Europeans' health data sold to US firm run by ex-Israeli spies
ftm.eu
ftm.eu
This is about Unit 8200? The 'cybersecurity' unit that Israelis can join instead of doing their mandatory military service on the gun? I think this acquisition could indeed be problematic, but this seems like a weird framing. The article could give more context than that.
Sure but the real answer is try what you can to get the fuck out of there so you don’t have to do harm to someone you don’t even know.
Source: https://energyandcleanair.org/june-2025-monthly-analysis-of-...
It's not (only) a matter of cost, but availability. People need fuel to heat their houses. In order to fully replace Russian gas, other facilities (like LNG container terminals) need to be built. That has been done and is being done, but is complex and not instant.
Should it have been done before February 2022? Yeah, probably.
When the war hopefully will be over, sanction lifted and there will be no problem with trading with Russia anyway.
and in the other 20%, many of them don’t get conscripted due to a religious exemption that includes being in a totally different ideology that has always disagreed with the other
odds not looking good, speaking as a betting man, not one with any actual opinion just need my prediction market bet to hit
What Israel is doing is wrong, but I don’t think it would be unique among developed states experiencing something similar.
Especially in a first world country like Israel where people aren’t shackled by their poverty.
These were not conscripted in any way whatsoever. These 10s of thousands deserve full blame, and fuck them all.
Humans build identities around their homes. It’s why any plan that involves relocation implicitly or explicitly requires violence.
It’s absurd to suggest Israelis should effectively “self deport” from their homes. It’s unrealistic to the point that it’s effectively dismissing the problem instead of honestly engaging it.
Sure. Not great. But also not relevant to charging individuals.
If we’re to learn from Sykes and Picot, a good place to start would be in acknowledging the primacy of the living over the dead, and those on the ground over ideals from abroad. One conclusion from that is we shouldn’t be condemning men we’ve never met for actions they are only affiliated with.
Leaving aside your warped sence of pity, which one's a society you'd rather live in?
The details around that are a significant source of friction.
I was specifically thinking of that line about sitting in an office writing books, analyzing, strategizing, justifying and criticizing, all of which are crucial guides to action -- hardly something you could describe as "just a tech job", for example.
Idea was end to end encryption. So technically, the new org should not have access to customer data. Company hit gold in the netherlands during covid whe reports had to sent out to users digitally and was always encrypted in EU due to regulations.
It could be different behind the scene. It does not look good for the netherlands where digital sovereignty is the key topic these days.
There are European alternatives but they need support.
IMHO it requires conscious choices by European citizens to choose more carefully which online services they dedicate their time and money to. Or expect unintended consequences.
How does that make the EU regulation something bad? The bad thing is that the companies are willing to bombard us with the worst possible cookie banners, in order to monetize our visits.
Maybe the next EU regulation should be to prohibit those banners and allow companies to add a small toggle somewhere on their site so we can toggle it to allow them to set 3rd-party cookies.
The EU's own government websites [1] are littered with the same cookie banners. They want the visitor data just as bad as everyone else.
> Maybe the next EU regulation
We don't need anymore EU regulations seeing how bad and thoughtless they already are.
Try and speak for yourself. No need to speak on everyone's behalf, this is disingenuous.
Sure, I don't understand why they don't remove it if they know that an average-iq'd person would accept only essential cookies, but that cookie banner belongs to the top 5% of friendly cookie banners.
I was talking about those you find on the typical website, usually news sites, who make them as annoying as possible.
They're not the problem, they never have been. It's the fact that so many parts of the modern internet rely on selling user data to make a profit, not the regulation that they now have to do the outrageous thing and (gasp) ask for consent first.
If the law would force them to say "Do you want Larry Ellison to get richer by looking through your webcam? [Yes] [No]" it would be a good law.
Oh, aren't many of big tech's EU HQs in Ireland?
In the EU, they've had the GDPR – a big, muscular privacy law – for nine years, and all it's really done is drown the continent in cookie-consent pop-ups. But that's not because the GDPR is flawed, it's because Ireland is a tax-haven that has lured in the world's worst corporate privacy-violators, and to keep them from moving to another tax haven (like Malta or Cyprus or Luxembourg), it has to turn itself into a crime-haven. So for the entire life of the GDPR, all the important privacy cases in Europe have gone to Ireland, and died there:
https://pluralistic.net/2025/12/01/erin-go-blagged/#big-tech...
Now, again, this isn't a complicated technical question that is hard to resolve through regulation. It's just boring old corruption. I'm not saying that corruption is easy to solve, but I am saying that it's not complicated. Irish politicians made the country's economy dependent on the Irish state facilitating criminal activity by American firms. The EU doesn't want to provoke a constitutional crisis by forcing Ireland (and the EU's other crime-havens) to halt this behavior.
> IMHO it requires conscious choices by European citizens to choose more carefully which online services they dedicate their time and money to. Or expect unintended consequences.
You mean, European citizens "need to" expect to, and pay for, basic internet services like search, mail, ... and, let's be honest, pay for worse services than are available free.
