I respectfully disagree.

When things were done that way, surveillance was possible but it was expensive. Someone would have to physically open every letter you sent, or visit the properties of organisations you dealt with to check their records. It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours.

It is similarly unlikely that, back in the days of cash and cheques, anyone was monitoring every purchase you made and compiling a profile of you without your knowledge or consent, again to be used for their advantage but not necessarily yours.

However, in the digital world with service providers like Google or the big payment networks, this is more or less exactly what is done routinely, every day, to everyone. Given the obvious risks involved, it is no unreasonable to question whether this is appropriate or whether those organisations should be subject to laws restricting what they can do.

Even in the digital realm, your financial data is mostly safe on account of PCI-DSS compliance requirements.

PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world.

Your personal health data is mostly safe on account of HIPAA.

I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue.

The implication of being unable to "live without tech giants" as extending to being unable to prevent others from living without them is a bit of a stretch.

Is it, though? Many of the dangers posed by the modern world and the tech giants that run it come precisely from the fact that there are two sides to many interactions and they only need to monitor one of them to get the full story.

You might choose not to use any Google services, but many people you contact may be using GMail, in some cases without your knowledge.

You might choose not to upload your photos to Facebook, but you can't prevent the people who were around you on your holiday uploading theirs that show you clearly enough for Facebook's facial recognition technology to identify you.

You might choose not to have a digital assistant on your phone uploading your voice to Google or Apple, but in a restaurant you are probably surrounded by people whose phones can pick up your voice from a much greater distance than any human would normally notice it and upload that.

Then there are all those modern camera systems in cars and homes and offices that are Internet-enabled rather than CCTV. The list goes on.

And on the other end of this vast data harvesting infrastructure are a relatively small number of awesomely powerful organisations, who are building up all kinds of profiles on you, without your knowledge or consent, to use for purposes that might not be in your interests, over which you have no say. This is a perfect example of the saying that just because we can do something, it doesn't necessarily mean that we should.

Yes, I mean I didn't suggest otherwise. What you're describing is a difference in degree, not kind. In principle not much has changed.

> It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours.

This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense.

On the flip side, today, in the age of information, the market has produced tools that allow us to communicate via end-to-end encryption that has finally become somewhat insurmountable by even state actors. This is why the US government is actively[1] trying to outlaw warrant-proof encryption.

> PCI-DSS is violated all the time by huge numbers of businesses, often without them realising.

PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm.

> In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea.

I'm not sure that I agree. The EMV standard for payment cards is fairly robust.

> And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world.

This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. If your argument is that most people use cash, then that's orthogonal to a discussion about the risks of digital systems.

> I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue.

Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction.

[1] https://www.judiciary.senate.gov/press/rep/releases/graham-c...

Here we clearly disagree. I think the ubiquitous surveillance that happens today very much is a qualitative difference. A single data point of the kind that is captured might not be very interesting, and a single person leaving their home and seen by another person passing in the street would be forgotten in moments. But the huge databases that are built today, combining many types of personal data from many sources to build a picture of everyone's personal lives at an unprecedented level of detail, is something that has never happened before.

This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense.

Sure, but the expense meant that is was targeted. People expect the state to make some attempt to monitor criminals or those reasonably believed to be planning a serious crime. That's totally different from private multinational entities building up vast databases profiling billions of people.

PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm.

Not for small businesses, they're not. I don't know of a single small business that has ever been audited under PCI-DSS. And these are the ones that will keep your CVC code in the unencrypted spreadsheet on the unprotected laptop they use to track their customers' phone orders.

I'm not sure that I agree.

If I have someone's credit card in my hand, then right now I can walk into any shop in the area and buy up to £45 of goods without a question being asked. If I go online, even with just the details embossed on the card, I could buy way more from countless stores. With just a little more widely available personal information about the cardholder, I could buy even more still.

This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet.

Do you realise that there are entire first world countries where credit cards are hardly used? That outside the US, direct payment/debit schemes are widespread? Take a look at one of the big multi-method payment services. They offer hundreds of different options for accepting payments from different places around the world.

Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction.

So because Google is in the US, I shouldn't be concerned that everyone holding an Android phone within sight or earshot of me is potentially sending data about me to Google, that everyone I ever send an email to might be sharing the contents of the message with Google, and so on? Sorry, but I simply don't agree. Just because these huge multinationals may be based outside of easy legal reach for me, that doesn't mean they don't pose a danger to me or almost 70 million of my fellow citizens here, or the same for any other country.

I help run a small financial services business. We absolutely cannot touch card data (eg PAN) without being PCI DSS compliant. Very Good Security (VGS) exists precisely because of this, there is a market need for PCI-as-a-service. You can in theory ask someone to give you PAN-in-the-clear, but you wouldn't be able to grow a business large enough that one would be "unable to live without" you, per the writer of this article. If you are that kind of a service, you will absolutely face the consequences of not being PCI-DSS, and you have every incentive to just use a service like Stripe or Braintree to process your payments, where it's impossible to get that information in plaintext unless you're PCI-DSS compliant anyway.

