US Spies Are Lobbying Congress to Save a Phone Surveillance ‘Loophole’
wired.comIf they can buy it then I can opt out.
It is an unconstitutional practice. If they didn’t think it was they wouldn’t go through the extra steps to get the data. Outsourcing one part of the illegal enterprise doesn’t make the whole thing legal.
But if they want to play this game, an interesting way to bait a Supreme Court case might be to request a CCPA delete for the NSAs “commercial” data.
> an interesting way to bait a Supreme Court case might be to request a CCPA delete for the NSAs “commercial” data.
Good luck with that. You cannot delete something which "doesn't exists". /s
Only a whistleblower could make this happen.
It's not just the NSA buying this data right? So is it illegal when say a marketing agency buys the data? If not why should it become illegal for the government?
It sure should be illegal all around.
The second piece about comparing the government to a business isn't valid. There exist many laws and rules that apply only to the government.
Not that I agree with the distinction. I think companies larger than the US government at formation should probably have rules to keep them good for humanity.
Indeed. Many laws and regulations around government agencies (not US specific, as I’m in the EU) specify what the agency is allowed to do, rather than what it isn’t. This is much easier to enforce, although it does require more regular review of regulations (that specify the details) to keep with the time.
Because the government can put you in jail and the marketing agency can't. (I think I heard this simplified response on the Risky Business podcast)
Realistically, scraping people for their data like this should just not be allowed at all. People are more important than corporations.
But in America, “corporations are people, my friend!”
Corporate personhood predates the formation of the United States and is not unique to the states.
The phrase I’m familiar with is Monopoly on Violence.
Because the marketing agency can't have you targeted in a drone stike.
Why not? Historically, corporations have had armed private forces that they've used to kill people.
Although you may have miss the tamer recent version where Ebay sent "a bloody pig mask, a funeral wreath, and a book entitled “Grief Diaries: Surviving Loss of a Spouse", practiced installing a GPS tracker and then travelled 3000 miles to install one, "The Defendants also posted the Steiner’s address on Craigslist and other websites, inviting strangers to the Steiners’ home for sex parties, and advertising yard sales".
The story has a happy ending though as "Defendant Wenig departed eBay with a $57 million severance package.".
> https://www.techdirt.com/2021/07/29/exec-that-tried-to-send-...
> https://storage.courtlistener.com/recap/gov.uscourts.mad.236...
That eBay story is wild, and does make you wonder how deep the rot must be in that company. Also, why on Earth does eBay need a "global intelligence center" and a "global security team"? Do they have a completely separate line of business that I'm not aware of?
At least one person went to prison, so there's that.
Any sufficiently powerful corporation is indistinguishable from a government. There aren't many corporations who currently exercise their money to get such power, but it's happened before and can certainly happen again.
I suspect you have worked neither in government or industry. Things look different outside academia.
As it turns out, a bloody pig mask isn't a drone and planting a GPS tracker isn't the equivalent of killing or maiming everyone at a wedding and the people that did this were subject to criminal penalties.
This is in contrast to militaries who are assumed to operate as legitimate extensions of foreign policy.
there is truth in fiction:
For the same reason that the Constitutional protections exist to restrict the government, specifically.
> But if they want to play this game, an interesting way to bait a Supreme Court case might be to request a CCPA delete for the NSAs “commercial” data.
Can state law compel a federal agency to do anything?
> Can state law compel a federal agency to do anything?
Within the jurisdiction of a state, probably. States rights should have precedent over federal except in cases that involve interstate activity. This is being tested in Texas right now with various firearm laws that are meant for items made in and staying within Texas.
The Texas situation as I understand it is the state refusing to enforce federal law, which makes sense as the federal government has their own enforcement agencies. That seems a bit different from the state compelling the federal government to do anything.
If you don't want them to buy your data, stop selling it. Lock down your browsers. Don't use Facebook. Put a better OS on your phone. And sue every company that even hints at violating privacy rules.
