That's what regulation does, it restricts the players in a field to the ones who have the resources to follow those regulations. It is definitely a limiting factor on an industry, but I thought we were sort of assuming that the rampant "anyone can play" nature of software was the source of many of the industry's problems right now.

My point is that if someone has to do it, I would A) want the industry to police itself (let me finish) and B) would want individuals to be unable to hide behind corporations, to the extent that is reasonably possible. These together could, I believe, make more of a dent in the problems in the software industry today than any one specific topic of legislation (e.g. privacy laws or digital advertising laws) could.

Imagine if you could lose your software license for writing adware! Would it stop everyone/everything? No, definitely not. Would it give your average corporate software engineer a leg to stand on when they try to say no to their bosses when the business wants to start selling customer data unethically? Hell yes!

"I could lose my license if I add that feature." <- huge impact.

I mean, you saw "regulations are written in blood because people died and resulted in them getting passed" and thought a proper response was "let's not have any regulations at all because they're hard to get rid of and slow business down" so you're at least taking the libertarian position, regardless of whether you identify as a libertarian.

And no, nobody else has ever interpreted "regulations are written in blood" in that fashion, nor is that a valid interpretation of that saying. That is in fact the opposite of what the saying means.

There are wrong answers to questions, I understand that it may be uncomfortable to be told that but it doesn't change the fact that nobody else ever interpreted that saying that way, nor does it really make any sense to interpret that way.

Your jumping into semantic arguments about well I said it therefore it's a viewpoint is especially unproductive to the overall discussion. Like sure, but (a) that's not relevant, and (b) not all viewpoints are good, it's not a valid viewpoint just because it's a viewpoint. It's also where you start seriously leaning off into sealioning/tone argument instead of, you know, discussing why regulations are written in blood.

Hope this helps, I'm trying to keep this as even-keeled and matter-of-fact as possible - which certainly poses a challenge once you've poisoned the well by throwing around accusations of toxicity. That's a burden on me, everything I argue now has to be sugarcoated lest it further reinforce you as being the victim, which is of course the whole reason you dove into tone arguments.

That is part of the problem with "no offending anybody" type rules - it becomes very easy to cry "toxic" and play the victim and that lowers the quality of discourse, because nobody's opinion can ever be wrong lest they get offended.

Honestly I didn't read this past the first two words, because I don't think a continued conversation with you will be productive.

Take care, have a good day!

Not familiar with that interpretation, though there is another similar one that refers to what you mentioned: “written in stone”

>will our representatives actually give teeth to real data protection legislation

No. The majority of them don't even understand what data is being collected, how it can be used, or the technology behind any of it. Until the people in office change, the idea that our representatives can or will protect us is toothless and spineless.

Yes, because that's what they are - representatives. Of a general public.

The only way to make these chameleons (pretend to) care about an issue is to make the general public (aka voters, source of their wellbeing) care about the issue.

What trouble Congress is in! They have to be experts in law, warfare, every industry from oil refining to adtech, science (at least as far as funding it goes), ecology, economics, medicine...

In fact I would say that it's impossible to expect anyone to understand enough to know what they're legislating. Aside from being a powerful libertarian argument against the excessive involvement of government, I think it shows that we have to figure out a way to work around the fact that congressmen don't understand everything that they're in charge of, rather than trying to remedy it.

Congress used to have an office which would inform them of how things work, but unsurprisingly, proceeded to dismantle it. https://en.wikipedia.org/wiki/Office_of_Technology_Assessmen...

This is why members of Congress have staffers and various groups like http://www.loc.gov/crsinfo/ which have subject-matter experts on staff to offer advice and research arbitrary topics of legislative interest.

That's a cop-out. Data use and technology are major issues that are required understanding going forward. Understanding the oil industry is not at all the same as having a basic understanding of technology. Technology usage is only going to grow in scale.

