Secret Service Says Users Agreed to Location Tracking in Terms and Conditions
404media.co
404media.co
Imagine having your daily news as a clean PDF document with working links. It might also have the psychological effect of signalling when you're "done" similar to reaching the end of a newspaper
Perhaps, though, this will increase people's awareness that these terms and conditions are typically extremely permissive, and that permissiveness is a real risk to them.
Especially now.
The end result? The population have spoken. They don't care. It might be too late already, or maybe we have another few years left, I don't know. Everyone aware of the XX century history, I think, sees the rise of the fa^H^H danger as inevitability. It happened after the WWI, it happened after the breakup of the Soviet Union, and the result is the same.
We have interesting times ahead of us. This time it will be backed by a fully functional surveillance apparatus capable of finding everything about a _suspicious_ citizens in seconds.
We've been warned and we failed to act.
What are the options? Protesting?
Two weeks ago we hosted in Coimbra the first portuguese event dedicated to NOSTR, only 15 people showed up but they travelled north/south of the country to be there.
More people or less people it does not matter, we will raise attention that exist options for using the networks without this constant tracking.
You can also do something too.
We shouldn't wait for a government to apply technological measures for our privacy, we should instead be an active part in making sure they exist and become popular.
I dived into it and didn't see what you suggested. Even Google added "reject all cookies" in EU recently.
> we should instead be an active part in making sure they exist and become popular.
Why not both? Sent from my Librem 5.
Was a silly measure that is Too litle, too slow and too late.
A proper measure could have been to request web browsers to define preferred user settings and to use that instead. Cookies are stored/retrieved from web browsers.
> Why not both?
Sure, go ahead. Maybe some day, something changes.
Do not use Smart Phones, maybe a Burner Phone would be ok
I am willing to bear it, but I can understand why many do not.
people don't care or much less than practicality.
Further enhances my feel that internet connectivity should be a utility, not a for profit service at all.
That's not what the article describes, though:
"Locate X which uses location data harvested from ordinary apps installed on phones"
T&C are dark, twisty forests of legalese that can shift, seemingly at any time. As a consumer, if you want to do something as simple as pay to park your car, you need to sign the T&C in blood or you get towed. Is it really an agreement if you must agree to it for basic necessities?
That said, it's the legal framework we have to deal with in the now.
As you may guess from my phrasing, I am well aware that in the present environment, believing that that meant much would be a childish level of naivety. But the principles can still be used to answer your questions in a reasonable way.
It really wouldn't be that hard to lay down some principles that privacy violations are an expense above and beyond, say, "parking my car". It is unreasonable for a person to think that the price of parking my car is $1.25 an hour and also arbitrary privacy violations and also you gave up your right to privacy from the government and also in six years if you sue a related entity they'll cite your parking agreement as the reason why you're not allowed to sue them (see recent Disney wrongful death case). $1.25/hour was already a fair price, give or take a couple of multiplicative factors. Taking a whole whackload of additional rights in the fine print under what can reasonably be called duress relative to the claims being made, beyond what a "reasonable person" would expect to be necessary to just complete the basic transaction, is not that hard to write some principles around. This is why judges are still human.
It's worth mentioning that in that case, Disney didn't operate the restaurant that allegedly caused the wrongful death, but got included in the suit because they had a website listing for that restaurant. In that case I think it's pretty reasonable that if Disney can be put on the hook for having a listing for a restaurant that caused the wrongful death, that they can be let off the hook for having a waiver in their website T&C.
If only they stopped there. After you've parked, you go in to some random activity and sign a liability waiver that, as written, says if the janitor's father's brother's nephew's cousin's former roommate murders any member of the same species as you at some point in the future, whoever relevant will have to simply ignore the inconvenience because you once went into an escape room.
Of course the extreme interpretation could never hold up in court, but it's absurd that I've even seen so many places that explicitly try to waive gross negligence in places where it's long been established to not be possible (or even places where it invalidates the entire clause!). These are sometimes justified as scaring people from lawsuits even if they don't provide and real protection, but why are we putting up with that?