And don't have a car, because the DMV sells your data too. “Stop selling your data” is too simplistic.
It's not a full-scope solution. I think you'll find most things in the world are complex and require complex solutions, and most people are capable of understanding that discussing one solution doesn't negate the need for others.
Positions like this really aren't helpful because they detract from existing discussions on ways to mitigate data loss. The information a DMV sells isn't behavioral data.
The privacy train has already gone.
We should just accept the status quo. We should not fight for privacy aby more. We should accept global surveillance without a fight.
No. We van do something. We van limit our data. It may be futile, but I cannot leave things be like that.
Your actions will signal X,Y,Z and qualify you for intrusive monitoring "because you are hiding something."
This is reality.
There's probably a market for fake id streams: want my contact history? Fine here's 100 fake contacts. Want my location data? Fine. I'm at the Taylor Swift concert two states over. Want to listen in on my microphone? Fine. Here's a recording of Pat Boone trying to do rap.
I'm far from the first person to recommend this.
That will come in next-gen adblockers. Ads will run in an emulated sandbox, unseen by the user. And many user-agent tools already allow randomization, a tiny fictional history.
Sure, but they'll be banned by Apple / Android ToSes. But meh, that shouldn't stop everybody. And it would be fun to watch the back and forth between ad tech and ad blockers.
Android doesn't have ToS.
Google may.
No other variants of Android do, AFAIK.
True. Do carriers try to add stuff like this to their ToS? I usually ignore them and root my phones anyway, so I'm not current on which part of the "value chain" is offering a ToS.
This tool sort of exists for web ads, though I think people started getting account actions or something from G.
There is a market for this but while Google controls android and Apple controls iPhone and it remains a duopoly theres no way in hell they will unlock their ecosystems enough to allow it to thrive.
That's an easy solve with a charge of corrupting of evidence or some such. We know you weren't at the Taylor Swift concert 2 states away because your WiFi history and cell tower triangulation puts you on the couch watching the Love Island.
do the chattels and daily dealings, of life become evidence at birth, or do you have to commit a crime before anything becomes evidence?
When the Eye of Sauron gazes upon you, by nature of the gaze you are under suspicion. Depending what is found while the gaze is upon you might decide if you are guilty or not. However, you cannot be ruled out as a terrorist until you've been under that gaze. By falsifying your data just means that the gaze will be much more intense because you're clearly behaving in the manner of someone guilty. It takes time to determine if that guilty looking behavior is because of guilty actions or just some nerd trying to corrupt the data. Either way, you are behaving like a subversive, so you'll just be remembered for that for future investigations.
that suggests, the chattels and daily dealings, of life become evidence at birth, is true.
by extension 5th amendment is hogwash, shielding the obviously guilty.
Besides being speculative, this misses the point that if more people do it, it becomes less suspicious.
...and when WEI reaches mass adoption, your privacy-oriented clients will eventually be locked out of essential services.
I sure hope you have a big war chest for litigation.
Can you find a bank, insurance company, phone carrier, etc, that doesn't have them selling your data in their terms though?
But hey, we make them send out “IMPORTANT UPDATE FROM _____ BANK” letters every time they change the pages-long legalese that allows them to sell all your data, and of course people read those from all the companies sending them and keep up on all the written mail-in opt-outs that expire.
GDPR is a disaster but the intent was good. Here in America we just say go for it.
I wish this worked... Even your ISP or VPN providers can and likely do sell data...
That works for a fringe minority of users
This is exactly why the US Government will not create a Citizen Network for authenticated social sharing among actual participants in our Social Contract. It's absolutely a path to despotism, and very few have the stomach for rebellion.
>will not create a Citizen Network for authenticated social sharing
What do you mean? Care to elaborate on the network (I think I know what you mean about authenticated, but I need to be sure where for).
I have mixed feelings about all this.