A quick refresher on the details of how congress actually goes about their day-to-day plus the roles of the various permanent government and de facto government organs, shows "expertise doesn't scale" isn't really a problem. If it was, the whole thing would have come toppling down ages ago. So the libertarian argument is only "it's hard to do well", not "it's impossible".

I'll leave you to find your own references to get a detailed picture, but in short two basic forms of organizing do a lot of the work: big teams/staff for each congressman to help out, and special interest committees and caucuses. On top of that at least some take the idea of "representation" somewhat seriously, so if they need to know about a topic they're not experienced in, they tend to meet with supposed experts in those topics (which can come from a dedicated pool, lobbyists, state university department, and occasionally private industry owners or high level employees) for information and sometimes policy recommendations.

> I suspect we as a society need new legislation to deal with these sort of issues.

Why not ban targeted advertising altogether?

Because it has value, both to the advertiser and to the target, compared to un-targeted advertising. Advertising is an attempt to transfer information. Targeted ads means that the information is more likely to be relevant, whatever its other downsides. Let's not throw out that baby with the bath water.

"Advertising is an attempt to transfer information" is deeply misguided unless you adjust that to say "transfer very biased information". Advertising is an attempt to influence one party to give their money to another party, generally through manipulation and guile.

Targeted advertising is like the difference between spam and spear phising. The person being advertised to rarely (if ever) benefits.

> The person being advertised to rarely (if ever) benefits.

Instagram has gotten so good at targeting me that I probably click on at least 1/2 the ads because I find them interesting. I've purchased things because of those clicks too, and have enjoyed the purchases. Things I would have never known about were it not for the ads.

I benefit if Youtube shows me advertisements for desk chairs and lathes instead of beauty products and kids toys. Targeted advertisements help me discover new products and product categories, while untargeted advertising just wastes my time. This is in essence no different than companies buying advertising time in specific TV shows with a known audience.

Of course the abuses are also plentiful and dangerous. We probably do need a lot of regulation. But in general targeted advertisement is a useful thing to have.

The equivalent of buying advertising time in specific TV shows with a known audience is... buying adverts on specific Youtube channels with a known audience. Funnily, a lot of Youtubers now perform advertising of this sort - I'm sure you've seen the VPN ads.

This, like TV, doesn't require tracking of individual people who haven't consented to such.

> This, like TV, doesn't require tracking of individual people who haven't consented to such.

That's a stretch. How do you think they determine any information about the "known" audience? Obviously, they do all sorts of research to determine more about the audiences watching certain shows and channels, likely by sifting through social media, show reviews (IMDB, etc), and elsewhere to determine who's watching what shows, then looking into their profiles to determine their interests. Aggregate that data, find what they all have mostly in common, and cater to those interests. It's just a more generalized and difficult process of the same thing, and eventually it's going to become more narrowed and specific to individual targets.

The difference is that if I don’t want to let anyone know that I watch My Little Pony... I don’t have to! There’s no little black box connected to my TV that tells an advertiser that I’m watching it without asking me.

I can also have a discussion with my friends about My Little Pony and how amazing the last episode was without an algorithm picking that up, unless I publish it to the world or explicitly send it to the advertiser.

I understand your point, and I agree that it's easier to keep your television viewing habits hidden from your internet viewing habits, for obvious reasons, but I'm just pointing out that there are still ways to aggregate data to the point where they are able to determine, with significant accuracy, which ads are the most effective based on demographics, locality, cross-referencing social media, web traffic, consumer surveys, department store sales information, and probably tons of other details.

They benefit when they use valuable services for free, which is paid by targeted ads.

“Targeted advertising” is just a euphemism for the secretive creation and sale of dossiers on unwitting Internet users. It should already be illegal under existing laws.

In most cases, this isn't true. The dossiers and maintained very closely by Facebook, Google, etc in order to leverage their knowledge on a target to produce the most effective targeted ads. If they sold the dossiers, they would lose the continued revenue.

