To me, what's missing from that set of recommendations is some method to increase the liability of companies who mishandle user data.
It is insane to me that I can be notified via physical mail of months old data breaches, some of which contained my Social Security number, and that my only recourse is to set credit freezes from multiple credit bureaus.
I agree. Let me tell you about what just happened to me.
After a very public burnout and spiral, a friend rescued me and I took a part time gig helping a credit card processing company.
About 2 months ago, the owner needed something done while I was out, and got their uber driver to send an email. They emailed the entire customer database, including bank accounts, socials, names, addresses, finance data, to a single customer.
When I found out, (was kept hidden from me for 11 days) I said "This is a big deal, here are all the remediations and besides PCI we have 45 days by law to notify affected customers."
The owner said "we aren't going to do that", and thus I had to turn in my resignation and am now unemployed again.
So me trying to do the right thing, am now scrambling for work, while the offender pretends nothing happened while potentially violating the entire customer base, and will likely suffer no penalty unless I report it to PCI, which I would get no reward for.
Why is it everywhere I go management is always doing shady stuff. I just want to do linuxy/datacentery things for someone who's honest... /cry
My mega side project isn't close enough to do a premature launch yet. Despite my entire plan being to forgo VC/investors, I'm now considering compromising.
>Why is it everywhere I go management is always doing shady stuff.
Well here's a cynical take on this - management is playing the business game at a higher level than you. "Shady stuff" is the natural outcome of profit motivation. Our society is fundamentally corrupt. It is designed to use the power of coercive force to protect the rights and possessions of the rich against the threat of violence by the poor. The only way to engage with it AND keep your hands clean is to be in a position that lets you blind yourself to the problem. At the end of the day, we are all still complicit in enabling slave labor and are beneficiaries of policies that harm the poor and our environment in order to enrich our lives.
>unless I report it to PCI, which I would get no reward for.
You may be looking at that backwards. Unless you report it to PCI, you are still complicit in the mishandling of the breach, even though you resigned. You might have been better off reporting it over the owner's objections, then claiming whistleblower protections if they tried to terminate you.
This is not legal advice, I am not a lawyer, I am not your lawyer, etc.
People are so quick to judge without knowing the details, the situation is more complex than I'm willing to go into here, and I'm comfortable with my decision.
That's totally fair. After all, laws are about what people will force you to do using (the threat of) violence, while ethics and morals are about how you personally navigate the world, and a bit about how people will try to shame or socially compel you. If you are comfortable with your decision, that's all that really matters at the end of the day.
The problem isn't society or profit motivation. It's people. Humanity itself is corrupt. There aren't "good people" and "bad people". There's only "bad people." We're all bad people, just some of us are more comfortable with our corruption being visible to others to a higher degree.
> We're all bad people, just some of us are more comfortable with our corruption being visible to others to a higher degree.
If the GP's story is true (and I have no reason to suspect otherwise), then there are clearly differences in the degree of "badness" between people. GP chose to resign from his job, while his manager chose to be negligent and dishonest.
So, even if we're all bad people, there are less bad and more bad people, so we might as well call the less bad end of the spectrum "good". Thus, there are good and bad people.
I understand your perspective, but I maintain that "good" (morally pure) isn't a category any of us belong to. We're all lying, hateful people to one extent or another, and lying hateful people aren't "good", even if we haven't lied or hated as much as other lying, hateful people. "Less evil" isn't synonymous with "good".
The argument that profit motivation is the origin of shady business practices ignores the existence of those businesses which pursue profit in an ethical manner. The company I work for, for instance, is highly motivated to produce a profit, but the way we go about obtaining that profit is by providing our customers with products that have real value, at fair (and competitive) prices, and by providing consistently excellent customer support. Our customers are *very* satisfied with our products and services, and they show their satisfaction with extreme brand loyalty. The profit we make year over year allows us to increase the quality of life for our employees, and keeps our employees highly motivated towards serving our customers. We pursue the good of our customers alongside our own, and we avoid shady business practices like the plague.
as it is written:
None is righteous, no, not one;
no one understands;
no one seeks for God.
All have turned aside; together they have become worthless;
no one does good,
not even one.
Your attempt of making the situation seem to be asymmetric by arbitrarily defining "good" as absolute good, while "evil" as everything else - is unconvincing. (Why not the opposite - which would also be ridiculous ?)
It's like a glass of pure water. If there is anything else in the glass, it can no longer be called a glass of pure water. Likewise, the presence of evil of any quantity or quality in a person disqualifies them from being good. Apple trees do not yield blueberries, and good men do not do evil things. So if we discern in our thoughts, words, and actions the presence of evil, we can know with absolute certainty that we, too, are evil.
Or is it supposed that hating each other, lying to one another, stealing from one another, murdering one another, failing to fulfill contract, covenant, and commitment to one another are things that should be considered good?
This. Also, the world isn't black and white. Good and Evil are overly simplistic categories that aren't constructive. Just because one person does something wrong, it doesn't have to define them or negate the good they do in other areas.
What is this even supposed to mean? Profit motivation is a concept invented by humans for humans to apply. If it leads to unexpected or undesirable outcomes then it's a bad idea. A system that requires all participants be paragons of some definition of virtue to produce good results is fundamentally unsuited for human beings.
>As described in more detail in the program guidance, the information must relate to one of the following areas: (1) certain crimes involving financial institutions, from traditional banks to cryptocurrency businesses; (2) foreign corruption involving misconduct by companies; (3) domestic corruption involving misconduct by companies; or (4) health care fraud schemes involving private insurance plans.