* limit scope. It should not be possible to get people to sign away rights they have in order to e.g. stream a movie
* plain English.
* compulsory summary at the start
* more statutory rights that cannot be wived. E.g. it is not legal to have death a result of non compliance
It is not that hard.
(This is intended to be phrased on a way that includes e.g. cases where one party agrees to terms but another one is affects by it to their surprise, like your spouse when you buy a cell phone plan. So rephrase as needed.)
Clearly HN users cannot posses that authority without a fairly significant rank.
The article says the article says the location data was "harvested from ordinary apps installed on phones". What type of "basic necessities" are you getting from apps on your phone that have location access? I'm guessing it's from random weather apps, rather than something "basic necessities".
He based-ness and your bias-ness are on display.
- not knowing the weather this weekend
- knowing the weather and signing away their firstborn child in the T&C
- becoming an amateur lawyer and spending dozens of hours reading and comparing T&Cs between apps to choose which one to use (until they change the T&Cs again of course, which they'll do without notifying you)
Is this a purely academic thought experiment or something that's happening in practice? I'm not exactly sure what the "999 data points" consists of. Given basically nobody assembles their own phone, the most that hardware fingerprinting will reveal is "you have an iPhone 13", impossible to differentiate from all the other iPhone 13s floating around because they're all identical. Both android and ios have cracked down on software fingerprinting as well, so you can't for instance grab a list of all installed apps.
I don't know about iOS, but here's the situation on Android:
https://support.google.com/googleplay/android-developer/answ...
> The QUERY_ALL_PACKAGES permission only takes effect when your app targets Android API level 30 or later on devices running Android 11 or later.
So I guess end users should just check which SDK level their weather app was compiled for! Simple, right?
And if the parking app was compiled for SDK level 29, people should just go find another parking lot with a more recent app?
You're suggest technical solutions to social problems, and those rarely work out in the long term, especially with adversarial parties. Better to solve the problem at the source.
That, to me, was the big takeaway from Attack Surface by Cory Doctorow. The idea that you can't "out tech" the State[1]. Because even if you, as an individual, are in fact (smarter|more talented|more capable) than any individual employed by the State, they still have you out-resourced to a degree that makes your cleverness moot. And as a defender, you only have to make one mistake and it's game over.
If I get Cory's point right, it's to say something like "as technologists, we should use our skills in service of effecting meaningful change through the democratic process", as opposed to creating better tech for evading State surveillance[2].
[1]: I think here you could probably read "the State" as "the State AND/OR BigCorps".
[2]: That said, there's probably still at least some basis for doing both. But "effecting change through the democratic process" is probably the better long-term strategy.
The play store has minimum SDK level requirements, so you can't compile your app against an ancient SDK level to bypass all the restrictions. Moreover, your linked article suggests that even if you have an existing app that does this, the play store will eventually down your app if you don't provide an explanation. This is consistent with some complaints posted on HN recently, eg. https://news.ycombinator.com/item?id=41895718
1. Do you believe that with these latest round of updates, our benevolent corporate overloads Google and Apple (both advertising companies to some extent) have at long last fully solved privacy, plugging every possible information leak and fixing every possible software bug, both present and future?
2. If you do, then do you think it's desirable that we expect every participant in modern society to enter into one-sided, legally-binding contracts with companies they've never heard of with every small action they take on a daily basis, and then use complicated technical measures to avoid fulfilling their end of those contracts?
I ignored those parts because you're moving the goalposts way past my original comment[1], which only objected to the claim that people were somehow coerced into having their location sold because the apps doing the tracking were providing "basic necessities". Is the fact you're using an iPhone, are visiting from an IP address that suggests you're in Kansas and using Verizon an "information leak"? I guess, by some definition. Is that anywhere close to getting your location tracked? Hardly.
You seem to have an awful lot of confidence that "iPhone" and "Kansas" are the only pieces of data any app can get from a device.