Imho proton is about the best available, it's just mail and office, and it's 5 euros per month for just mail and basic office, essentially Google's free tier.
Obviously, this will never happen. So either the government makes such services, and makes them well enough to seriously compete or implements a "great firewall of Europe" Chinese/Russian style and forces the change.
Instead, governments are introducing dependency after dependency on FANG companies. Is there any place left in the EU where you can even do your taxes without identifying through Google/Android or Apple/IOS on Chinese made hardware? Any at all? How about all of Europe? There was a row in the Netherlands about efforts to force homeless people to pay for cell phones ... and the government is refusing to back down. It's just incredible.
Even if the EU kicked out the FANGs with a "great firewall of EU", to force people to pay, it would decimate the gig economy and show that EU unemployment, especially among young people, is really double or perhaps even more the figure it appears to be. Plus I don't think it would work. Too many people would choose to simply stop interacting with the government under such a situation. And while the government can deal with 1 or 1000 people not doing their taxes, they cannot hope to deal with 10% not doing their taxes.
The only solution is that all European governments force themselves to ONLY work through "sovereign" channels not dependent on American companies. Right now they are all doing the opposite, and in fact not just encouraging EU citizens to give their information to FANGs, but actively forcing them to do so.
And you're right. This can only end in disaster. But it's slightly cheaper now. And the disaster is tomorrow.
Didn't Charlie Munger say "you young people ... tomorrow's politicians will make you wish Trump had eternal life"? If it's not Trump, sooner or later someone will blow up relations with the EU, and even within the EU, on either side.
best of luck
>proton
Yes, probably 'good enough' at the scale they have as an alternative.
>Obviously, this will never happen.
Hard sell for sure vs the status quo.
>Obviously, this will never happen. So either the government makes such services, and makes them well enough to seriously compete or implements a "great firewall of Europe" Chinese/Russian style and forces the change.
Consumer change of habits but obviously having alternatives count.
>Is there any place left in the EU
Is definitely a problem wrt dependency. Also outages from Cloudflare etc suggest further dependency and its all about convenience.
>The only solution is that all European governments force themselves to ONLY work through "sovereign" channels not dependent on American companies.
They don't. The US companies have gradually pushed the envelope and unfortunately EU reaction has resulted in time wasting cookie modals etc for front end users. There is surely a measure of lost EU business opportunity vs what is actually happening, a wholesale copyright and privacy override. Google was bad enough before AI but now it's just wholesale stealing of everyone's everything.
Europeans have already made open source versions of quite a few things as side projects without any funding. The issue is a lack of transparency (by American standards) that hides just how hideously incompetent and outrageous (even by American standards) member state governments are. (PACER is a big reason how Americans know what Europeans are ignorant about.) I do believe an EU member state could otherwise create any service that American companies already proved are desirable, make it free for nationals and residents and require payment for others, and use EUDI as the login and verification, probably for quite cheap.
Ain't nobody dedicating their money to anything.
That's exactly why these enormous tech giants are privacy nightmares. How many people complaining about Google have used their services extensively for decades now, and never have once given a cent to Google? Probably over 90%.
People were offended when Google launched YouTube Premium because it encroached on their right to "free" everything from Google. Even today people still chain themselves to the hill of "I will never give youtube a penny", despite them probably using a couple percentage points of their entire waking life on google products.
Europe is in a tough, if not impossible spot, of having (relatively) heavy privacy protections, while also having a population that is largely offended by the idea of having to pay for something that "has always been free!".
Maybe they can launch a taxpayer funded EuroTube and EuroGram.
its okay to depends on some product because they are just good, for example people free to use Office alternative which is free btw but people literally dont choose that because MS Office is just better
all of this deep talk discussion is irrelevant since User want an working product that they expect them to
its just that
With the latter, there's a direct contractual relationship since you're paying Google for services
If google offers something similar, I am pretty sure Europeans will find something else to complain about.
[1] https://about.fb.com/news/2024/11/facebook-and-instagram-to-...
[2] https://www.engadget.com/social-media/meta-will-let-facebook...
The root of the issue is probably the "freely given consent" that the law defines. If Meta charges users unless they consent to something, then the consent isn't freely given.
They wriggle and wriggle, instead of running an honest business, where people buying access to their platforms would actually reflect the usefulness and real value of people being willing to pay for a service. That would be a very transparent number, and that cannot be made look more than it is to shareholders though. I think if they did this, then their whole value would collapse massively back down to sane levels. Now they have blown this whole ads and attention machinery waaay out of proportion and will do anything to keep it pumped up. Heck, they want to pump it up even more, because we all know iiiinfinite growth! They would not be satisfied, if their business spanned the whole solar system.
Of course
"What kind of dumbass would pay to not see ads when uBlock Origin is free? lololol"
It didn't ever get traction or last very long before being canned. This is the mentality that money-compensation-business-plan tech companies would have to face; "What kind of dumbass would pay for your product?"
See, ads are not a pro-social service. Their fundamental goal is not to inform and facilitate mutually beneficial exchange of goods/services. Their goal is to allow companies who spend ad-money to gain an advantage over competitors who don't, regardless of quality of the product.