No advertising is really untargeted. Even billboards tend to carry ads for the type of driver that passes by them and broadcast TV has ads for the type of person that watches that show.

Ads targeted to an individual without that individual's consent should probably be banned. In addition, the law should make it clear that when a company does hold data about individuals, the individual should have some rights to that data including the ability to block the sharing or transfer of that data.

So, when Google buys FitBit, every user of FitBit should have to explicitly opt-in to their data being transferred to Google.

Most things has value by some definition. Question is if the sum is positive. I'm not sure that is the case for targeted advertising.

Targeting doesn't work. There is no baby.

I recently bought a set of clamps on Amazon to join two shipping containers together. Since then I've seen a bunch of related ads, such as for shipping container vents, shelving, etc. I clicked on a couple of those ads, and while I didn't buy anything, I did learn some useful information. I probably would have learned less, if anything, from untargeted ads in those same slots.

> while I didn't buy anything

And so targeting didn't work!

Yes, "targeting" can put stuff in front of your eyeballs that may occasionally have marginal utility, but for sales? Nu uh.

In the baby/bathwater metaphor, you saw some ads for strollers. Still no baby.

It didn't work for the advertiser, but it did for me. I learned about options and prices for container accessories, which will help me make future choices. I would not have been better off if those ads had been less interesting to me.

> Advertising is an attempt to transfer information.

If you want to inform me, just give me a website I can visit where I can enter my needs and provide perhaps some context information, and which deletes/forgets this information when I leave. There is no need AT ALL to figure this info out behind my back.

The use-case isn’t advertising, it’s QoS. So you collect the data and give your best customers fast access, or maybe you balance it out: your most complaining customers get preferential treatment and the most reasonable wait a little longer on the line because you know they won’t complain.

Or, framing it more broadly: mass personalization implies a worse deal on average for everyone on the atomized/consumer/low-power (individual) side, because the high-power participants (companies) will optimize their outcomes at the expense of individuals.

Isn't GDPR enforcing on this vein? You could build something similar in North America.

Looking out how the spam act played out, which allows implicit opt in compared to Europe’s explicit opt-in.

I believe US govt will always be at the mercy of corporations.

Now some things are great. Like CCPA, California’s version of GDPR. But getting it accepted throughout the US is a mammoth task.

I have hope though.

I've been wondering: if there was a world government, corporations would probably reach a point in which they are unstoppable from a law point of view. The bigger the machine, the harder to steer it in a good direction.

This is already a big (and largely unaddressed) problem with the big 3 credit CRAs, if you know enough about a person you can very easily request their credit report and get the keys to the kingdom (so-to-speak) - everything you didn't already know.

I mean, I already request credit reports for my husband without issue, for example (with his permission! - he finds it much easier to just ask me to do those things for him rather than doing them himself).

In this case, since email address is part of the report they could only send the report to the email address on file for "security," which would be a big improvement over what the big three CRAs are doing with annualcreditreport.com.

CRAs are a scam from top to bottom.

A bank makes a lot of money, but in theory, it's doing an important job which benefits society. That job is independently assessing creditworthiness. Of course, it's hard to assess creditworthiness if you don't know if someone is making a lot of loans at different places. So, there needs to be a system for credit monitoring. But credit monitoring is not credit rating. Credit rating is the one job a bank is supposed to do. Letting someone else do it undermines the whole purposes of the independent financial system. We might as well just dissolve the banks and move to a centralized planned economy if that's what we're doing, so that at least the centralized rating agencies will be democratically controlled.

So, to begin with, CRAs shouldn't exist and undermine the basic purpose of the financial system. On top of that, they are incredibly incompetent and corrupt as seen by the Equifax breach. It was clear in the early 2000s that the old system in which people would present a few pieces of relatively obscure personal identity to open a line of credit was no longer workable because the data was now subject to trivial duplication. Instead of fixing this, the industry created the concept of "identity theft" in order to falsely shift blame onto an unrelated third party.