>If the information a whistleblower submits results in a successful prosecution that includes criminal or civil forfeiture, the whistleblower may be eligible to receive an award of a percentage of the forfeited assets, depending on considerations set out in the program guidance. If you have information to report, please fill out the intake form below and submit your information via CorporateWhistleblower@usdoj.gov. Submissions are confidential to the fullest extent of the law.
Why would you resign? You could have reported it yourself and then you would have whistleblower protections - if the company retaliated against you (e.g. fired you), you then would have had a strong lawsuit.
Because I don't want to be associated with companies that break the law and violate regulations knowingly.
I've long had a reputation of integrity, and it's one of the few things I have left having almost nothing else.
So you would rather be known as someone who had an opportunity to report a violation, and chose not to? From my perspective it seem like you decided against acting with integrity in this situation - the moral thing would have been to report the violation, but you chose to look the other way and resign.
> it seem like you decided against acting with integrity in this situation ... you chose to look the other way and resign.
I agree with this statement.
This isn't a judgement, we all have to make choices; the "right" choice (the one that aligns with integrity) is usually the one that will be the least self-serving and even temporarily harmful. They did what was right for them, that's okay, but it was not the choice of integrity.
Because that is the choice they made for themselves.
How it plays out after is another matter entirely. But the choice was what they seemed to think was right, for them, at the time. Thus it was the right choice for them. It doesn't mean it was the right choice in terms of integrity, or the right choice for me, or you or anyone whose data got caught up in it. Nor was it right choice in receiving a paycheck the next week.
But the way it was explained, it doesn't seem like they went out of their way to pick a "wrong" choice, specifically. They picked what they felt was the right one, for them, at that time. There were less ethical options to choose as well, and those were not picked either.
You appear to be talking about the external consequences of choices, while I am talking about them making a choice based on what they believed was the inner rightness of their choice. They did not want to be associated with a company like that, so they made the choice to not be -- because it aligned with their inner knowing of not wanting to be a part of that company. The right or wrongness in terms of external consequences is not what makes the choice, right or wrong -- for them
But they left the vast majority of the morality on the table. They even talked to a lawyer to avoid reporting. So in the sense of making the choice that aligns with inner rightness and makes them moral, they still made a bad choice.
> making the choice that aligns with inner rightness
Again, I am talking about -- them -- not anyone one else or what anyone else thinks of it outside of them. I am not talking about "inner rightness" in general, I am talking "what they believed was the inner rightness of their choice" -- Their inner rightness. You seem to be talking about what -- you and/or others -- may believe from an outside perspective. My outside perspective is they made the choice that did not align with integrity. But that does not mean that was not the right choice for them.
And again, they made the right choice, for them -- at that time. How that plays out after is neither here nor there and in your labeling it a "bad" choice for them is akin to saying that they have no real agency over their choices, and we outside of them are the final say in what is good or bad for that person.
Again, I am talking about things internal to that specific person just as much as you are. Not external anything.
You are trying to focus on what they believed in that moment, but I see no reason to use that in an analysis of whether their actions fit their own morals. Sometimes people make mistakes even by their own rules. If we only care about what someone thought right in the heat of the moment, that category of mistake would be impossible, and it's not impossible. Saying that mistakes are possible is not overriding agency.
The core of it is in this line "the choice was what they seemed to think was right, for them, at the time. Thus it was the right choice for them". I don't agree with that logic at all. Humans are not good enough at following their own motivations and principles. They are impulsive and bad at analysis. You can't assume that their choices will always be consistent with their personal parameters of right and wrong.
Also, saying I think someone made a mistake is not denying agency. Don't be so melodramatic. Nowhere am I claiming to have the final say. I merely have the right to an opinion.
I was never talking about if they made a mistake or not. That is after the fact and outside the scope of what I have been saying. I know it matters, but that is not within the scope of my first comment that started this.
I took the little information they gave and from that the only true logical conclusion was they made the right choice for them at that moment. Full Stop.
You’re the one bringing the extra opinions into the matter and reading into a simple thing far too much. Most of the above I agree with you on outside of this particular thread. It has nothing to do with the very narrow scope of my original comment and attempted clarification.
Neither of us can know 100% what was right or wrong for them in that moment, but based on the information of A. no longer feeling right about being associated with a place for reasons that they deemed important enough to come to this conclusion — and B. aligning actions with that inner knowledge; makes it the right action (choice) for that person. If they changed their mind later, it does not change the immutable facts of that moment. It simply provides a new set of choices and options that is outside the scope of my original comment.
> I was never talking about if they made a mistake or not. That is after the fact and outside the scope of what I have been saying. I know it matters, but that is not within the scope of my first comment that started this.
When I say mistake here, I specifically mean "mistake as far as their goal of making the right choice". And I mean that in the moment, using knowledge they have at that time, just like you're defining "right choice". Nothing after the fact nor outside the scope.
> I took the little information they gave and from that the only true logical conclusion was they made the right choice for them at that moment. Full Stop.
I don't see how they gave enough information to be sure, but more importantly you seemed to make a generic statement that anyone making a choice like that would be making the right choice, and that's what I really object to.
> You’re the one bringing the extra opinions
I am not! Please stop misreading me! Why won't you listen to what I'm saying about my own argument?
> Neither of us can know 100% what was right or wrong for them in that moment,
Please explain how "neither of us can know 100%" can be true at the same time as "only true logical conclusion was they made the right choice for them at that moment. Full Stop."
> A, B
Remember that not reporting the company was also part of the choice they made. The basic description of the choice was to report, quit, both, or neither, and they chose to quit.
> If they changed their mind later, it does not change the immutable facts of that moment. It simply provides a new set of choices and options that is outside the scope of my original comment.