Ads are a fundamentally anti-competitive practice.
I mean its not like paid service that dont have ads and giving privacy is non existent either, we have proton mail for example
Companies should be required to be transparent about how much revenue each of these sources generates.
its free as you paid zero dollar
"People either pay with their data, their attention or their money."
for some people money is more important than their data, and its vice versa with wealthy customer
I agree that in the future maybe we can control how much data/money we can paid for the service but that just not possible in current time
What about other currencies? Do you only count state-issues currencies? Have you heard about barter?
> but that just not possible in current time
Why not?
well you convert them to usd
"Have you heard about barter?"
well you are free to choose paid service that else where, I dont understand this coming from. no one force you to choose free product
In fact, you're exchanging them at a rate you are not informed about which means you are disadvantaged in this exchange.
It would be free if for example there were 2 tiers, free and paid and the free tier would be entirely supported by the paying customers. But it's not.
This is another way companies can legally lie to customers. I honestly don't understand why you keep defending them.
there is no lie if you paid zero dollar on it
"which means you are disadvantaged in this exchange."
what do you mean disadvantage??? stop playing victim, you dont paid anything and you get the service for free
stop acting like globalist corporate literally evil or wrong, it literally mutualism relationship
"You paid with your data" ??? then what??? You acting like everyone is important???? if you are that important then just pay up for private service
2) Generally, people use the > character for quotes. You use " and that's fine but your third quote is not an actual quote from my message. This case is harmless but it's generally rude to put words in other people's mouths and mislead anybody else reading this into thinking I said a particular thing I did not.
3) Since "You paid with your data" is actually your phrasing, you admit that data is a form of currency. And since as you said, I paid, it cannot by definition be free.
4) Your insistence that state-issues currencies (or only the dollar) are the only valid currencies is wrong. People commonly perform other forms of exchange of both goods and services, surely you wouldn't claim e.g. somebody is performing work for free when he asks you for a counter-service or non-monetary compensation. I suggest reading https://en.wikipedia.org/wiki/Consideration , it is closely related.
5) Disadvantage means one side of the negotiation has more information it can leverage to make a more beneficial deal to it at the expense of the other party. Since I don't know how much money my attention and data makes the company, I can't negotiate a fair price for me to pay in monetary terms instead of attention and data.
6) I am clearly important enough that my data, time and attention have monetary value.
7) What if I belong to a minority which would be targeted under a different regime? My data can be used to profile me. If the data can be sold or published today, there's nothing stopping a future government or even non-governmental organizations from using it. The right to privacy and the right to control my data is just as important as free speech for maintaining a free society.
freedom isnt free
I use substack and patreon and I wish we had micro transactions that’ll enable more of this model for content.
Now much of the same info is recycled via AI, instead of reading blogs / stack overflow etc I just ask AI and so far I can use AI without ads. I do pay for a subscription to Gemini.
Nope. At least I was offended, because YT Premium wanted $15 from me for hosting other people's videos. That's more than streaming services that pay for production of TV shows and movies.
Don't think they really need THAT much to cover hosting costs. Not when they operate on that scale and in addition can hover up and profit on all the usage data.
If YT Premium costed $3 or $5, I'd pay and I'd bully any friends and family that watch YT and don't pay into supporting the service. As it is now, my appraisal skill says "SCAM" and I pirate YT with clean conscience.
Also blocking-ads/pirating on youtube provides the creators with nothing. I'm not sure how people justify this besides the established internal conditioning that anything on the internet must be free. Also conversion rates for "watches all their content" to "pays for their patreon" are <1%. meanwhile ad-blocking/pirating rates are around 40-60% depending on your audience.
At some point the internet has got to have a reckoning with reality if they want things to improve.
If all users' are ranked the same then loyal adblocking users can still help a lot
Producing de novo some valuable information--a YouTube video, blog post, software program, news article, song, etc.--has a real cost that must be paid for each new information good created.
But making copies of information in our digital world with gigabit networks and terabyte disks is now very nearly free, so the marginal cost of production of copies of any piece of information is very nearly zero.
This is why centralization and scale are such powerful strategies for IP-based industries: They offer enormous leverage. And it's also why they are so dependent on government intervention to ensure unfree markets.
These creators can only make a profit if they are able to monopolize their information goods. If a new "factory" opens up down on BitTorrent Boulevard literally giving your product away for free, how can you compete with that? Moreover, what incentive do you have to produce new goods in the first place, if anyone can just offer infinite copies of your product to the market for free?
Thus, these creators rely on government intervention to make it illegal to offer copies of their information goods. But there's a fundamental tension between the twin economic realities that the marginal cost of production is ~zero yet the marginal price of consumption is nonzero. Thus, piracy.
In my opinion the copyright system is broken in the digital age. Instead of granting monopolies on information goods produced, we ought to figure out an alternative economic structure that incentivizes the production of these information goods in proportion to their consumption while accepting that their marginal cost of production is zero and abandoning any attempt to control the copying, transmission, creation of derivative works, etc.
Android phone contracts seem strangely cheap.