I "had my identity stolen" a few years ago. The event had nothing to do with me, so all of the language around this is wrong. What actually happened was first a criminal learned some information about me, then Verizon chose to give the criminal a line of credit on a cellphone, then the CRAs reported that I was profligate to anyone who asked. Saying "my identity" was stolen makes it seem like I was somehow a party to any of this. "My identity" is not a property of mine; it is a property of the reliability of the CRAs' data. What actually happened was the CRAs had their data polluted by the combination of a criminal and lax identity checking at Verizon, and then the various guilty parties forced me to do their data cleanup for them.

What should have happened in the mid-00s was that the credit monitoring agencies, created systems where you can prove your identity to a notary public and get some sort of signed certificate gizmo that you can use to get a cellphone or make a car loan. But because the whole US financial system is corrupt, it instead outsourced all of the liability onto consumers.

Agreed. The whole idea of "identity theft" stinks of PR lubrication. Your identity cannot be stolen, but "identity theft" is a clever, cynical sleight of hand that obscures what really happened: credit fraud, specifically fraud that is the responsibility of the party issuing credit and the criminal propagating it.

I agree with this idea in principle, but I am unsure of how it would work in practice.

Say you open a credit card, then try to say it wasn't you..... what would a bank need to do to prove it was you? The things they would provide are already the things they have... your signature, your information, etc. What EXTRA bit would they start collecting that would prevent fraud?

Currently, banks ARE on the hook for fraud.... if you dispute fraudulent credit opened on your behalf, they have to eat the cost.

I don't quite see what the difference would be in this alternative world... currently, someone applies for credit, the credit issuer decides it is legit, and issues the credit. That would still be the same. Say it was fraudulent; the fraudster doesn't pay it off, so the issuer tries to collect... at that point, you say "hey, I didn't open this credit!"

Well, the issuer is going to say "yes you did, here is the information I have saying it was you"... how would that be different in your alternative world? Maybe you would require more verification steps... but what? Picture of you holding a sign saying you signed up for the credit? Video? What could you possibly provide that couldn't be faked for fraud? What could the issuer require?

At this point, things are no different than now. The issuer says it was you, you say it wasn't, and then someone has to arbitrate and decide who was correct.

I guess I just don't see how we can do it better (although I would LOVE to do it better!)

It has been done better in other countries and could be done better in the US if there were political will to do it. There's a whole universe of cryptographically signed certificates that we in the US don't use. The hard part is not signing a cert; it's making sure the certs are given to the correct people and having a procedure for when a cert is lost. Estonia has done this well; Korea has done this poorly. But it's quite doable if you have political will for it.

Does that then make the cert a high value target? How do you get people to protect it and use it properly? If it is stolen, does it actually make it HARDER to prove you didn't open the credit line?

This is not a theoretical topic. Other countries have electronic signature system and you can evaluate how well or poorly they are implemented: https://en.wikipedia.org/wiki/Electronic_signatures_and_law

The issuer and arbitrator are, if not the same entity outright, are so far in bed together they should be common-law spouses. Let me explain one of 2 possible outcomes based on socioeconomic factors.

A) you have money to keep a lawyer on it; No problem.

B) you don't have money for a lawyer; Tough shit.

Nothing beyond real unilateral enforcement of the system already in place is required.

> What actually happened was first a criminal learned some information about me, then Verizon chose to give the criminal a line of credit on a cellphone, then the CRAs reported that I was profligate to anyone who asked. Saying "my identity" was stolen makes it seem like I was somehow a party to any of this. "My identity" is not a property of mine; it is a property of the reliability of the CRAs' data. What actually happened was the CRAs had their data polluted by the combination of a criminal and lax identity checking at Verizon, and then the various guilty parties forced me to do their data cleanup for them.

Right -- and really, that should be some class of negligent libel on behalf of the CRAs.

> We might as well just dissolve the banks and move to a centralized planned economy if that's what we're doing, so that at least the centralized rating agencies will be democratically controlled.