I'm not talking about whether someone might change their mind later with new information, per se. I'm making the objectively true claim that people don't always think things through, meaning their choice might fail to represent the knowledge and priorities they had at the time.
Since this thread seems interested, I will reveal the main issue being that based on my analysis, reporting to PCI and the state AG would have absolutely destroyed this (very) small business and the businessowner, someone who helped me in a very rough time, and thus I felt both options were bad/wrong, but resigning without whistleblowing was the better of the two options. I appreciate the analysis and really hope I made the right choice, and if I change my mind, I can still whistleblow on this, which has been a solace in the struggle in this decision.
Yes. The owner is old, and going blind, but refuses to sell or hand over day to day ops to someone else, and thus must ask for help on almost everything. I even pulled on my network to find a big processor with a good reputation to buy the company, but after constant delays and excuses for not engaging with them, I realized to the owner the business is both their "baby" and their social life, neither of which they want to lose.
Since moving overseas 15 years ago, I tried numerous times and it simply is not possible. All the forms require a U.S. mailing address to register. Same for online access to your Social Security account.
There are an estimated 10 million Americans living overseas. Taken together, we are the equivalent of the 11th largest state. All of us completely blind to what is happening with our credit record and Social Security account.
At this point I think the only way this gets fixed is massive fraud/exploitation by organized crime, so these organizations finally address the problem.
> There are an estimated 10 million Americans living overseas
Curious how you found this number, have a source?
This made me pretty curious, but I couldn't find any official numbers. The closest 'official' numbers that I could find are from the Federal Voting Assistance Program [0] and that lists 4.4 million people, but only 2.8 million of those being adults.
Strange that someone down-voted you, as this is a fair question.
> Curious how you found this number, have a source?
I don't have the source handy but have seen the estimated 10 million figure cited repeatedly. But maybe it is about a million too high, as the US Department of State estimates nine million in this 2020 publication: https://travel.state.gov/content/dam/travel/CA-By-the-Number...
Using FVAP stats to me seems problematic, because just like the general population, many US citizens do not bother registering to vote (though they do acknowledge this on the page you linked to and try to control for it).
State likely have a more accurate estimate from knowing how many passport renewals originate from overseas addresses. I am sure some Americans renew or replace their passports while merely travelling overseas, but I cannot imagine this is a routine practice.
Unfortunately, that isn’t enough to mitigate identity theft. Someone leveraging the recent National Public Data breach opened a checking and savings account using my identity (no credit checks are performed in doing so) then committed wire fraud using accounts.
Right, but you've got to do what's within your control, unless you're planning a Senate campaign and plan to resist significant and lucrative lobbying operations against you.
> To me, what's missing from that set of recommendations is some method to increase the liability of companies who mishandle user data.
As nice as this is on paper, it will never happen, lobbyist exists. Not to be tinfoil hat but why would any lawmaker slap the hand that feeds them.
Until there is an independent governing body which is permitted to regulate over the tech industry as a whole it wont happen. Consider the FDA, they decide which drugs and ingredients are allowed and that's all fine. There could be a regulating body which could determine the risk to people's mental health for example from 'features' of tech companies etc. But getting that body created will require a tragedy. Like why the FDA was created in the first place. [1]
>There could be a regulating body which could determine the risk to people's mental health for example from 'features' of tech companies etc.
I think ideas like this is why it's not going to happen.
Our understanding of mental health is garbage. Psychiatry used to be full of quackery and very well still might be. Treatment for something like depression boils down to "let's try drug in a random order until one works". It's a field where a coin-flip rivals the accuracy of studies. Therefore any regulating body on that will just be political. It will be all about the regulators "doing something" because somebody wrote enough articles (propaganda).
Problems like this are why people aren't interested in supporting such endeavors.
this argument reduces mental health to medication, which leaves aside everything from the history of mental health (asylums, witch burnings to today), leaps in medicine (from lobotomies, to SNRIs, bipolar meds and more), to simply better diagnoses.
There are certainly tons of people here who have benefited from mental health professionals - overextending the flaws in psych simply to dismiss the idea of a watchdog is several unsupported arguments too far.
I disagree, in brief because the practical side of psychiatry is medication-dominated, mostly because medical research is difficult and expensive.
There are some non-medication treatments for some psychiatric symptoms such as those caused by trauma (Prominently, EMDR) that some hail as actual cures, and even maybe depression (I am clearly not a doctor.) but in the case of depression I think you'll find its quite medication-heavy.
The reason for this is that psychiatrists are Medical Doctors and Psychiatry is a medical field which is of course bounded by the means of medical science. This is not to say there is some "magic" at work which science could never understand--not at all. It is merely the case that medical doctors are a research paper oriented bunch, and most of the medical research which makes it into practice is either relating to anatomy or pharmaceutical interventions.
Most of the treatments we have are pharmaceutical medications because most of our research dollars have gone into pharmaceutical research.
I decided to edit this comment to add: In my personal opinion, is probable that psychiatrists et all, writ large as it were, have already figured out how to cure depression. Only, we cannot really manage to employ it because it isn't a pill, therapy, device or surgery.
Most treatments we have for anything largely boil down to pharmaceuticals, not just in psychiatry, so I don't really understand what is different here from other medical fields (I personally think there should be more prevention in general). At least, a lot of mental health research and treatments comes from psychologists who don't work using with prescriptions. It's definitely not a flawless field, but I don't think it's that different than any other when it comes to lobbying and regulations being driven by politics over science.
Ironically, the proposed biological mechanism behind EMDR is totally incorrect, and everyone knows it, outside of some diehard polyvagal theory (also totally bunk) adherents. But the treatments do work for a lot of people, probably because it's just exposure therapy by another name.