Obviously, the intelligence agencies are thwarting the spirit of the law requiring warrants by buying data hoovered up by big data.
But I was always told growing up not to share things on the internet I don't want everyone to know. I feel like you kind of deserve having your data hoovered up by the government if you share that data publicly on social media, but personal responsibility doesn't appear to be a contributing factor in this discussion for some reason.
That's not the only source of data, obviously, but there are a lot of people on HN who think blocking ads is piracy. To those people, I present this exact problem, because they should have seen it coming. Adtech is amoral and unethical, and ways of life that rely upon it should collapse. No mercy, I don't care, find a better business model or live on the street.
personal responsibility is always important, but you are just blaming the victims. And you ignore the responsibilities of those we trusted. The tech companies have lied about, and disavowed the surveillance systems they use.
Let's be glad then, that policy is not based on your feelings. You had the privilege of education, that doesn't mean those still ignorant deserve the abuse.
For the love of all that is good... the problem isn't "omg the NSA is buying data!" the problem is this data is being collected in the first place.
ALL data collection should be restored to its natural state of OptIn, no matter what zuck or any other silicon valley bro says.
There is no "one" problem. Both are problems.
It’s so obviously unconstitutional. If Congress gives them a pass, I don’t see how they would explain allowing agencies to sidestep the Constitution. At that point they’re not upholding the Constitution any more. The only chance is bringing it up to the Supreme Court.
For those of us not well-read on the Constitution, which specific parts does it violate?
I would say it qualifies under unreasonable.
It's unreasonable to expect every citizen to understand when and where their data is being taken.
It's unreasonable to expect people to understand what actions lead to what data points.
It's unreasonable to assess data for unrelated traits that don't match every person perfectly.
It's unreasonable to trust a company selling data to not at some point include illegal data. Certainly not without a verified chain of custody.
It is unreasonable for the government to bypass the constitution by using limited interpretation of language.
The "unreasonable" part of the Fourth Amendment refers only to "unreasonable search and seizure" by law enforcement, not to any and every subjectively unreasonable aspect of society or law.
I'd state what the parent comment says a bit differently: the availability of data for purchase does not make its purchase by law enforcement magically "reasonable".
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
In a digital world, one's "Person" and "effects" have become inseparable from the phones/platforms we communicate with. Participation in many cases is not a choice if one is to function in society.
The requirement that warrants are issued only upon establishment of probable cause also highlights the issue here. It seems highly dubious that a company holding your data and selling that data is somehow an acceptable end-around the warrant requirement.
Is this all technically legal? Seems like it might be. Is this what the authors of the 4th amendment had in mind? Seems extremely unlikely.
> Is this all technically legal? Seems like it might be. Is this what the authors of the 4th amendment had in mind? Seems extremely unlikely.
you are not inconvenienced when the NSA buys data in the same way that you're inconvenienced when you have to feed/house a soldier.
While it's extremely unlike the authors of the 4th amendment had the internet & etc in mind this concept of selling things to the government surely was known to them and so the current implementation would be OK from their perspective.
A lot of the first 10 amendments are about protecting your physical property from the Government. 2nd - Guns, 3rd - House, 4th - Property, 8th - Money. The digital bits that Google and etc created (ex. metadata) are clearly neither in your procession nor your property. There is no amendment that protects letters you wrote but gave to somebody else nor recordings made by somebody else of your interaction with them.
When you send someone a letter it is held by the post office, but it is definitely not allowed for the government to open those without a warrant, even if they do not inconvenience you. When you rent a house from a landlord they can’t turn around and sell warrantless access to that house to the government.
People have digital homes just as they have physical homes, and they have digital letters (mail, messages or chat) traveling to and from those digital homes. It is not unreasonable to expect all of that to be private against broad government surveillance.
Those examples are still different from reality.
You're decided to add a condition of "held by the post office" to the letter example. This is not at all what I wrote. Once the letter is delivered (as it was in my example) that recipient may give it to the Government without a warrant. The government may just not forcibly take it without a warrant.