I'm pissing in the wind, but I'd prefer it if the use of personal data - sold for adverts - was banned outright. Particularly for large companies.
This would forced Google et al to charge for their services, creating the market that would stimulate competitors (Open Source or otherwise).
People will argue against this, but online advertising that got us to where we are is the absolute scourge of modern society ... it's poisoned every decent well of humanity.
Even for things like Youtube Premium, I'm certain Google are double dipping ... likely quadruple dipping.
I believe an EU member state could create any service that American companies already proved are desirable, make it free for nationals and residents and require payment for others, and use EUDI as the login and verification. Probably for quite cheap. They're just too incompetent.
The current modus operandi for tech companies is to offer something for free or below market price, gain a userbase, lock them in and destroy competitors who don't have cash to burn, then alter the deal.
If I start using a company's offerings, I have certain expectations, such as the terms and conditions suddenly not changing from under me. Now, you can argue that they are required by law to inform me of any changes to the literal Terms and Conditions. Well, yes, except:
1) They are often worded so carefully from the beginning that they can start doing something exploitative at a later date, only after gaining goodwill and users by not doing it.
2) I can't very well stop using a service if doing so incurs a loss to me. Phone operators are required by law in some countries to allow customers to transfer their phone number to a competitor. I am not aware of a similar law for email addresses. And email is at least 1:1, what any other operator offers it technologically compatible due to open protocols, so a transfer is possible. There are services with no 1:1 alternative.
( Hopefully Open Social will change that but we're not there yet: https://overreacted.io/open-social/ )
---
There's also informed consent. Most countries don't allow people below a certain age to have sex because they might not understand all the implications and consequences. How many people do truly understand how tracking and profiling works, the risks of data breaches, doxxing, stalking, surveillance, etc? I argue informed consent cannot be formed unless people are aware of _exactly_ where each bit of data about them is stored and accessed; and also are made aware of the probabilities of all the possible adverse events over their lifetime.
Anyway, in short, everything you said applies to literally any human or even animal: if you give them something for free and then take it away unless they pay for it, they won't accept it (google maps). On the other hand, if you provide something for a price, and it's needed, people will pay even if there is an alternative (e.g. Netflix).
The difference is that many/most people are ok with ads as a form of payment for the free services, while others (including Europeans) are not ok with the additional hidden clauses regarding how their personal data is used. Is that wrong? I don't think so.
To make it more realistic, imagine getting a TV for free because it will insert ads every X minutes. The tradeoffs are pretty clear: Good TV for my time/attention.
But if someone then started also recording from said TV the inside of my room, my and my family's faces to be sold to unknown parties for unknown uses (and sometimes even to antagonists) then I don't think anyone would believe it is a fair implementation of the original and presented "agreement" (even if it is stated in their 1000 pages ToS).
Now, if Europeans start being vocal politically that such an invasion of privacy is not acceptable, does that make their claims invalid because there is no valid alternative to such services?
I'm pretty sure today's tech giants would be profitable even without the privacy invasion and the selling of the data; furthermore if their premium versions did not actually show you ads (some show you ads even if you pay), I'm sure people will slowly start gravitating there as they stop being ok trading their attention/time for money.
But if Facebook explicitly told you "pay us X/mo or we will sell your personal data to Russia", would people actually pay them or, perhaps, would they start considering other saner alternatives? I guess we'll never know.
Of course, this would likely receive a lot of blow-back in the form of "Looks like now you have to be rich to not get your life sold to third parties" and "Google used to be equal for all and now they are just going to prey on the most vulnerable in society"
The only way to win in this situation is for people to understand that things cost money. They probably cost more than you expect, and you probably will want your ads and tracking back once you see the true cost. After all, at the end of the day, the downside to these decades of tracking to most people has been "Damn, how does google know I buy Tide detergent!".
There are things which shouldn't be for sale, and I believe personal information is one of those.
Even though we don't have another universe to compare ours to, I believe companies started selling personal data not because people didn't want to pay for their services (since they do that even if you DO pay for them) but mainly because it is profitable. End of the story.
I am always surprised why people here attach so much humanity and conventional logic to huge international for-profit VC-backed companies: they will do literally anything if at the end of the day they come out in the green (aka profitable). Even illegal things, if the expected payout is lower than profits created.
I also believe that if literally killing people made some company $X and their analysts predict having to pay $Y to governments (with $Y substantially lower than $X) once in a while, someone would eventually decide to do that. And such a company wouldn't have trouble finding shareholders and employees.
The consistent political pushback against mandatory paid options that are ad-free is that it excludes people that can't afford them. It is unfair because it only advantages people with money. Therefore "free" is the only valid policy choice because there is always someone who can't pay. This limits what is possible as a practical matter.
The obvious alternative to an ad-funded model within these constraints is for the government to pay the companies for the service on condition that they remove ads from their country. Needless to say, the idea of paying "taxes" to Google et al to remove the ads is offensive to many of the same people.
So we are stuck with the status quo of "free" ad-funded services because people aren't willing to accept the necessary tradeoffs to change the situation.
