The Marginal Ethics of Privacy | Hacker News Reader

The Marginal Ethics of Privacy

consult.sauvik.me

46 pointssdas720 comments

In the last year, differing answers in different societies to the following hypothetical privacy scenario have seemed important.

Suppose there is a dangerous, highly infectious novel pathogen which can be spread by apparently asymptomatic people. Alice tests positive for this pathogen. Does she have the right to keep this information private? Alice tells Bob, but asks Bob to keep the fact of her positive test private. Bob knows Alice has seen other people during the window where she could potentially have been infectious. Is it socially acceptable for Bob to post on Facebook that Alice tested positive?

What if Alice's government systematically tests people and carefully follows people who test positive? Is Alice less free? Does she have fewer rights than if she lived in a society with strong norms against this kind of thing? What if the latter society has a much harder time containing the epidemic, resulting in longer-lasting, more onerous restrictions on public gatherings due to uncertainty about who is and isn't infected?

Well your scenario is obviously playing out to be true, this doesn’t mean that we need to degrade privacy on all fronts. It’s reasonable to me that someone might have to disclose that they have a communicable disease yet still have privacy in the vast majority of areas of their life. Heck, before the pandemic this was already the case; you can be prosecuted in many countries for the intentional (or intentionally undisclosed) transmission of HIV.

Talk about privacy reminds me of Wittgenstein’s Philisophical Investigations, in which he expounds that we get into so much conceptual trouble when we try to use words like “truth” in the abstract instead of looking at cases where people actually say that word. Privacy is not a single right or a single action, it is an umbrella term for hundreds of unrelated things. Privacy means totally different things in the following scenarios:

- at the doctors office - at a nude beach - in a changing room - between neighbors - among parents and children - a “private person” (i.e. someone who doesn’t share their thoughts readily) - private enterprise

The last one is different from the rest, but not in a way that is especially relevant I think. No one is confusing the private sector with a right to privacy. The rest seem to me to have an obvious common thread, and it should be possible to make arguments general to all of them even if there are meaningful specific differences. The question is when are you willing to declare it illegal to disclose facts about another person, because in some sense that person owns facts about themselves. When are you willing to declare it utterly socially unacceptable? I'm willing to accept that there may be cases where the answers to these questions differ, but there should be principles common to all scenarios.

You should probably add to the equation that in the past scenario the government is still systematically collecting information about your location, they just don't use it for contact tracing.

Why is that relevant?

In 2021, there is not really a question about whether your government is going to track most people's movements - the question is actually if that should be used for productive uses also. Which is a difficult question, don't get me wrong, and arguably more interesting.

Seems pretty simple, Bob is the asshole for being a bad friend and for pretending his backstabbing made a difference in the grand scheme of things. The people who were already exposed are either already in a hospital and know or they're fine. If I had a friend behaving like Bob I'd counter by saying I got it from him and that he's deflecting.

What if the people who were already exposed are currently asymptomatic but contagious?

Same answer. Bob's decided to take something told in confidence and risk my reputation sharing it. He's not only a bad friend but clearly a risk so the best move is to burn him back and as hard as possible. He's getting dragged in and if he argues Im going to turn it into a larger issue for him. If we're coworkers I'm going straight to HR and asking what to do because a fellow employee infected me and then tried to put the blame on me. Anything but total calculated aggression will justify Bobs behaviors.

I guess it depends on whether you think someone has a right to a reputation independently of how they behave. Thanks for your answer, it was very enlightening.

To clarify, I'm aware there's a difference in perspective occurring. You're approaching it more from if it's beneficial to the larger group. But Bob is supposed to be my friend, if I can't trust him to keep something socially volatile like that a secret then he's failed me at an individual in a potentially harmful way. At an individual level it makes far more sense to bury Bob than say 'thanks for screwing me Bob'

Is your name Alice? I'm pretty sure I posed the question in the third person.

At the end the author asks which world are we closer to. I think we're close to both. For people that want to cloak their identity, it is getting easier to do so, while at the same time having world-wide scope for distribution or consumption. But it is also the case that for the average person their behavior is available for the government to observe.