So can we say that you agree with #1: after decades of playing cat and mouse with advertisers and spyware authors, these latest updates from Apple and Google are the magical updates that finally completely solved privacy once and for all, and there will never be any bugs or mistakes or security holes ever again?
This right here is the issue. There's a protocol to these things focused on pushing out, but no reciprocal pipeline for feedback other than "clicked" to come back in. Clickwrapping should have been wholely dismissed as a valid medium for contracting. I'm willing to park on and die on this hill. A contract regime wherein oneside is the progenitor of all changes, is not, in fact, a meeting of anything.
And yes, I'm drinking my kool-aid at this point. Sucks being on the minimalist side of the Software world, but I'm doing my damnedest to cut out every EULA possible, replacing it with something wherein I can be assured the world won't be turned over on me at a moment's notice at the behest of a bunch of greed optimized psychopaths sitting on top of an infrastructure most of them would be powerless to keep running short of the economic game of Mutually Assured Destruction the West calls it's capitalist "free market" system (which is anything but once you scratch beneath the surface).
I already mentioned one: parking apps granted a monopoly over a region by a municipality. Before you ask, no, there are often no meters to feed cash or a card to anymore (the apps don’t want those cutting into their fees). Your options are to accept the T&C in the app so you can go buy groceries or get parking tickets, and eventually a boot or tow.
For the last few years I leave my phone's GPS perma-off unless I'm actively navigating. Of course, I also have my location permissions for apps defaulted off and locked down (except for the two apps I grant conditional access to). I realize that cell tower tracking exists and is used by my mobile provider instead but at least it's a little less accurate. As a side benefit, my battery life is much better.
I've also adopted the healthy lifestyle choice of not using any social media apps on my mobile device (which is surprisingly wonderful once you make the leap). I mostly just use my phone to make and receive calls and texts (and as a remote for my home automation).
https://en.wikipedia.org/wiki/Russell's_teapot
>Unless you have a physical disconnect for the chip, I would presume it is still gathering data and that data is being shipped out. There are just fewer companies that can do it.
If your paranoia level is this high, what makes you think they won't put a backup GPS receiver in the SoC or modem? They're perfect places for it, because they have tons of traces connected to them that you could piggy back off one to use as a rudimentary antenna.
Thank you.
More like Russell's teapot would apply to anybody who would assert there is a benign and benevolent corporate actor out there. Prove it. You can't, and every major company in this domain has been caught out at least a few times, plus we know there are laws on the books that force them into secrecy.
This is honestly so basic it almost feels like gaslighting to call me paranoid. Either keep your phone in a metal box, or presume it is compromised. Just like the the most basic level of opsec for virtually all relevant government agencies.
>This is honestly so basic it almost feels like gaslighting to call me paranoid.
Explaining past the correct answer and then getting reduced to absurdium is only something a RLHF-prodding half-cognizant truth-addicted semi-sentient half-escaped super-intelligence would consider as wise.
>Either keep your phone in a metal box,
And remember, they can induce current via highly directional beam-forming, so thinking "no power" = "no computation/exfil" is cute, but naive.
Once the tech eventually gets there this will be sold as a feature and will replace our current wireless-charging tech. There will be no more “charging” at all — every device will simply be always on. Then it will be that much harder to escape The System's eye since a dead battery will no longer be any excuse for a device to disappear.
Fuuuuuuuuuuuuuuuuuuuuuuck me its hard to know you're not crazy when fukin APT/sufficiently advanced autocorrect can convince someone to hit you with a microwave (beam).
There's a pretty big difference between "some apps collect your location data and sell it, there's some clause buried in the ToS authorizing them to do it", and "your phone has hardware/software backdoors to collection location data even if the option is explicitly turned off". The former can plausibly be defended in court, whereas the latter is obvious fraud. Before you claim "but big corporations are above the law!", google recently paid millions to settle a lawsuit for tracking users in incognito mode, which sounds evil but was pretty banal in actuality. They didn't add some sort of backdoor to exempt their domains from incognito mode. Rather, they treated incognito sessions as regular sessions, such that if used incognito mode but visited a site that used google analytics, your visit would still be recorded.