Psychiatry is useful in the way Statistics is useful for math models we don't fully understand. Statistics let's us get at answers with enough data even though we don't really understand the underlying model at play.
There a whole host of 'sciences' that are kind of 2nd tier like this, Psychiatry being one of them. Once we understand enough Neuroscience, it's likely to me Psychiatry will get consumed by Neuroscience which will splinter into more useful for day to day life categories as it grows (like a psychiatrist)
Through civil disobedience is the only way stuff like this happens in America. You're right about the incentives to those in power, but how do you think we got emancipation2, women's suffrage, organized labor rights, prohibition and the end to prohibition?
But reveal any "classified" information about the govt and you will end up in jail. The severe asymmetry between what a citizen can do and what the govt gives itself the right to do is crazy.
I’m completely sympathetic to making companies more liable for data security. However, until data breaches regularly lead to severe outcomes for subjects whose personal data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner, it seems unlikely for such legislation to be passed.
I forgot where I saw this, but the US govt recently announced that they see mass PII theft as a legitimate national security issue.
It’s not just that you or I will be inconvenienced with a bit more fraud or email spam, but rather that large nation state adversaries having huge volumes of data on the whole population can be a significant strategic advantage
And so far we typically see email+password+ssn be the worst data leaked; I expect attackers will put in more effort to get better data where possible. Images, messages, gps locations, etc
yes, privacy is not an individual problem; it's a civil defense problem, and not just when your opponent is a nation-state. we already saw this in 02015 during the daesh capture of mosul; here's the entry from my bookmarks file:
https://www.facebook.com/dwight.crow/media_set?set=a.1010475... “#Weaponry and morale determine outcomes. The 2nd largest city of Iraq (Mosul) fell when 1k ISIS fighters attacked “60k” Iraqi army. 40k soldiers were artifacts of embezzlement, and of 20k real only 1.5k fought - these mostly the AK47 armed local police. An AK47 loses to a 12.7mm machine gun and armored suicide vehicle bombs. Finally, the attack was personal - soldiers received calls mid-fight threatening relatives by name and address. One army captain did not leave quickly enough and had two teenage sons executed.” #violence #Iraq #daesh
of course the americans used this kind of personalized approach extensively in afghanistan, and the israelis are using it today in lebanon and gaza, and while it hasn't been as successful as they hoped in gaza, hamas doesn't exactly seem to be winning either. it's an asymmetric weapon which will cripple "developed" countries with their extensive databases of personal information
why would a politician go to war in the first place if the adversary has the photos and imeis of their spouse, siblings, and children, so they have a good chance of knowing where they are at all times, and the politician can't hope to protect them all from targeted assassination?
the policy changes needed to defend against this kind of attack are far too extreme to be politically viable. they need to be effective at preventing the mere existence of databases like facebook's social graph and 'the work number', even in the hands of the government. many more digital pearl harbors like the one we saw this week in lebanon will therefore ensue; countries with facebook, credit bureaus, and national identity cards are inevitably defenseless
imposing liability on companies whose data is stolen is a completely ineffective measure. first, there's no point in punishing people for things they can't prevent; databases are going to get stolen if they're in a computer. second, the damage done even at a personal level can vastly exceed the recoverable assets of the company that accumulated the database. third, if a company's database leaking got your government overthrown by the zetas or daesh, what court are you going to sue the company in? one operated by the new government?
Are you saying you think more critical government databases than OPM or security clearance rosters are inevitably going to be breached?
I'd like to think the government or corporation can effectively protect some databases at least...
those are already pretty bad, but i think the really dangerous ones are things like verizon's billing records and customer location history, credit card transaction histories, license plate registrations, credit bureau histories, passport biometrics, enough voice recordings from each person for a deepfake, public twitter postings, etc.
> The 1943 bombing of the Amsterdam civil registry office was an attempt by members of the Dutch resistance to destroy the Amsterdam civil registry (bevolkingsregister), in order to prevent the German occupiers from identifying Jews and others marked for persecution, arrest or forced labour. The March 1943 assault was only partially successful, and led to the execution of 12 participants. Nevertheless, the action likely saved many Jews from arrest and deportation to Nazi extermination camps.
to avoid partisan debate, imagine a neo-nazi group takes over the us, which presumably we can all agree would be very bad. after they took over, how hard would it be for them to find all the jews? not just make a list of them, but physically find them? (much easier than it was in 01943, i'm sure we can agree.) how hard would it be for them to find all the outspoken anti-fascists? where could those anti-fascists hide?
now, step it up a notch. how hard would it be for them to find all the jews before they take over? it wouldn't be that hard if the databases leak. and if you feel safe because you're not jewish, rest assured that neo-nazis aren't the only groups who are willing to use violence for political ends. someone out there wants you dead simply because of the demographic groups you belong to. the reason you haven't been seeing widespread political violence previously is that it hasn't been a winning strategy
Very aware of that. That to me seemed like a targeted attack by a tracked APT group. What I’m referring to above is that the more vanilla attacks (ex: popular online mattress store gets popped) actually have national security implications, despite seeming like just an inconvenience
> Even minutiae should have a place in our collection, for things of a seemingly trifling nature, when enjoined with others of a more serious cast, may lead to valuable conclusion.
Then instead of regulating the companies, make SSN easily revokable and unique per service. I don't understand why Americans are so oppposed to a national ID despite the fact that every KYC service use SSNs and driver licenses.
The expansion of KYC and the hegemonic dominance of our global financial intelligence network is a recent infringement on our privacy that would not necessarily pass popular muster if it became well-known.
Most of our population is still living in a headspace where transactions are effectively private and untraceable, from the cash era, and has not considered all the ways that the end of this system makes them potential prey.