Again, NSA isn't going into your digital home. They're going into Verizon's digital home and Verizon has invited them in there. Sure Verizon has information there that you gave them but just like if it had written Verizon physical letters it's not _your_ home its _Verizon's_ home.
It's fine to think of this like a loophole but gathering information and selling it really isn't some novelty that didn't exist in the 1700s.
I should have been more clear, but it seems the message got to you correctly.
I can't read the 4th amendment and this article and not come to a conflict. It seems obvious to me that it is unreasonable to expect a person (with the average IQ being 94-98) to understand what data on their phone is public or private.
It's obvious because we have millions of teenagers believing they have privacy on their phones to a point where they break incredibly consequential laws to store sexualized imagery there.
What the average citizen believes is private is where the goal posts should be.
So a potential solution is to poll America asking the following question:
Donald Trump and Joe Biden would both like to download all the data on your phone to share with the world via press conference. Do you accept? If 50% of people so no, it is unreasonable.
Disclaimer: I worked on Geolocation products with the top 3 aggregators and have extensive experience with Palantir.
Geolocation and your sexts are two separate things so your poll doesn't reflect what is purchased.
The poll is to determine if people understand that their phones are essentially the government.
Both geolocation and sexual proclivities are often considered private.
2 years ago I had access to enough data to stalk any person I chose, anywhere in North America. If they connected to a network of websites (GM/Stellantis/Nissan corp and all their dealer pages, plus most of MBUSA) I could see a profile of them and where they went.
I knew their work schedule, where they worked, where they did lunch, when they were in a meeting and when they were taking the day to go to Canada's Wobderland. This was done with permission of the friend and encouraged by my boss.
The end result was dealerships having a ~90% accurate intent to purchase. Which was used to increase sale prices. We were measuring the success with our partners at a Lexus dealer in Toronto.
* Some brands(of vehicles) have been changed to similar brands to protect myself.
It's not essentially the government though.
Your example is knowing the location of somebody. That's it. You example isn't about knowing who they're calling, what they're saying, their Wordle high score, their pictures, theirs emails, etc.
I don't doubt you had highly detailed geolocation. Just make that your poll though since that's what you have an example of.
If we allow this logic what is to stop the following situation:
In this situation a third party secured access to something which is traditionally constitutionally protected. This third party is in a position of power that is hard to bargain with (as many tech companies are). Most people wouldn't agree to this if they had the option to say no and would not expect this lease clause to be used this way.1. Landlord writes into rental agreements that they could have someone inspect the property every year. 2. Sold access to people's apartments to police officers every year.Collecting data is specifically searching and seizing, and in an unreasonable manner without warrant.
… they’re using the data to perform searches …
Fourth amendment to the constitution. They would need a warrant. Laws don’t evaporate just because it’s in the digital realm.
If you have a friend who's willing to report on you for a price and the government pays the price the 4th amendment wouldn't have been violated. Why is is different because it's digital? The government isn't spying on you, it's just paying for information collected legally
If you call the gov and you confess to something that’s on you.
Your friend also cannot just bust into your house and search through your things. Now the government because it has enormous powers behind it and people willing to do the wrong thing on its behalf is specifically limited in what it’s allowed to do.
It depends. If someone breaks into your house with government encouragement, that’s a Fourth Amendment violation. If he breaks into your house because he’s a burglar, and then happens upon something he knows the government would want, and then sells that information to the government, it’s not a Fourth Amendment violation.
The question is, if you hold a garage sale and someone buys your stuff and the governments then buys that stuff from whomever you sold it to, is it a Fourth Amendment violation?
Because that's what's really happening here. Once you sell your data to Facebook, Twitter, etc, it's no longer "in your house." If you granted third parties license to collect and sell your data under terms of service, then that data no longer belongs to you, and you agreed to that..