And I mean guaranteed in a way that I would have legal recourse against the company if they go back on their word or screw up
What would be a solution, but one that the companies don't want, is to offer a service either as a paid service or truly at no cost which includes no privacy cost. But they are afraid of doing that, because they fear that then they can't hitch the ride on data taken from users, who are not informed and who only clicked some accept button, because the business kept nagging them about it, instead of accepting a "no".
I have to admit though, that Google did better than most other big techs, as they do provide a consent dialog, where rejecting is as easy as accepting. See for example YouTube. And not sure about Google search, since I don't use it these days. However, I did not research (and that's how one would have to call it), whether rejecting is truly adhered to, or they sneak in not actually needed things as "functional cookies" or something.
However, lets not have any illusions here. If the EU didn't demand things to improve and didn't impose fines, big tech would have done exactly nothing of the sort.
Ok, but only if one of them is called “EuroVision”.
Either regulation, or it needs to get so shitty and painful that people get a reflexive avoidance thing going on.
There hasn't really been a "reap what you sow" moment for people who threw privacy caution to the wind for free stuff.
The reason for all the data/lack of privacy stuff is because most people get something from it - the next shiny manipulative BS thing, or shiny gadget or whatever.
Markets outcomes are not a prophecy.
If it was so simple - why put the unsubscrube or privacy rules behind UI/UX features that required A/B testing and behavioral analysis to make it as onerous as possible?
People aren't happy that they to sell their privacy, and had to be reassured that this is the best option.
Not to mention, this was during an era of camraderie between the US and Europe, not a potential opponent. The idea of a taxpayer funded EuroTube and EuroGram or CountryThing will pick up steam. Why have your information farmed by a nation which acts in a hostile manner to its erstwhile allies?
Apple devices aren’t secure either.
You're also conflating security with privacy, a security hole is unintentional it's not like they were selling their customer's information. No system is perfectly secure. Apple has done more to address those issues than any other tech company. They’re targeted because they’re popular, maybe your antagonism should be directed towards the country that openly sells such software to murderous authoritarian regimes or the government that condones it from their alleged “greatest ally”
US Senator Ron Wyden whistleblew how iOS Push Notifications are collected by US intelligence, which is concerning when you consider how much iMessage relies on it:
https://www.macrumors.com/2023/12/06/apple-governments-surve...
https://daringfireball.net/2025/12/imessage_push_notificatio...
Privacy and security are two different things.
"It’s interesting to observe who it’s fashionable to hate and the double standards this community applies to tech companies" Indeed....
Great subthread to remind that your HN data (comments and maybe more) is shared and licensed with all Y Combinator startups. It's also impossible to delete your own data, either on HN or data shared with the Y Combinator startups (except by some 'beware of the leopard' email procedure).
This is not being made clear when registering a new account.
If you were actively commenting, you are basically asking to break the flow of discussion among many participants. And yes, this is unfair to others.
My rule of thumb was to honor the deletion requests for those who were little involved in the community.
For others I would disable their account, anonymize their login name and remove sensitive details in discussions.
This is how it worked until toxic behaviour, facebook and telegram made my little social network redundant.
This violates EU's GDPR article 17 I believe, at the very least, thank you for raising the point.
TBH, if a service doesn't explicitly say what data I expose to it _won't_ be shared, I assume it will be immediately and repeatedly.
Though also if a service does explicitly say the data won't be shared, I still assume that it will eventually be given to the highest bidder, then the next highest, and the next, and so on. If not deliberately, it will at some point be hacked from without or unofficially exfiltrated from within.
And on a public site like HN all bets are off as the information is probably being scraped by everyone, their dogs, and their dogs' fleas, even more so now LLMs are such a big thing.
HN comments are public and are available through several archives and datasets.
Deleting old comments wouldn’t stop anyone from having access to them, but it would make old HN threads frustrating to read. Old Reddit threads are becoming painful to read on the Reddit website due to all of the people posting and then overwriting their old comments with scripts.
There is a growing misconception that the GDPR and similar laws give complete control over any user-contributed inputs to a website, but that’s not true.
I accept that if someone data-mined every comment by said user, they might be able to build a picture of said user clear enough to identify them (e.g. posting times might indicate likey country of origin). Possibly, depending on the content they posted.
(I'm just thinking around the problem. I'm not a security/privacy researcher designing systems I'd like others to use, just an interested user curious where the lines in the law lie, and also what the threat models might be to me as a user.)
It has been widely misinterpreted as a tool to force website operators to remove anything you've contributed to the website or any information about you, but that is neither consistent with the language of the law nor consistent with what the courts have found.
You are free to remove your own e-mail address from an account (visit your account page) or to never provide any identifying information at all to the website. I've also seen the moderators change account names away from identifying information for those who request it.
However, there is no GDPR requirement that websites must universally delete any and all contributions you provide to a public website if you retroactively decide you don't want you public posts to be public.
Like I said, I doubt casual HN commenters have a better grasp on the law than Y Combinator's legal team.
Even following the "if there's smoke there's fire" model, unclear there's a strong scent of "smoke" here. One could write a similar guilt-by-historical-association article concerning anyone, in the same position, really. Obviously if you're uploading a file to a 3d party website, the vendor has some technical access, this should be warned.