The fact is that the market is demanding a way to identify you both publicly and privately, and it will use whatever it needs to, including something fragile like a telephone number 2fa where you have no recourse when something goes wrong. It's already got a covert file on you a mile long, far more detailed than anything the intelligence agencies have bothered putting together. The political manifestation of anti-ID libertarians is wildly off base.
The concern about organizations and the governments feelings that it needs to track you is a very valid concern. Why does the government need to make sure your "hand job from a friend" venmo payment to your friend is "legally legit"? (You can get transactions flagged for this and the moderator will shame you)
Are you correct in what's going on? Yes. Are we placed in this with no option to resist? For the most part yes.
Emphasizing that the number can be changed would really help there.
People could even generate their own number (private key), which they never gave out, and appeared differently to each account manager verifying it, and still replace them.
When you choose your own number, it's only the Mark of the Beast if you are the Beast! * **
Shared secrets are criminally negligent security architecture in 2024. We can authenticate identity and authorize payment without giving the relying party a token to leak or abuse. The energy behind this problem is good, but "everyone try harder to protect the shared secrets entrusted to you" would be a tragic waste of it.
The first time would have been a tragedy, from then on it has been farce after farce.
Imagine a world where companies would have to prove the necessity of storing specific factoids. It would only take 1 security researcher to prove it being unnecessary, invalidating that class of "legitimate interests".
Today this value judgement happens in human brains, like the (correct) judgement in your comment. If we want to scale it objectively we would have to switch to formal verification. A whole industry of compliance checking could come to exist where a company wants to get its operations screened for compliance issues, so as not to suffer criminal negligence penalties.
The problem here is the payments industry (continuing to issue and accept "credit card numbers") and the voters (refusing to authorize a proper national ID). An individual entity that has to conduct business under these circumstances has no real alternative.
You are not being harmed by the storage or leakage of a few bytes, that's ridiculous. You are being harmed by the financial industry and government's insistence that knowledge of these bytes is sufficient to take your property or hold a debt against you.
Regulation is key, but I don’t see it as likely when our society is poisoned by culture war bs. Once we put that behind us (currently unlikely), we can pass sane laws reigning in huge corporations.
This does nothing for them being able to continue with shadow profiles and inferences about you based on data they gather from others in your social network. It is well beyond "data you provide". Like waaaaay beyond.
I get a feeling that liability is the missing piece in a lot of these issues. Section 230? Liability. Protection of personal data? Liability. Minors viewing porn? Liability.
Lack of liability is screwing up the incentive structure.
I think I agree, but people will have very different views on where liability should fall, and whether there is a malicious / negligent / no-fault model?
Section 230? Is it the platform or the originating user that's liable?
Protection of personal data? Is there a standard of care beyond which liability lapses (e.g. a nation state supply chain attack exfiltrates encrypted data and keys are broken due to novel quantum attack)?
Minors viewing porn? Is it the parents, the ISP, the distributor, or the creator that's liable?
I'm not here to argue specific answers, just saying that everyone will agree liability would fix this, and few will agree on who should be liable for what.
It's not a solvable problem. Like most tech problems it's political, not technical. There is no way to balance the competing demands of privacy, security, legality, and corporate overreach.
It might be solvable with some kind of ID escrow, where an independent international agency managed ID as a not-for-profit service. Users would have a unique biometrically-tagged ID, ID confirmation would be handled by the agency, ID and user behaviour tracking would be disallowed by default and only allowed under strictly monitored conditions, and law enforcement requests would go through strict vetting.
It's not hard to see why that will never happen in today's world.
But my point was that you asserted that regulations can overcome claims of impossibility. I was just illustrating that is not always true, and therefore we can't assume it is true here.
Well, something to consider is that part of why everything is so much expensive these days is that a lot of the solutions to those problems add costs. That cost needs to be absorbed by the price.
One of the reasons it's so expensive to build a house is safety regulations. They exist for a reason, but they nevertheless add a substantial cost to building a house. If you had mandated such a cost to people living in 1870 then a lot fewer people could've afforded a house.
We should stop begging the for profit house building industry to make affordable housing. Just use the army core of engineers and build the mega cities from Judge dredd.
In fact you can say that about most regulations of any sort, this seems to hit people's brains in the same way as how anti-vaxxers are so cavalier about things like Measles because we effectively eradicated it via vaccination (except it's now making a comeback thanks to anti-vaxxers) and people have forgotten how horrible it is, in the same way people forget, sure, houses used to be cheaper to build. And they also burned down a hell of a lot more, or were constructed poorly and not to code, or were built too close together, etc. etc. etc.
Just about every regulation that exists for every product or thing or way of doing something was written not even after a death, that's usually not enough, it needs to be a substantial number of deaths that can be directly linked to the thing the regulation covers and only then does it become law.
It still adds an enormous amount of cost. Despite that buildings (and even bridges) still collapse. What is often not asked is how many people lack housing because those building codes made it unaffordable for them.
>Protection of personal data? Is there a standard of care beyond which liability lapses (e.g. a nation state supply chain attack exfiltrates encrypted data and keys are broken due to novel quantum attack)?
There absolutely should be, especially for personal data collected and stored without the express written consent of those being surveilled. They should have to get people to sign off on the risks of having their personal data collected and stored, be legally prevented from collecting and storing the personal data of people who haven't consented and/or be liable for any leaking or unlawful sharing/selling of this data.
If you aren’t directly harmed yet what liability would they have? I imagine if your identity is stolen and it can be tied to a breach then they would already be liable.
The fact that my data can be stolen in the first place is already outrageous, because I neither consented to allowing these companies to have my data, nor benefit from them having my data.