To me the bigger problem isn't the government buying data on the open market, it's that data is a market to begin with.
>Because that's what's really happening here. Once you sell your data to Facebook, Twitter, etc, it's no longer "in your house." If you granted third parties license to collect and sell your data under terms of service, then that data no longer belongs to you, and you agreed to that.
That's the general thrust of Fourth Amendment jurisprudence and is called the "third-party doctrine". But the Carpenter decision in 2018 is a big exception to that, and it's likely that more are to come.
So a one off garage sale run doesn’t seem “unreasonable” —they came upon it… accidentally or gumshoed it… but once it becomes systematic and pervasive I definitely believe it is in contradiction with the fourth amendment to the constitution of the US
If the government is using the data to bypass a restriction then that same government is unlikely to create a law to change that.
Seems like a problem that will never be fixed, on purpose.
You would think so, but Congress has occasionally done things like this, like pass the Wiretap Act and the Electronic Communications Privacy Act, both of which impose restrictions on government access to information beyond what the Courts at the time required under the Fourth Amendment.
One concerning development is how much the Democratic Party, which used to be a major proponent of restrictions on government searches, has cozied up to the defense and intelligence establishments since 2016 because of a shared interest in stopping populist right-wing movements that also happen to be anti-interventionist. They're also less keen on digital rights these days because they want to censor right-wingers online.
It appears like the Neocons, previously associated with a war-philic faction of the Republican party has surreptitiously, through the Clintonite "third way" faction of the Democrat party, made vast inroads into the current Democrat party, in measure because of the Neocon opposition to non-interventionism which is associated with parts of the Republican right and also parts of the Democrat left. Off bedfellows but has become rather "mainstream" in both parties.
The government paying a contractor to circumvent the constitution is still the government violating the constitution.
The 4A does actually evaporate for a subset of Americans. Reagan's EO12333 permits warrantless collection for Americans subject to background investigations. You are fair game for the panopticon from the submission of an SF86 application until the time you end your security clearance. The domestic surveillance apparatus exists, in part, to facilitate that need which is something the affected agencies want to preserve a carve out for.
I actually think that is reasonable.
If the data is already commercially available, why not access it.
If you want to fight this, regulate the commercial collection and sale of this data.
Really a warrant should be required to carry out any kind of in-depth, prolonged, or otherwise invasive surveillance or investigation into someone.
It’s not just which data or where they get it (though surely many types and sources of data should be restricted too, especially without a warrant) but the fact that they are building a profile, targeting, etc. at all. These are things the government/law enforcement should not be doing lightly or without supervision.
It's unreasonable to expect a person to understand when and where their data is being leaked/sold.
I think it is reasonable for governmental agencies to have greater restrictions on their behavior without due process than a private company because the government has vastly greater opportunity to abuse this power.
if the availability of commercial data becomes necessary for a functioning NSA, it will be used as an argument against any attempt to regulate data collection
If it’s publicly available, they don’t need a warrant. That’s been the 4A law from the beginning.
Wait is Snowden still considered a loser here? I can't keep track of the narrative.
We have an agency beholden to no-one with the power to blackmail any journalist, lawyer, politician, associate, etc.
We have an agency that seems to take pride in "hacking" the constitution. We've been shown glimpses and glimmers of clever mechanisms to run-around the US Constitution.
Go ahead and use a VPN and lock down your stupid android OS. You fail to grasp the breadth and depth of sources for harvesting "public" intel.
If you want to be a founder and have no moral code there's ample opportunity here. IoT and connectivity make it cheaper than ever to generate intel on people. Fingerprint people's voices in public, travel patterns, associations, bluetooth/wifi device ids, home wifi attributes, etc. Who's the customer? Big Brother.. Spy on your fellow Americans to help combat Terrorism.