I've been forced to use this service, by way of healthcare professionals just disclosing correspondence to this service without asking for my consent.
Smeerlappen.
Luckily HN automatically detects when you post your password and obfuscates it with * - try it out yourself!
This is not the case in the land of DICE-like key derivation; see TKey protocol for example. You can download and run an actual rv32 program on actual FPGA over WebUSB without having to worry about its provenance. If the program is modified, firmware will derive a completely different key.
Also Germany uses and is already Rolling out a Matrix-based Messenger and S/MIME-Mail with End-to-End-Encryption for Communication between Healthcare Professionals.
So at least for Germany this is not a problem.
More problematic was our prior health Minister who wanted to make data accessibile to OpenAI et al for "research". That's also why I opted out of the electronic health record
https://www.heise.de/news/Lauterbach-zu-Gesundheitsdaten-Goo...
How would you even be sure of this just from what you can see from the outside? That doesn't mean your health insurance company isn't using Zivver internally same how they use Office 365 or SAP. It's not like they tell you all the SW they use.
Internally, you have the Hospital Information System where you can look up all the informations you need.
I can just say I know the inside of one of Germany's biggest Hospitals, since I'm a Doctor. And requesting Patient Data or giving it out to other Parties is unfortunately a Task that Doctors still have to do on their own
And for communication with the outside world it's down to Fax, Phone or Letter.
And that will be replaced with KIM in the future
That's interesting because in The Netherlands most of my doctor's communications come through email (and zivver), followed by snail mail.
They just started installing Card Readers for the Doctor Identity Cards, so they can issue electronic prescriptions
For communication with Patients some Hospitals have Web Portals/Apps for getting/sending information.
As far as I know, I don't think the hospital portal has ever been used for communication like that. An email seems more "obvious" perhaps to the docs, and that's what they use most of the time.
See https://www.bundesgesundheitsministerium.de/themen/digitalis...
> We should instead elect officials that can deal with the “Neuland” of the digital age and have some technical chops and don’t immediately cave in when there is some money to be made
Yes, but I don't think this will happen during our lifetimes. Especially since the Gematik has shown again and again that they can't be trusted with it
I oppose civilians being targeted by terrorism, and that also obviously includes Israelians. For example, I was very much shocked by Oct 7.
I also do have a problem with Israel's alleged genocide by the current government.
I don't believe any of the above makes me antisemite. It is very typical of agents of a certain agency to frame like that though.
An astonishing pair of sentences.
[1] https://en.wikipedia.org/wiki/Weaponization_of_antisemitism
Israelis
That is terrible news.
Offense and defence are different games.
Should there be scrutiny when sensitive data is being sold off? Of course but this article is extremely low quality, with zero evidence and just based on vibes with a nice dose of antisemitism (and no I don't use that term lightly)
As if cyber security experts running a cyber security company is somehow shocking.
[1]https://en.wikipedia.org/wiki/Kiteworks [2]https://www.kiteworks.com/company/management/
Like how about a call to Benny's office saying "hey buddy, reign your dogs in, our citizens are off limits"?
https://en.wikipedia.org/wiki/Download_Valley
> Download Valley is a cluster of software companies in Israel, producing and delivering adware to be installed alongside downloads of other software.[1] The primary purpose is to monetize shareware and downloads. These software items are commonly browser toolbars, adware, browser hijackers, spyware, and malware. Another group of products are download managers, possibly designed to induce or trick the user to install adware, when downloading a piece of desired software or mobile app from a certain source.
> Although the term references Silicon Valley, it does not refer to a specific valley or any geographical area. Many of the companies are located in Tel Aviv and the surrounding region. It has been used by Israeli media[2] as well as in other reports related to IT business.[3]
Getting an Israeli extradited is almost impossible, their in-group ethnic bias is so strong that they even fight the extradition of rapists. The Israeli government would rather see a jewish rapist escape justice in Israel than face justice in a gentile nation. Extraditing some businessmen who merely scam and destroy people's computers? Fat chance in hell.
https://en.wikipedia.org/wiki/Malka_Leifer_affair
https://www.cbsnews.com/news/how-jewish-american-pedophiles-...
What they don’t - or don’t care enough to - realize is that given the enormity of the crimes they committed (heck, still are committing!), nothing short of accountability and justice will help cleanse their reputation.
I suspect it'd have a different spin put on it.
US has a law that they will invade International court of justice if ever any US personnel is tried there (ie for war crimes, that one would be easy to pull on thousands of US citizens). That's the US mindset against other jurisdictions.
Israel would be an exception of course.
https://www.timesofisrael.com/senior-israeli-cyber-official-...
https://www.jpost.com/israel-news/article-865532
https://www.aljazeera.com/news/2025/8/19/how-was-an-alleged-...
The US has always had a number of grey market scammy businesses like those too. Lots of countries do.
this alleged sex offender just appears remotely for his court appearances lol. I wonder if he will attend prison remotely too? Maybe an RC robot will serve his sentence and he can look out the bars through a camera and VPN from Israel.
