Hacker News Reader

Comment by Deukhoofd | Hacker News Reader

I think a great example of why data privacy matters was the recent concern many American women had about whether data collected by their period tracking app could be used to persecute them for abortions. While you might believe that the data being collected about you is harmless, a government hostile to you could use that data against you with great effect.

View on HN

An even more worrying account of data hoarding was when homosexuals were registered and later sent to concentration camps... (Yes, I've just invoked Godwin's law)

In my opinion data should be regarded as a liability by default.

We can't rely on a given corporation being benign, or not cooperating with a given regime forever.

Grindr is being abused by egyptian police to persecute gay and bisexual people: https://www.washingtonpost.com/world/2023/03/24/grindr-egypt...

Grindr was bought by a Chinese company. Gee, I wonder why a (I presume CCP backed) company would want a list of all the closeted gay US Senators?

This is precisely why Germany (and thus the EU) is the global leader in personal data protection and on-device ML requirements.

When I was at Apple getting iCloud off the ground, we had to carve out exemptions for all client-server syncing to allow phone-mac sync specifically for Germany. Because they know what happens when the government can subpoena your data.

No Godwin necessary. There are plenty of countries like Saudi Arabia or Uganda where in 2023 your sexual orientation can be a capital offense.

> a government hostile to you could use that data against you with great effect

A future government - one that is very different from the one currently in power or that you ever imagined possible - could use that data against you with great effect.

A foreign government hostile to you could use that data against you with great effect.

An institution hostile to you could use that data against you with great effect.

A corporation hostile to you could use that data against you with great effect.

A stalker could use that data against you with great effect.

And so on.

The case with foreign govts are expressly part of why I'm unlikely to ever visit certain countries. Being critical of a foreign govt online can get you in trouble if you ever need/want to visit. Best case, you get turned back... but can only imagine how bad a worst case could get.

Or, having your own govt take you out with a drone strike while on foreign soil.

A media outlet hostile to you could use that data against you with great effect - and it's already happened. The owners of Sanctioned Suicide were deanonymised by the NYT in part from illegally obtained data - the Epik breach.[1]

These were individuals who intended on staying pseudonymous, operated something that was legal-but-disagreeable-to-the-public, but yet fell victim to a hack that spilled their identity. And in spite of that, journalists felt it ethical to use illegally obtained data in part to "out" them. Nobody to my knowledge called out the problems with this - or that this same ethically fraught tactic may one day be used by organised harassers and right-wing outlets to deanonymise people seeking abortion or gender-affirming care.

Here in the US, the First Amendment makes any legal remedy to this hard to achieve. Yet still, we could be doing far better than to passively condone the use of illegally obtained data in investigative journalism to highlight unpopular, perhaps even vile, but legal activities.

[1]: https://archive.ph/eL4dS

Or the despicable doxxing by the NYT of Scott Alexander, author of the blog State Star Codex.

One of my wife's friends was married to a senior Google engineer, and after a messy divorce needed help to avoid stalking by him. In addition to being a privacy roach motel, Google had shockingly bad controls and auditing to detect and punish abuse, not sure if that's still the case but I wouldn't be surprised.

In a world where data is carelessly collected and insecurely stored, it won't just be prosecutors using it to obstruct access to abortion or gender affirming care. It will be organised online harassment campaigns as well, using ML to comb through combinations of legally and illegally obtained data - years and years worth - to build an instant dossier on anyone they deem a target, and highlight aspects of their personal life that they had never intended to come to light, or even thought would one day be angering enough to justify widespread harassment.

The article used Google Ads as an example. Let's say, god forbid, Google Ads suffers a breach, and it turns out they didn't anonymise the data used to build personalised ads at all. Any one of these organised harassment campaigns can pick out targets of their ire simply by what was recommended to them in ads.

That's an example of being concerned, though. That is, people imagine a possible future and they are concerned about it.

When we think about the future, this is the stuff of imagination, storytelling, and mathematical models. It's mental constructs, not something that actually happened.

Many examples used in privacy arguments are like that. If you instead look for things that actually happened, it's things like journalists, activists, doxing, crazy exes, and so on. And certainly if you're in a war, good opsec is important.

These are certainly things that happen, but it seems reasonable for many people to look at them and decide their own risk is low, compared to other disasters you could prepare for.

If you are gay, transsexual, or a woman, (or assist one of those groups with getting medical care) that "war" is upon you now.

And, this war has been foretold for decades now.

Yes, this depends on who you are and where you live. By war I meant actual war, like in Ukraine.

Also, I don't think Google is the problem for vulnerable minorities, and it might be part of the solution, because they do have good security?

Using Google isn't a good idea is you think law enforcement might take an interest and get a warrant, though.

I also think it's important to maximize personal liberty... even for those you don't agree with. It's disturbing how many people support overt censorship and thought crimes. Eventually it can and will be used against you. Govt in general will always abuse every power granted in the end, and everything you let it do to attack "the other side" can be turned on you.

This is a classic example of an ideological argument. But of course ideology is important to many people.

Of course it's an ideological argument. Censorship in general is almost always about ideology.

I think what's new here is that digital data can be store long-term easily.

In that case though the data collection is presumably required (to some extent) for the app to function. If you're tracking a users periods then you presumably need to store data about their period.

It's probably a case for why we should have anonymous users accounts for those kind of services. I don't know how practical that is.

Yes, that's a good one. I'll need to look for an article that describes that well.

Reply on news.ycombinator.com