Tin foil hat on: It might be too late for any of this to be meaningfully reformed. The people-in-charge already have enough blackmail on politicians they can drown out dissent. If there is any reform, the info gained from illegitimate sources is already stored as weights into a neural model for future use. Creating the neural model would be "constitutional" because the models aren't "searched" lol
Our national security apparatus is running on self-signed certs. Hope nothing goes wrong with that!
> beholden to no-one
They're beholden to congress. No US entity is beholden to no-one
That's false. If an entity is above the law then it is above Congress. This exists.
If an entity can forever dismiss Congressional inquiry through unlimited open-ended legalistic escapes that are virtually always applicable, then it is de facto above Congress. This also exists, and is different than the first example.
I could see where you could get that notion from reading an org chart. However, Clapper lied to Congress, was accused of perjury, and allowed to resign. He now walks around as a free man with 0 consequences making whatever salary he's given from his consulting career.
Congress is a feckless body of government when it comes to checks and balances.
He wasn't charged because they didn't charge him. They're free to make that call. Was there any reason given? Maybe he cleared it up in closed door meetings?
What we learned from this is that you can get away with anything if you say "I made a mistake". Really, and which mistake are you owning up to with that comment? The part where you lied, or the part where you did the thing that you covered up with the lie? Feckless. I have no other word for Congress. Well, that's a lie, but not like anything is going to come of it!
You seem to be conflating a bunch of individual actors here.
Congress didn't testify to Congress, Clapper did. Clapper did so in both public and private settings.
Clapper didn't tell the truth in a public setting because it was classified. Clapper (privately & immediately) informed Congress of the need for a private meeting to correct things he said in the public setting.
This would be akin to your husband asking you were the cookies are and since you noticed your son around the corner saying you don't know. Then when you son leaves you tell him they're in the top of the cabinet. Nobody is going to actually be mad except your son (that's you in this example!).
You seem to want to write this off like we're all small children and have no ability to rational thought. You can be under questioning by congress while under oath and receive a question that would require revealing of sensitive information. At that point, you can lie like a small child, or inform the congressional panel that the conversation is approaching sensitive material and in order for questioning to continue, it would have to be done in a private session.
Please, don't treat me like I'm an imbecile. That's congress' job
Edit: also, that's such a shit parenting job. take the opportunity, and tell your significant other that it's not time for cookies and it'll spoil your dinner. there's no reason to lie about it. you have a teachable moment, and you've chosen to teach that it is okay to lie rather than something more valuable.
Clapper could not have answered that Yes/No question with "That's classified" without revealing whether the answer is Yes.
Going on TV and Clapper saying _he just made a mistake_ is really what I think you have issue with. But none of this TV statements are under oath.
> Clapper could not have answered that Yes/No question with "That's classified" without revealing whether the answer is Yes.
If the answer to a question is classified then it is classified regardless of whether it is yes or no.
But the answer to that question being classified is objectionable, because a large proportion of the public would have taken issue with not knowing, because they would have objected to the program.
Part of the reason it's illegal to lie to Congress is that you are at the same time lying to the American public, who are the people Congress answers to.
It would be like lying in a deposition in front of the board of directors and then going back in private to your friend the line manager and saying "hey, that thing I said when it really matters was a lie because I didn't want the board to find out about it."
The NSA is beholden to Congress until the NSA sends a few messages to fix it.
The NSA is beholden to the people whom it is almost certainly collecting kompromat on.
Would it be too cynical if I suggested that many of our laws (worldwide, I'm not in or of the USA) exist in order to be sure компромат can be found on almost everyone?
The CIA hacked Congressional oversight of their illegal activity with no consequence.
I’m comfortable saying that US intel agencies are rouge and beholden to no one and no laws.
And when the intel director lies to congress about spying on American citizens, then what? Self signed certificate my friend..
I guess it would be nice if congress held the executive in check.. but maybe they can't bc of sinister reasons >:D
Wasn't there a report recently of the FBI illegally searching US Senators?? Something really wacky is going on.
but is the oversight effective? Formal supervision alone is irrelevant.