> And these are the ones that will keep your CVC code in the unencrypted spreadsheet on the unprotected laptop they use to track their customers' phone orders.

The set of small businesses in the US that don't use Stripe, Square, Braintree, etc to run their payments is so minuscule as to be insignificant. These businesses absolutely do not have the ability to see your CVC code, it's all tokenized.

> Do you realise that there are entire first world countries where credit cards are hardly used? That outside the US, direct payment/debit schemes are widespread? Take a look at one of the big multi-method payment services. They offer hundreds of different options for accepting payments from different places around the world.

Yes? I'm not sure what your argument is here. Debit cards fall under PCI-DSS compliance. We're talking about payment cards, not just credit cards.

> If I have someone's credit card in my hand, then right now I can walk into any shop in the area and buy up to £45 of goods without a question being asked. If I go online, even with just the details embossed on the card, I could buy way more from countless stores. With just a little more widely available personal information about the cardholder, I could buy even more still.

First of all, this is false on its face because you would have to know their PIN. Second of all, the threat model of physical theft of a credit card is extremely narrow. And even there, it's easy to remotely disable a payment card once you know you've lost it. EMV is the industry standard because the actual threat model: replay attacks was identified and neutralized.

> So because Google is in the US, I shouldn't be concerned that everyone holding an Android phone within sight or earshot of me is potentially sending data about me to Google, that everyone I ever send an email to might be sharing the contents of the message with Google, and so on? Sorry, but I simply don't agree. Just because these huge multinationals may be based outside of easy legal reach for me, that doesn't mean they don't pose a danger to me or almost 70 million of my fellow citizens here, or the same for any other country.

It requires tinfoil-hat levels of paranoia to think that merely being within earshot of an Android phone renders you susceptible to surveillance. Unless Google has information on you, personally, it's extremely difficult to correlate background audio noise to you personally, and that would only be possible if you actually went and used Google's services. The only system that has been able to apply this level of indirect surveillance is the Chinese government, but that's because they have your information (by force), unlike Google which you can simply avoid using. And if you're this paranoid about indirect exposure to Google, you can send PGP encrypted e-mails, even to people that use G-mail. You have the tools!

And once again, there is a world outside the US, and some of its customs will be different to those you are familiar with. I've had more than one small shop or food place I buy stuff from clearly demonstrate that after a previous phone order paid by card, they'd just written down all the details and still had them on file, including the CVC.

I'm not sure what your argument is here. Debit cards fall under PCI-DSS compliance. We're talking about payment cards, not just credit cards.

Just for perspective, a rough calculation suggests that less than 25% of the money I have spent in the past 5 years was paid by card, whether credit or debit. The majority of the payments I make by far are via the UK bank faster payments system, standing orders, Direct Debit, etc. I don't think this is particularly unusual in the UK, or a lot of other places that have similar methods available.

First of all, this is false on its face because you would have to know their PIN.

And yet again, there is life outside the US, and the rest of the world doesn't necessarily work the same way you do. For example, you might like to look up contactless payments, which have been ubiquitous in places like the UK for many years.

Second of all, the threat model of physical theft of a credit card is extremely narrow.

And what about the person who had an opportunity to handle your card for a few seconds and record the numbers?

What about the problems inherent in those contactless payments I mentioned, where someone can literally walk past you in the street and use a device to scan your card details if they pass close to you?

What about the online businesses using the modern card payment services, but whose sites get hacked (or just cloned on a similar-looking domain) so that at the payment form/script stage it's not really Stripe or PayPal you're giving your card details to?

Apparently your threat model is excluding quite a lot of the potential threats.

It requires tinfoil-hat levels of paranoia to think that merely being within earshot of an Android phone renders you susceptible to surveillance. Unless Google has information on you, personally, it's extremely difficult to correlate background audio noise to you personally, and that would only be possible if you actually went and used Google's services.

No, it isn't. Voiceprints are a unique biometric marker, and the technology to isolate individual voices in a recording with a high degree of accuracy has existed for a long time.

You're potentially subject to surveillance any time you're within audible range of a device that monitors for trigger words (typically with considerably less than 100% accuracy) and then uploads the following audio to the mothership.

Or just because someone had an app that accessed the microphone, covertly or otherwise, and then uploaded the audio for whatever reason; take your pick.

Directly analogous arguments, other than the voice activation triggers, apply to photos taken on phones and subsequently uploaded to cloud storage or shared on social media as well.

And if you're this paranoid about indirect exposure to Google, you can send PGP encrypted e-mails, even to people that use G-mail. You have the tools!

Unfortunately, the person I'm sending to usually won't, and I have no way to determine whether they are using Google to handle their email anyway.