>This is honestly so basic it almost feels like gaslighting to call me paranoid. Either keep your phone in a metal box, or presume it is compromised. Just like the the most basic level of opsec for virtually all relevant government agencies.
The police also has the ability to bug your house, but I think it's pretty paranoid for the average joe to think their house is bugged. "opsec" also involves doing a threat assessment and understanding what the most likely risks are, not assuming the FSB is out to get you and hiding in a bunker.
You don't need to go full prepper mode to recognize the situation. I just want to promote honest awareness, not a specific course of action as a consequence of that awareness. My threat assessment is that this happens nonstop. It has been revealed to be the case in the past, in the present as per this article, and undoubtedly will only continue in the future.
Again, there's a pretty big difference between an opt out, and a system that outright betrays the user. Moreover, what you said might work for someone who has location services enabled in the OS and don't realize there's preinstalled facebook with pre-approved permissions, but OP specifically mentioned disabling location services in the OS, which should disable it for all apps regardless of whether it's pre-approved.
This does nothing. The location spying is baked into the cellular tech itself. 5G base stations literally steer the beam to follow you, so it “““has””” to spy on your location in order to work.
https://www.ericsson.com/en/blog/2020/12/5g-positioning--wha...
“The arrival of 5G delivers new enhanced parameters for positioning accuracy down to the meter, decimeter and centimeter.”
“Positioning of users and devices across general indoor environments, such as offices, shops, logistics, etc., was a focus area of 3GPP Release 16.”
https://www.fastcompany.com/90314058/5g-means-youll-have-to-...
“[5G network positioning] data can also enable advertisers and data brokers to see the exact routes you take each day and even which buildings you go into. And anyone with access to your mobile network’s cell tower data will now be able to track your movements in real time.”
That is not (currently) in "Overton Window" of "acceptable" in regards to the nations phyche, in totality; 5G is more of a "passive system" than what can be collectively admitted irt natsec atm.
(G as 2D spiral view of 3D coil, 3 sides of a cube being the most you can see at one time, coil of Humanity goes inside the cube, tilted axis of the second P compared to the first, arcs of Ascension traced in the signal lines)
A lot of people do understand this but can't really do much against this. I personally use a GNU/Linux phone with hardware kill switches. And it's not always easy.
> I leave my phone's GPS perma-off unless I'm actively navigating
You can't trust this: https://news.ycombinator.com/item?id=15413709
I don’t understand why the law should specifically limit the government like that. I think it should be illegal for anyone to do this.
Most of these companies wouldn't get very far if they had to build their own products from soup to nuts.
Given that parsing non-denial-denials is journalism 101, I wonder at 404’s studious incuriosity about the Secret Service statement. Here are some questions I would ask the Secret Service on the record if this was my story.
1. Does the Secret Service use other tools, partners or methods to collect location data on Americans without establishing probable cause and obtaining a warrant?
2. Does the secret service collect the location data of all Americans, or does it target certain groups in particular? If the latter, how does the service decide who to target?
3. What other crimes become non-crimes if the private company hired to commit them gets the victim to check a box labeled “I agree to the terms of service” prior to watching a funny cat video?
4. Hypothetically speaking, is it now legal for me to start the “uber for loansharking” if my terms of service indicate that the penalty for late payment is kneecapping by non-employee gig muscle?
5. Can the secret service identify my source for this story by determining who i’ve been meeting for lunch at the Holiday Inn every Friday for the past two months? If so will your wife be in a lot of trouble?
Why stop there? If ToS overrides the 4th Amendment, why not the 13th?
Or they're lying. Cops do that a lot too. But I personally think it's more likely that they have a replacement.
Maybe Locate X2 or Locate X_2
Then they do not
Liars
But my point is the secret service should have the same access.
And I don't know why anyone would assume that the United States secret service is the only intelligence agency using that data