In the history of central planned economies, never have they been “democratically controlled.” Despite the name, places like the Democratic Peoples Republic of Where-ever are never democratic nor are they republics.

> because the whole US financial system is corrupt

Is that actually true or just hyperbole?

It's actually true. If you don't believe me, go try to start a bank. Here's a handy link to get you started:

https://www.federalreserve.gov/faqs/banking_12779.htm

How does your link support your assertion of corruption?

The link doesn't. The experience you will have if you actually go try to start a bank will. I only provided the link to point you to the entrance of the rabbit hole.

I don't see how the fact that the process of becoming a bank is strictly regulated means that it's corrupt?

It doesn't. What makes it corrupt is that banks are not in fact strictly regulated, it only appears that way. But there is no way I can prove that to you in an HN comment. I would have to write a book. I can point you to a lot of circumstantial evidence but there is nothing probative in the public record (see below). The only definitive evidence I have of the corruption in the system is my personal experience, some accounts of which I have published on my blog. But if you don't put credence in my conclusion, then you will likely not put credence in my evidence either, because I can't prove any of it. The only way I can prove it is to invite you to undertake the same journey I did. If you do that, I predict you will learn first-hand the same thing I did: the system is corrupt, and whether or not you succeed in penetrating it will ultimately depend entirely on whether you have the right connections and whether they decide that you can be trusted to toe the line on the unwritten rules, the first of which is that you never talk about the unwritten rules to anyone who is not a member of the club.

Note that I never joined the club, so my theory of the unwritten rules is pure speculation. No one ever sat me down and said, "Look, son, this is how it is..." But I did spend ten years of my life on this, and during that time I accumulated a lot of evidence that I have a very hard time explaining in any other way. It eventually led me to a serious existential crisis.

BTW, it's not just the financial system. Academia is corrupt in much the same way, and in that case I did join the club so I can speak to that with some authority. That experience is one of the things that allowed me to recognize what I was seeing in the financial industry. But both academia and finance are centuries-old industries. They have become very skilled at hiding their corruption from prying eyes, and a big part of the strategy is making it appear that anyone who accuses them of corruption is a crackpot. (Which is, of course, exactly what a crackpot would say, and that, too, is part of the strategy. It's a horrible catch-22.)

So you have to decide whether to believe me or not, whether you think I'm a crackpot or not. Before you jump to a conclusion I invite you to look up my record. My life is pretty well documented on the web.

Having joined academia at one point and seen "how the sausage is made," and subsequently left for ethical reasons that I have no way of using to hold anyone to account, I totally understand this comment.

It is so hard to put into words how these systems are corrupt, because these systems create an enculturation / religion around themselves. By the time you see how the entire system works, you are powerless to simplify the mechnications that make that system corrupt (if you even choose to recognize the corruption). You can't "just start an alternative," because the system exists at a local maxima and will crush your alternative or assimilate it into the existing system.

When people are taken advantage of by these secular religions, it is so normal and engrained in the societal fabric that we almost don't have the language to expose the fundamental dishonesty and fraud of these systems. Victims will say that there may be some bad actors at the edges, but on the whole, "this is the way it's supposed to be."

Yes. Exactly.

I think this might come down to how you define corruption.

I define it the way the dictionary does: dishonest or fraudulent conduct by those in power in order to advance their own interests over those of others.

How would you define it?

the magnitude of it matters.

Order a Big Mac - does it look like the ad? Probably not. Drink a Cola, does it feel like your life has turned around, probably not. is advertising dishonest - of course, but we all know that and we learned to deal with it. Is advertising corrupt, I would not say that.

Thus for something to be truly corrupt it needs to go beyond a certain level of illegality.

There are plenty of small banks and credit unions out there thus the point that you cannot open a bank is not quite valid. Are some of the rules onerous, probably. Are some of the rules unfair and ridiculous, probably ... does it mean it is corrupt I don't think so.

> the magnitude of it matters.