It stands to reason that ex-cryptographers from Unit 8200 would use the expertise they gained to launch legitimate companies that provide cybersecurity solutions.
Which is something you can believe but it falls into the extraordinary claims, extraordinary evidence category. But by claiming it about Oracle or Israeli cyber firms or whatever you swap the evidence burden to the person who has the not extraordinary claim, that most businesses are doing what it claims on the tin.
“The Age of Surveillance Capitalism”
and
“Stand Out of Our Light”
might not change your mind, but you’re likely to end up realizing customer data hovering is more of a driver of modern business decisions than you realize. To say nothing of the assets such activities provide the intelligence communities.
This is happening. Please don’t dismiss it as conspiracy theory.
Say the words “I believe all companies exist as an extension of the US intelligence apparatus” and claim the burden for yourself.
Oracle gets its name from a codename of a 1977 project for the Central Intelligence Agency, Oracle's first customer.
In 2004, then-United States Attorney General John Ashcroft sued Oracle Corporation to prevent it from acquiring a multibillion-dollar intelligence contract. After Ashcroft's resignation from government, he founded a lobbying firm, The Ashcroft Group, which Oracle hired in 2005. With the group's help, Oracle went on to acquire the contract.
Following the beginning of the Gaza war in 2023, Oracle’s top executives, including Safra Catz and Larry Ellison, publicly aligned the company with Israel’s military operations. They issued statements of solidarity, paid double salaries to Israeli employees, and donated to organizations connected to Israel’s wartime response.
Switching to that is commenting in good faith. It educates and argues the point and makes it clear that you aren’t in fact claiming that all companies are surveillance state apparatus. Note that other commenters ran with the “but they are actually argument” because the door was opened.
Please feel free to translate and read the Dutch version of this article. On the bottom, several security researchers found vulnerabilities in Zivver [1]
[1] https://www.ftm.nl/artikelen/vertrouwelijke-zaken-te-grabbel...
How is this different from suggesting Netflix was all a secret plot by Stanford to spy on Europeans' TV binging?
This should be a concern if the company is owned by Dutch people, but more so if it is owned by a company with questionable jurisdiction. Which unfortunately the USA and Israel are these days.
[1] https://www.ftm.nl/artikelen/vertrouwelijke-zaken-te-grabbel...
If all it takes to convince us that a communication product was created as a front for spying operations is not having a strict e2e design like Signal's, then do you think virtually all of them are fronts for spying operations?
> Did they ever claim otherwise? They say "Zivver scans the content of every email" prominently on the front page. The flow seems to be TLS to Zivver first, scanning, then encryption.
I worked at a government organization which used Zivver. This was around 2018. It was assumed to be E2E encrypted. I wrote about the issue in my security audit, but it had low priority for a myriad of reasons (they had worse issues at the time). Zivver is more akin to the Lavabit situation.
Proton's OpenPGP.js is slightly more secure than this implementation (it encrypts client-side), but because Proton can decide (and be forced) to serve a different OpenPGP.js, it suffers from a similar issue.
> If all it takes to convince us that a communication product was created as a front for spying operations is not having a strict e2e design like Signal's, then do you think virtually all of them are fronts for spying operations?
I never wrote it was created as a front. I don't believe anyone asserted that. The company was founded by a couple of Dutch people in 2015, it was a Dutch company. So they fell under Dutch jurisdiction. I honestly haven't looked them up.
Fast forward to June 2025 and this company got acquired by an American company where the higher echelons are ex-Israeli spies. This could be a front, I don't know. I very much question this sale should've been ACK'ed by the Dutch government. Because due to the CLOUD act, the data now falls under American jurisdiction. Around the time of the acquisition though, the Dutch government fell. responsible up to then was Dirk Beljaarts. Around that time (June 2025), Vincent Karremans took his place. Fast forward a couple of months later, we had the Nexperia crisis, where Karremans intervened. A fallout from a stopped acquisition due to national security is lower than Nexperia fallout though.
I copied the title of the article verbatim. The Dutch article has a different title, and is IMO of better quality. The title of that article calls it a strategic blunder. I very much agree with that, but not because the top of Kiteworks is Israeli and ex-Unit 8200. That is just a cherry on top, worse case scenario a red herring. No, because of the current geopolitical situation with regards to Trump and the CLOUD act. Can you blame them for trying, given the situation and stakes? The acquisition occurred at a perfect timing.
The TL;DR is not that a American or Israeli entity supposedly succeeded. It is that the Dutch government failed. And while Zivver is heavily in use in The Netherlands, it also is within EU. So we failed to serve the best interests of EU here as well.
> I never wrote it was created as a front. I don't believe anyone asserted that.
There seem to be vague insinuations of a conspiracy floating around, rather than an explicit conspiracy theory, so I may have mischaracterized it. But for example, you mentioned elsewhere that "Mossad's way of operating is aggressive". Could you clarify what you're insinuating, if anything?