For me the problem with lack of privacy, isn't the lack of privacy itself, but rather the lack of symmetry. For example, if I had the same visibility into the individuals/orgs observing me, including knowing they were observing me -- I feel like I'd be less worried about lack of privacy.

> "...if I had the same visibility into the individuals/orgs observing me, including knowing they were observing me -- I feel like I'd be less worried about lack of privacy."

we should take this one step further and escalate transparency based on size, money, influence, and power. a poor individual generally has little power, so gets broad privacy protections, while a multi-national corporation needs to be fairly transparent in its practices and aims.

the constitution (with amendments) plus public markets together sort of implement this at a course and haphazard level, but we should implement it broadly and smoothly. both democracy and fair (not simply free) markets depend on individuals having autonomy and information.

Poor individuals also commit most of the crime that damages their community. Focusing only on the money at stake ignores whether or not the victims matter. I care a lot more about getting thugs and shoplifters out of my neighborhood than I care if Google 'violated' my privacy since the former hurt me in the real way and the ladder only hurts me if I'm white and paranoid.

no, the poor don't commit most of the crimes, and what crimes they do commit are often crimes of necessity and of quite limited effect. whereas, the crimes of the well-to-do are often large and affect a broad range of society (y'know, like the sacklers, madoff, putin, or bashar al-assad). worrying about thugs and shoplifters makes as much sense as worrying about lightning strikes, pickpocketing, kidnapping, and drowning in a bathtub. if you worry about the former, you should seriously worry about the latter too. but you shouldn't ever worry about any of those things, since they're exceedingly unlikely and/or of limited effect. centers of power, wealth, and influence are far more likely to negatively affect your life, potentially dramatically, than a thug or a shoplifter.

I'm not sure it is getting easier to cloak identity, because privacy-defeating mobile phones are required to do more and more things in society, for example:

1) Around the world, ID is increasingly required to buy a SIM card, because governments want one-to-one mapping between a phone number (and IMEI) and a particular person. Surveillance-heavy countries can then trivially link all mobile web-browsing to that particular person.

2) Nearly all of the "vaccine passports" that have been announced recently are intended to be mobile phone apps that generate a limited-time QR code, ostensibly to prevent forgery as could happen with paper certificates. Knowing how lazy governments are, the Android version will probably require Play Services, which means Android phone owners will have to disclose a ton of info to Google – it won’t be as easy for people to install a de-Googled Android and still e.g. enter restaurants or cross borders.

3) The same is true of online banking, as many banks have phased out e.g. code cards and they now require a mobile app for authentication. Such mobile apps often require Play Services and, citing lack of security, refuse to launch if a user has unlocked the phone's bootloader and installed a more privacy-respecting Android version. It is not longer reasonable to tell privacy-savvy people to eschewing online banking and visiting their bank to do their business: physical bank locations are being slashed left and right, and even in the physical location they might tell you "Oh, you have to go online to do that".

I think a similar question worth pondering is: Is increased development of pay-for-privacy ethical in similar extremes?

Extending the authors arguments, it would be unethical to develop pay-for-privacy if it reserves privacy for the few and ends up hurting democracy. I wasn't a fan of CA's prop 24 precisely because it wasn't clear enough on this question.

Offcourse, most people aren't worried about ads, but about their boss seeing something they want to keep private. I imagine once the ads and tracking get invasive enough, there will be more outcries if there aren't enough already. Anyone can setup a Pi-hole, get Signal, and at least try to use alternative privacy-respecting platforms, but even that may not be enough if ISPs and other lower-tier providers also track you and offer opt-outs to only those who can pay more.

I enjoyed the breakdown of the 2 hypothetical worlds since it gives a mental model for how to think about the problem.

I personally have never taken a class on ethics so I'm not sure how to handle the fuzziness that comes from translating this into the real world. Just because technology exists does not mean it is applied everywhere it should be. We _could_ be in a state where bad guys (tm) may be able to hide while the general population remains in a blissfully ignorant state of being surveyed. Is improving privacy enhancing tech ethical in this situation when the general population may continue to ignore the tech and continue being surveyed?

A recent book on the topic for those interested: Privacy is Power: Why and How You Should Take Back Control of Your Data by Carissa Véliz

https://www.amazon.com/Privacy-Power-Should-Take-Control/dp/...

Reply on news.ycombinator.com