It's like if you go to an AirBNB and the owner sneaks in at night and takes photos of you sleeping naked and keeps those photos in a folder on his bookshelf. Would you be okay with that? If you're not directly harmed, what liability would they have?
Personal data should be radioactive. Any company retaining it better have a damn good reason, and if not then their company should be burned to the ground and the owners clapped in irons. And before anyone asks, "personalized advertisements" is not a good reason.
That's the big problem with relying on tort law to curb this kind of bad corporate behavior: The plaintiff has to show actual injury or harm. This kind of bad behavior should be criminal, and the state should be going after companies.
> before anyone asks, "personalized advertisements" is not a good reason
The good reason is growth. Our AI sector is based on, in large part, the fruits of these data. Maybe it's all baloney, I don't know. But those are jobs, investment and taxes that e.g. Europe has skipped out on that America and China are capitalising on.
My point, by the way, isn't pro surveillance. I enjoy my privacy. But blanket labelling personal data as radioactive doesn't seem to have any benefit to it outside emotional comfort. Instead, we need to do a better job of specifying which data are harmful to accumulate and why. SSNs are obviously not an issue. Data that can be used to target e.g. election misinformation are.
> it's all vastly valuable and that's why it is right that it is taken without consent or compensation?
No, I'm saying it's a common with a benefit to utilisation. A lot of discussions around data involve zealouts on both sides. (One claiming it's the god-given right to harvest everyone's personal information. The other acting like it's the crime of the century for their email address to be leaked.)
I mean it's pretty clear that you are directly harmed if someone takes naked photos of you without your knowledge or consent and then keeps them. It's not a good analogy so if we want to convince people like the GP of the points you're making, you need to make a good case because that is not how the law is currently structured. "I don't like ads" is not a good reason, and comments like this that are seething with rage and hyperbole don't convince anyone of anything.
What is the harm? It is not obvious to me, if the victim is unaware...unless you are alleging simply that there is some ill-defined right to privacy. But if that is so, why does it apply to my crotch and not my personal data?
These are exactly my questions. If I never, ever know about those pictures and never, ever have my life affected by those pictures, what is the actual harm to me?
If the answer to them ends up being "Well, it's illegal to take non-consensual nudie pictures.", then my follow-up question is "So, why isn't the failure to protect my personal information also illegal?".
To be perfectly clear, I do believe that the scenario kibwen describes SHOULD be illegal. But I ALSO believe that it should be SUPER illegal for a company to fail to secure data that it has on me. Regardless of whether they are retaining that information because there is literally no way they could provide me with the service I'm paying them for without it, or if they're only retaining that information in the hopes of making a few pennies off of it by selling it to data brokers or whoever, they should have a VERY SERIOUS legal obligation to keep that information safe and secure.
Just want to point out that the company is usually also doing what it can to get other information about you without your consent based on other information it has about you. It's a lot closer to the "taking non-consensual nudie pictures" than "fail to secure data" makes it sound.
I mean most people won't until that day they find out theirs a house in Idaho under their name (and yes I've seen just this happen).
The problem here is because of all these little data leaks you as an individual now bear a cost ensuring that others out there are not using your identity and if it happens you have to clean up the mess by pleading it wasn't you in the first place.
The real kicker is trying to prove which leak your SSN came from. If your SSN gets leaked by 3 different companies, and 6 months later someone uses your identity to commit some crime, you can't have each company share 1/3 of the blame.
I think a better example would be You (AirBnB Host) rent a house to Person and Person loses the house key. Later on (perhaps many years later), You are robbed. Does Person have liability for the robbery?
Of course it also gets really muddy because you'll have renting the house out for those years and during that time many people will have lost keys. So does liability get divided? Is it the most recent lost key?
Personally, I think it should just be some statutory damages of probably a very small amount per piece of data.
The particular problem comes in because the amount of data lost tends to be massive when these breaches occur.
It's kind of like the idea of robbing a minute from someone's life. It's not every much to an individual, but across large populations it's a massive theft.
Sure and if you pay a statutory fine times 10 million then it becomes a big deal and therefore companies would be incentivized to protect it better the larger they get.
Right now they probably get some near free rate to offer you credit monitoring and dgaf.
> I think a better example would be You (AirBnB Host) rent a house to Person and Person loses the house key.
This is not a direct analogue, a closer analogy would be when the guest creates a copy of the key (why?) without my direct consent (signing a 2138 page "user agreement" doesn't count) and at some later point when I am no longer renting to them, loses the key.
This version loses multiple parts of things that are important
1. I have no control over what was stored
2. I have no control over where the storage is
The liability in this case is the homeowner/host, as you should have and had full ability to change out the locks.
To make it more similar, I think you'd need one of the guests to have taken some amount of art off the wall, and brought it to a storage unit, and then the art later was stolen from the storage unit, and you don't have access to the storage unit.
It's not as good as the naked pictures example because what's been taken is copies of something sensitive, not the whole thing
this is outrageously incorrect analogy.. you ASSUME property ownership in the first statement. Where are personal legal records analogous to owned property? by whom?
This is the traditional way of thinking, and a good question, but it is not the only way.
An able bodied person can fully make complaints against any business that fails their Americans with Disabilities Act obligation. In fact these complaints by able bodied well-doers is the de facto enforcement mechanism even though these people can never suffer damage from that failure.
The answer is simply to legislate the liability into existence.
This is exactly why thinking of it in terms of individual cases of actual harm, as Americans have been conditioned to do by default, is precisely the wrong way to think about it. We're all familiar with the phrase "an ounce of prevention is worth a pound of cure", right?