I'm no expert on that subject, just following Hubert's assessment that it falls in their M.O. (already linked), following Modderkolk's recent assessment on how Mossad operates [1]. Look at all the flak I get in this thread while I just went with HN rule of 1:1 using title. Problem is all these sources are in my native language. And finally, yes my suspicion is on high alert ever since the Maccabi riots in Amsterdam [2], to which Modderkolk also refers to.
And yes, I am well aware every Israeli adult is ex-military [3]. If it were up to me, we'd restart this practice here in NL.
[1] https://podcasts.apple.com/nl/podcast/hoe-de-mossad-overal-t...
[2] https://en.wikipedia.org/wiki/November_2024_Amsterdam_riots
Perfect cover story /slowclap
Secret services use companies as cover all the time. Nothing new there.
The conspiracy is that it is a dragnet for the data, and given the data is first send plaintext to Zivver (see the Dutch FTM article I already linked), it isn't far-fetched.
Looking at the current geopolitical situation, it also isn't far-fetched. It even fits in the Israeli secret services' M.O.
Actually, anyone who uses Zivver can find these vulnerabilities. I was worried about this, and reported it to my former employer (while still employed), but alas I did not have a PoC and they had a lot of other security related incidents so this was low priority. Also, this was at a time when the company was still privately owned by the Dutch founders. My hypothesis is that someone working for such an organization passed it to the Israeli secret service, who then got motivated to buy this honeypot.
Chinese do something similar: release some piece of technology, never provide any meaningful updates to the product, and voila it is insecure as hell (yet 'we didn't know' provides plausible deniability). I saw this first-hand with KRACK vulnerability.
Also... Kiteworks [1] is the name of the company. Not sure why you keep calling it Kitenet.
This is the same as claiming that water isn't wet until someone here on HN brings you 10 articles and news proving otherwise. This particular topic was never really denied, nor even by the authors themselves as you can read on the article.
Govt surveillance is a big club, and you ain't in it.
If you're looking for a sinister plot, look no further than In-Q-Tel.
The English article doesn't mention this, but vulnerabilities were found in Zivver. See my comment elsewhere in the thread referring to the Dutch version of the article.
You still wouldn't necessarily want a life insurance company to know stuff they haven't formally asked to know, you still have health information that could be used to blackmail you or whose reveal would be humiliating or upsetting.
Can't speak for all Europeans, but in my neck of the wood, Germany, they do very much.
Privacy is privacy. I ideally don’t want any of my data sold to anyone, but health data is even more vulnerable.
In my country it was even a big deal when they allowed different doctors to access your health data via a common system, as there were e.g. concerns that the information recorded by one doctor might bias another doctor, so some felt that it should be your choice what data to share between different parts of the public health system (except for explicit referrals).
Moreover, most European countries do have private doctors, private hospitals, and private health insurance – it’s just way less used than the public system. Those would have the same concerns as in the US.
I received my daughter's ASD diagnosis via Zivver. This included very personal details about her life. No parent would want that to be public. For adults it is worse: they become vulnerable to extortion, and Mossad is known to go very far for the cause.
Do Europeans care if their private and personal data is secret or not? What kind of question is that?
Of course there is no way for me to know if the poster was trolling or pushing an agenda. Some other commenters in this whole comment section are more obvious to identify
You can be discriminated against a job based on health records. Scary diseases like AIDS and TB make it hard for unskilled labor to land a job since it's so easy to discriminate. Pregnancy history may hurt women who are in countries with more generous maternity leave.
Mental health history will hurt just about everyone - who wants a worker who can claim ADHD, depression, anxiety, etc as reasons to be unproductive?
Then people will simply deny getting diagnosed for fear that they may uncover something that puts their jobs at risk. That hurts the medical system as a whole.
Combine with weird stuff like eugenics. What if we identify a possible rapist gene and neuter them in advance? Or bar people with a klepto gene from working in finance? You may live in happy, sane, democratic societies today, but it may not be the case 30 years from now.
I think this has been something people have had an instinct about forever, and the only reason I had to threaten to quit was because of a misunderstanding of the level of data safety involved; put simply it was not common knowledge that socket connections could be snooped and that targeting a popular service would be easy for a malicious person to do. (This was before SSL was efficient or easy to manage, and in the days when only payment screens were encrypted).
Once the message was across, everyone's objectives were aligned again.
Health information is deeply private because disease is entangled with shame/weakness/vulnerability/taboo/intimacy.
Just to make this clear, probably EU-wide, you can't legally be discriminated against. However, it's gonna be hard to prove leaked data won't be illegally integrated in e.g. ATS models, or was attributed as skill issue when it popped up during manual background checks.
Although, infectious disease like HIV or dystopian scenarios like eugenics are probably the classical discrimination examples for these privacy implications, I don't think they are very likely to be discriminated against (outside of jobs where discrimination is legal and require disclosure anyway, e.g. health workers, food industry etc.). It's easy to dismiss those worries, since most people aren't affected. But common issues with mental health (e.g. depression), hidden disabilities and chronic disease (e.g. PMS), or potentially severe recurring disease (e.g. cancer) realistically are going to be much more impactful. Everything which statistically increases chances to fall out the work force due to health reasons - especially in combination with strong labor protections.