The cost to consumers of financial corruption runs into the many billions of dollars.

> There are plenty of small banks and credit unions out there thus the point that you cannot open a bank is not quite valid.

I did not say that you couldn't open a bank. I said that if you tried you would see firsthand evidence of the corruption of the system.

The problem is not that the rules are onerous. The problem is that the rules are not applied evenly and transparently.

> The problem is that the rules are not applied evenly and transparently.

Of course not. Never are, again you are not saying much here. Also with the billions of wasted dollars. Of course, but that is a natural consequence of dealing with immense scope - it is going to be very inefficient and stupid. Still a far cry from actual corruption.

I feel that people tossing around the word corruption don't really understand what it means and it is a hyperbole - only undercuts the message.

A bit like the Soup Nazi in Seinfeld - he is not really a nazi in any shape or form - don't even mention real nazis in the same context.

> I feel that people tossing around the word corruption don't really understand what it means

I see. So your position is: I "don't really understand what [corruption] means" -- but you do. And because you possess the true understanding and I don't, nothing in my personal experience can possibly be evidence of corruption because you alone possess the true understanding.

Have I got that right?

> > The problem is that the rules are not applied evenly and transparently.

> Of course not. Never are

This is normalization of deviance. It might be true that the rules are never applied evenly and transparently anywhere and never have been, but it is one thing to posit this as a fact, and quite another to dismiss it as being inevitable (and hence acceptable) by saying, "Of course it's that way." No, it's not "of course." It's corruption, not just because the rules are not applied evenly and transparently, but because this is done by a group of powerful people for their own benefit at the expense of everyone else. Its inevitability is a self-fulfilling prophecy. By accepting it, you have made yourself part of the problem.

You can claim that people tossing around corruption don't understand it... but you in the first place don't understand the scenario OP is even describing (as they're unable to provide details, you couldn't possibly be making an accurate judgment). So it is far fetched for you to confidently claim OP is misusing corruption etc. here.

I am simply responding to what others also called out, that none of the evidences the poster claimed to exist were indicative of corruption,

hence the logical and reasonable assumption that the poster is misusing the term, obviously I can only comment on what is stated here,

> Letting someone else do it undermines the whole purposes of the independent financial system.

Even small regional banks have their own internal credit rating algorithms. Credit ratings from CRAs are generally consumed either in aggregates (a buyer on the secondary markets wants a traunch with an average credit rating of X) or by less sophisticated parties such as landlords.

> since email address is part of the report

I don't have a business relationship with any CRA. If they have my e-mail it isn't because I gave it to them intentionally. Nor is it guaranteed that they have a valid email that I still control.

I meant the Sift reports, not the big three CRAs. The Sift reports will contain your email address since it's reporting mostly on online services (that require an email address to use)

I wonder what the additional risk is though given that, iirc from the times I've requested credit reports, the amount of info needed to retrieve it is enough to have already stolen my identity. So in that case it seems the additional risk is low.

This problem is much bigger than just the CRAs. The fundamental problem is that the information that is used to authorize transactions (including financial transactions) is not bound to the transactions. It's re-usable. That makes phishing trivial and hence inevitable.

The situation has gotten slightly better recently because of the widespread deployment of chip cards, but these only protect POS transactions. They don't help with e-commerce or non-financial transactions like credit report requests.

Not only that, but so much "consumer data" is probabilistic - they believe it's you who's doing something, but it could have been your ex logging into Pinterest on your phone one time, which then linked across her other devices and now "your data" is actually leaking her private data from the rest of her life.

The one that offered an online form requested a copy of a government issued id to confirm identity. How long til someone poses as one of these agencies to collect data too?

I've sent a couple of GDPR Subject Access Requests out of sheer curiosity. The answer is - in my experience - 'it varies'.

One requested a copy of a photo ID or passport and were happy to accept a partly redacted copy with 'FOR PROOF OF ID ONLY - (company), (date)' over-typed on the scan in red.