It's better to to think of it in terms of prevention. This fits into a category of things where we know they create a disproportionate risk of harm, and we therefore decide that the behavior just shouldn't be allowed in the first place. This is why there are building codes that don't allow certain ways of doing the plumbing that tend to lead to increased risk of raw sewage flowing into living spaces. The point isn't to punish people for getting poop water all over someone's nice clean carpet; the point is to keep the poop water from soaking the carpet in the first place.
Safety rules are written in blood. After a disaster there’s a push to regulate. After enough years we only see the costs of the rules and not the prevented injuries and damage. The safety regulations are then considered annoying and burdensome to businesses. Rules are repealed or left unenforced. There is another disaster…
Tangentially, there was an internet kerfuffle about someone getting in trouble for having flower planters hanging out the window of their Manhattan high rise apartment a while back, and people's responses really struck me.
People from less dense areas generally saw this as draconian nanny state absurdity. People who had spent time living in dense urban areas with high rise residential buildings, on the other hand, were more likely to think, "Yeah, duh, this rule makes perfect sense."
Similarly, I've noticed that my fellow data scientists are MUCH less likely to have social media accounts. I'd like to think it's because we are more likely to understand the kinds of harm that are possible with this kind of data collection, and just how irreparable that harm can be.
Perhaps Americans are less likely to support Europe-style privacy rules than Europeans are because Americans are less likely than Europeans to know people who saw first-hand some of what was happening in Europe in the 20th century.
I am currently ~400 pages into the Power Broker. I was motivated to pick it up again by a "read along" with Roman Mars from the 99% Invisible podcast. He's spacing out the book over the course of a year and interviewing fellow Caro fans and recapping major portions of the book. Never been a better time to tackle the beast! I am not sure I'll ever read a better biography in my life. At least, not until I read the Lyndon Johnson books.
Thank you for your incredible book Cliff. I found a copy when I was in high school about ten years ago and it changed my trajectory. It got me into hacking and tinkering with computers and led me to a career I love today. I always make a point of loaning my copy to anyone I see who was my age then with an interest in computers.
And thank you for your kind note -- the technology in the book feels antique today, but I suspect that many infosec people recognize both the story and my attitudes. Best wishes to you in your computing career!
Same. I don’t know where I’d be without it honestly. But certainly not where I am. It was the first and only thing that ever really clicked for me. Only I found it back in the early 2000s. Quite how I found it, I’ll never remember, but I found it at a dark time in my life and it had a profound impact then, through now.
Thanks, oh Shackleford. Dark times (in life, at night, or during an eclipse) can lead to remarkable observations and insights. I'm honored that m'book played a part in your own story.
A good chunk of southeastern Manhattan is dramatically underserved by public transit, despite what the MTA's map would have you believe.
I'm talking about from the Seaport all the way up to Alphabet City. I hope you've got strong legs.
Tangentially, this is one of the reasons that nearly-invisible corners of Manhattan like the eastern end of Cherry St and Water St still have serious crime problems today.
Honestly that whole stretch between Smith Houses and Vladeck Houses is pretty fucked.
If you are living in a place that forces you into car ownership as a means of transportation, then you are receiving a subsidy in the form of the infrastructure that enables car dependent city planning. You're also compelled to own a car, which is enormously expensive, getting even more expensive, and is probably the thing you do on a regular basis which is most likely to kill you. Sprawl is expensive, and so is car ownership.
Upvote; People complain about a congestion tax -- or traffic -- or bad roads. But they don't think about policy when when a car costs ~30% of a median salary, when insurance is "required", expensive (and part is because some choose not to afford insurance while driving a car). Beyond that car / driving enforcement is a drain on police preventing more dangerous crime, a top entry point of harassment and escalation by police, a drain on District Attorneys and the courts from enforcing other crime.
> If you are living in a place that forces you into car ownership as a means of transportation, then you are receiving a subsidy in the form of the infrastructure that enables car dependent city planning.
It costs more to build a road that supports a bus than it does to build a road that only supports cars. OTOH, the roads also need to support fire engines, so there's that. Certainly stores devote more real estate to parking than they would if I didn't live in a car dependent infrastructure, but I'm paying for that in some way or another.
Otherwise, what infrastructure do you think I'm getting subsidized? I don't have muni water or sewer, and the power and telco utilities certainly pass along their costs to me.
> Otherwise, what infrastructure do you think I'm getting subsidized?
The city you drive into is subsidizing your ability to drive into the city, the space to park in the city (which could be used for more housing), paying the cost of your emissions and noise, so that you can live a cheaper life in an area that's generally more expensive to sustain per-capita.
> I don't have muni water or sewer, and the power and telco utilities certainly pass along their costs to me.
The power and telcos generally do not pass these costs onto you. The costs are spread across the entire user-base, and it's more expensive to support you because it's more infrastructure for less people. Streets/roads/highways are also generally subsidized.
Suburbs and extreme white-flight areas are heavily subsidized by cities, especially if you're commuting into them for work. If the costs of sustaining your living situation were truly passed onto you, you wouldn't be able to afford to live there.
> It costs more to build a road that supports a bus than it does to build a road that only supports cars.
This isn’t true and it’s also missing a bigger point: you need many more lanes for cars than buses. That space is not providing economic value and has to be subsidized using general fund revenue when it could be used by businesses or for housing.
Busses weigh a lot more than most cars, and require a better prepared road bed if you want the road to last. If it's just private light duty vehicles, you can build to a much lower standard; gravel roads are perfectly servicable for cars, but will suffer heavy wear from frequent busses. Road preparation is especially important where many busses are expected to stop and wait for long periods of time, bus stops are often built to an even higher standard.
In the city I live in, nearly all roads are one lane in each direction. Even if we had a lot more busses, I don't see how we would have fewer lanes. If we had a lot less traffic, one lane roads could work.
