If the data exists 99% of the work is already done though.

It is extremely easy for a government to infiltrate into these organizations and get their hands on it, it has happened at Twitter [1], for instance.

So, yes, the problem IS data collection in the first place.

1: https://www.washingtonpost.com/national-security/former-twit...

It doesn't have to be extremely easy, and it isn't extremely easy at every company. Twitter's security was bad, worse than it should have been for their size/ data footprint.

I do agree that data collection is at the core of the problem, but Twitter really should have done a better job.

Read the article,

No amount of "security" is enough for an actor who wants to do this and has privileged to the data. This is almost impossible to out-engineer, if you think a company like Twitter cannot solve "such an easy problem" you're being naive.

Not really sure what your point is. I did read the article. I didn't comment on TikTok, which would be legally required (and I am sure compliant, although they deny that in the article) to hand data over to the Chinese government. I commented on Twitter, which was hacked by amateurs, and absolutely could have been considerably harder as a target.

My point is, you only need a rogue CTO (most of which have no actual idea of how technology works, i.e. an amateur) and it's over; or you know, any of the 10,000s of engineers currently employed on your favorite FAANG company.

Weird point, I don't really get it.

The "nationality" of a company is basically irrelevant here. Foreign governments could obtain this data from an "American" company in numerous different ways.m The most obvious vector would be a subpoena, but they could also negotiate payment for the data or infiltrate the company.

There's a shitload of data for sale from brokers. So foreign governments might not even need much from a company like FB. Perhaps just enough to confirm the validity of data purchase from other sources.

It's not irrelevant to the FCC, a United States federal organization. I don't think any brokers are selling "execute code on 10s of millions of US citizens' phones" to foreign entities, and if they were I suspect the FCC would have something to say about it.

Data brokers are absolutely, 100%, verifiably selling data collected by large american tech companies and selling them to foreign actors. See: Emerdata for one example. Yeah, the FTC makes attempts to take on these companies, but only if they find out about their activities, and even then, only years after the fact.

> I don't think any brokers are selling "execute code on 10s of millions of US citizens' phones" t