Another requested I email them from an email address they had in their records, or log in to change it and resubmit the request.

Most of the others sent the data without any ID checks whatsoever.

Curiously the one who did the most ID checking used an exemption (I forget the specific GDPR Article number) to redact nearly everything which wasn't shown on their web portal. Their position was that "revealing this data (specifically messages on trouble-tickets and their staff's internal notes) would adversely affect the privacy of our staff".

Amusingly I could just log into their portal and view the trouble-ticket history (but of course, not the internal notes). I can only assume their refusal was because there were comments in the internal notes (on my or other tickets) they weren't comfortable disclosing.

> Another requested I email them from an email address they had in their records

Wow. They didn't mail it and require confirmation of receipt, they just required a (trivially forged) mail with that email address in From?

> I can only assume their refusal was because there were comments in the internal notes (on my or other tickets) they weren't comfortable disclosing.

more likely just following an established policy that applies to all such information, to take personal judgement out of the equation. almost certainly absolutely nothing to do with your “file” in particular.

>Another requested I email them from an email address they had in their records

so our email providers can get all this data? They can DKIM sign such a mail and simply never have the relevant emails show up in your emails.

What items did you redact from your ID/passport?

I sent a driving licence and redacted the licence number, then overtyped the whole thing with the text in my previous post.

My goal was to make certain that if it leaked, the overtyped expiry date should make it useless after a certain point, and the company name should make any company other than that one question the source.

As a side effect, it'd also clearly identify the source of any leaks - but that wasn't my primary goal.

I moved the text so the name and address (which they already had) and date of birth (which isn't really a secret) were clearly readable.

>My goal was to make certain that if it leaked, the overtyped expiry date should make it useless after a certain point, and the company name should make any company other than that one question the source.

>As a side effect, it'd also clearly identify the source of any leaks - but that wasn't my primary goal.

Wouldn't a malicious actor just add block text over your text saying "only for identity verification for SomeOtherCompany" ?

They could do the same for the expiration date, although I wonder if any company actually bothers to check the expiration date

I don't know how GP did it, but I would have made the text translucent and make sure it covered the entire image so that there's no easy way to obfuscated the watermark without also obfuscating the license itself.

Ahh, of course - I didn't think of that. Thanks, obvious now that you mention it :-)

translucent text is nearly trivial to remove

Great questions! This conversation is already pretty mature I think. Take a look at Bruce Schneier to see some great synthesized commentary on the questions you're posing.

There is a pretty great talk about how companies fail at this - https://www.youtube.com/watch?v=gd3DiRuvr8A ("SOUPS 2019 - Personal Information Leakage by Abusing the GDPR 'Right of Access'")

"Of the responses, 24 per cent simply accepted an email address and phone number as proof of identity and sent over any files they had on his fiancée. A further 16 per cent requested easily forged ID information and 3 per cent took the rather extreme step of simply deleting her accounts."

https://www.theregister.co.uk/2019/08/09/gdpr_identity_thief...

Examples that I've seen with GDPR requests are:

* Scan of ID

* WebID - video call where they take screenshots of ID and your face

* Cookie - kind of makes sense since 3rd party web trackers Quantcast rely on cookies to identify

If your a company you can buy the data. Just need name and address.

The liability would be the same as a GDPR dataleak, or comparable. If the data leaked is sensitive enough, you might get fines and punishments by other regulatory bodies or industry bodies (PCI audit might be failed next time, so no card processing anymore).

The victim might be able to sue for damages incurred by the identity theft.

In my experience, some companies place high dilligence on the process. A bank I requested information from sent a postal letter containing a code to my mailing address. The Germany Postal Service has a special service to allow identifying people, so the letter contained the code and then I had to bring part of the letter back to the next postal station along with my ID card.

Once they got the confirmation of the ID card along with the code sent to me, they sent a CD-ROM with the information encrypted and the password via mail.

Wow, that's a good point.