The minimum infrastructure for busses is more than the minimum infrastructure for cars. Although, if you're getting municipal roads, it makes sense to build them to standards so you can use busses.
This thread is about one of the largest cities in North America and that’s the context of my comment: if gravel roads are an alternative you’re not looking at congestion tolls, and you already need to build the roads to handle things like trucks.
Re: lanes, yes, rural areas are different but if you look around suburban or urban environments there are a ton of 4-8 lane roads, complex interchange ramps, etc. which exist only because people drive solo and the resulting congestion leads to a massive amount of dedicated space. If you count the number of people on a given block, it’s usually an amount which will fit on a single bus. This is really eye-opening if you’ve ever driven in New Jersey where there are these huge congested roads full of cars and a single train goes by with more people than every car in eyesight.
That was someone else, but I think the point of comparison was the New Jersey and Connecticut suburbs whose drivers are affected by this change rather than rural drivers. Those kind of places are where you see such a large amount of the local budget going to road construction and maintenance because they have the combination of high population and limited transit options.
What are you talking about? The roads in my city are paid for my taxes remitted to the city. I guess you could call that a subsidy but that's also just known as being paid for by taxes. And if you're in an area where everyone needs a car to get around then there's no argument that drivers are mooching off the tax revenue of non-drivers. I swear people are so salty about roads when they don't drive but nobody complains about public schools when they went to private.
Owning a car isn't enormously expensive except in online discussions where people quote the MSRP of $year+1 models and act like folks making minimum wage are actually paying that. My primary car is a 2012 Honda Fit that was $6000 when I bought it at 30k miles and is now pushing 120k. I bought it in cash, but the monthly payment with insurance would have been 15% of my rent.
The city also has to pay for utility lines, which are much more expensive in suburban sprawl than the urban center. Also, zoning laws make it more expensive to build apartments, so you really only get single-family houses in the suburbs and apartments in the inner city. If you use property taxes to pay for infrastructure, the inner-city residents (living in apartments, and likely poorer) are paying most of the money for infrastructure they never use.
This isn't even moving the goalposts, this is switching to water polo. You don't get to tally every cost of suburbia and then say that's the cost of people driving cars. The argument doesn't apply to someone who lives in a city and drives a car nor someone who lives in a rural town who drives a car.
You're really just arguing that suburbia is a drain on city budgets and I can agree with that, it's a drain on a lot of things. I think the reason it persists and gets special treatment is because a significant number of people consider it the goal and see themselves moving out of the city eventually.
But more generally people get so stuck in the idea that tax dollars will be spent on things that aren't for you. Am I the weird one that's unbothered by this? If your vegan you're paying for meat and dairy subsidies you don't use, if you don't have kids you're paying for schools you don't use, if your house is all electric you're paying for gas subsidies you don't use, if you're not outdoorsy you're paying for parks you don't use, if you're acab you're paying for police you don't want, if you believe that caging people is immoral you're paying for whole prison systems you don't want.
Most Americans do not drive solely on city/town roads, we rather frequently take highways and interstates which are federally subsidized - not mostly paid for by city taxes.
You or your city may be exceptions, you might drive only on city roads, but the parent comment's point about subsidies is broadly correct.
I don't think anyone here is under the impression that government subsidies don't come from taxes. The criticism above is that subsidies skew the observed relative prices of transport at the point of use.
Yes, but I think the poster's point was that their locality maintained the roads using tax dollars collected from the locality - i.e. their local roads are sustainable system.
All US dollars are created by the US government, the ability of the US government to create valuable dollars comes from the tax base, so of course everything eventually goes back to taxes.
Hugely agree on transit access to the airport, but it has gotten somewhat better. The GCT Madison connection has enabled another connection to Jamaica for the JFK AirTrain alongside LIRR and the E-train. And no longer do you need a separate MetroCard, as the Port Authority has finally modernized with contactless payments.
And the Q60 bus serving LGA also couldn't be easier. It picks up from a clearly designated spot on the lower level and drops you off right at Jackson Heights for E and 7 access. Could there be a direct rail connection a la O'Hare? Yes, and there should be.
Great, now expand it to all of Manhattan, instead of just 60th and below.
And while they're at it, build the QueensLink so people actually take transit instead of just turning it into a park so that it can never be built.
It boggles my mind how unable NYC seems to be able to invest it its largest comparative advantage to every other city in the country: its density and transit access.
If you're referring to the number of folks who work in the central business district of Manhattan but have no choice but to drive (given the enormous catchment area of MTA services), that number is vanishingly small, and congestion pricing does have low income discounts.
If you're referring to those who drive taxis or cars-for-hire in Manhattan, yes, the idea is the cost should be borne by riders who choose those services instead of transit.
There is no "CBD" in Manhattan. It's a made up term created for this program to make the pill less bitter. Let's be real, it's half the fucking island and where mostly everyone in the city works and shops. That's no small number.
It's everyone making deliveries to those businesses. It's every one doing manual labor jobs requiring tools. It's city workers on low salaries who have to live so far out in the boroughs where the MTA isn't even a good option to get to work anymore. The whole FDNY is losing their shit over this congestion pricing in particular because it hits them fairly hard.
> There is no "CBD" in Manhattan. It's a made up term created for this program to make the pill less bitter. Let's be real, it's half the fucking island and where mostly everyone in the city works and shops. That's no small number.
But it's not half of the city. NYC is more than Manhattan.
I'm sure all the plumblers, electricians, etc (the people who actually do the hard work of making the city actually function) are taking all their tools and materials around town on the buses and subways.
This is just what Kahn's FTC does.