Internet companies should not be monitoring terrorists or anyone else | Hacker News Reader

Internet companies should not be monitoring terrorists or anyone else

techfruit.com

97 pointsprimitive46 comments

It's also impossible. "I'm going to kill some soldiers when I get back" might refer to my super secret terror plot, or my PlayStation-related plans for the evening.

Welcome to The Database.

The Pre-Crime Database - or rather the Don't Make Us Use Something We Have Against You Database.

Here's my solution to that. Gather all the information possible, including things you've purchased so that I know whether or not you actually have those games or any of your friends do (and whether you actually play them). Assess, whether any major life changes have occurred for you based on all my data-mining and algos and assign a risk-factor for that particular statement. Monitor/filter your subsequent (or even previous?) communications (SMS, calls) for anything that might increase the risk-factor. If it's above a certain threshold, dispatch a discrete drone to follow you around 'just to be sure' (it's ok, you won't even know it's there). Maybe one day, I might decide to have armed drones, you know, 'just in case'. Oh, and make all of this automated because software is eating the world and what not (bugs? what bugs?).

Obviously, I say all of the above tongue-in-cheek but it wouldn't surprise me if there are people in government (or the security services) who actually think that way.

There very definitely are people who think that way who make policy decisions - most of them. They see themselves as invulnerable demagogues, and their apparatuses as being able to do anything, because they say they can. Computers are this amazing thing you can wave a wand at and anything can happen, and because it came out of a computer, you know it's GOT to be right.

We used to have a saying for this, which was "high on their own bullshit".

Career politicians are just that - in politics, for their career. Not for your sake. Not because they want to change things. Because they see a trough, and daddy stuck his nose in it and did alright, so why can't I too? This doesn't require any particular knowledge of the world around you, or empathy, just a machiavellian drive to clamber on corpses until you reach the top, where you can crown yourself king of the ashes.

The NSA is building a whole installation in the Western US specifically so they can do exactly what you propose, or as close as they can get at this time.

So, don't be surprised. Be a little bit afraid.

> I'd love a boiled egg

> Me too, I could murder some soldiers

And how do you differentiate 'IS' with 'is'?

How do you do it?

Besides capitalization, it's noun vs. verb. That sort of stuff is generally not hard to pick out with NLP.

If only inference engines were sophisticated enough to solve this impossible problem...

Why not? We expect and demand that banks monitor billions of transactions between 100s of millions of customers for evidence of money laundering and terrorism financing - and fine them billions of dollars when their controls or oversight are deemed insufficient.

I expect most us agree that banks _should_ be held accountable for the legitimacy of their customers behaviour. Why should the same standards not be demanded of internet companies?

All in all because we are "hypocrites". "I don't like thing" is the essence how one defines himself. Of course, you need others who does not like something else. And the wheel goes on and on and on and on.

It is perfectly fine for someone not to like how something works and other person to like how it works.

It is dilemma of humanity, how does we cope with it(should we?).

Did you even read the article? We shouldn't demand it because of privacy concerns. Same reason we don't have phone companies screen all of our phonecalls. Because we're not guilty until proven innocent.

Besides, then things like encryption become questionable. If the ISP can't screen your data, what's to stop them from kicking you off their network? Who knows what illegal things you're doing if they can't validate it themselves.

Not to mention that end-user companies don't have all of the keys either. If a screenplay writer googles "how to murder wife" and "how to get away with murder" and "disposal of body", what is google to do? Notify authorities? This is surely the wrong course of action.

It's the same. In you're making a big enough transaction your bank is going to get flagged and look into your banking activity. How is that not a breach of privacy too ?

Privacy is a continuum.

It is a breach of privacy, and it has some unpleasant side-effects:

http://www.nytimes.com/2014/10/26/us/law-lets-irs-seize-acco...

Accompanying HN thread: https://news.ycombinator.com/item?id=8509500

It's so obviously wrong, in fact, that suggesting this is the level of stupidity things would actually be implemented with is a bit of a strawman. A false positive rate of 99.99% isn't useful to anybody. You'd also monitor their netflix history to see if they're just reading up on something they saw on Dexter or Breaking Bad last night, you'd look at searches around the same time period to guess the intent more accurately, you'd have a general psychological profile built up to determine whether they're actually unstable, and you'd have purchase records that would help establish a baseline for how likely it is that they could actually pose a threat to anyone. And that's just what a layman thought of in two minutes. DHS has actual professionals working on this as their job.

You'd also monitor their netflix history [...] guess the intent [...] have a general psychological profile [...] have purchase records

DHS has actual professionals working on this

And what could possibly go wrong with that kind of power in the hands of "DHS professionals"...

Is that the world you want to live in?

Yes, it is. Isn't that obvious from my tone?

>>I expect most us agree that banks _should_ be held accountable for the legitimacy of their customers behaviour.

I don't think most people have this expectation.

Banks to be accountable for customers breaking law? What's an example of this? If I open a bank account in a different country, under an LLC, to illegally avoid paying taxes or to receive kickbacks it's up to the bank to figure that out? I do not expect banks to be responsible for their customers unless something outrageous happens, like a non-corp account suddenly reaching a billion USD balance. And this is ___much___ easier to automate for banks too and will produce almost no false alarms. If Joe-The-Plumber's account is suddenly more than Donald Trump's net worth... something is going on.

Conversely, with Facebook/Apple/Google you'd just get this[1] happening all the time. And have you ever had the joy of XboxLive's in-game audio and messaging? False alarms galore. Blowing up planes and burning down / shooting up schools was a common joke even when I was a kid in the '80s, not even to talk of today's youngsters. <--- And now if HN had terrorism-dection built in, will this comment of mine get flagged?

1. http://www.cbsnews.com/news/long-island-high-school-student-...

If a bank falls within the remit of the Fed or PRA then yes, KYC rules mean the bank is indeed supposed to figure this out.

Enough people have shot up schools that I think some sort of response to "I'm going to kill people at school" is warranted. A conviction may not be the best outcome, but I don't think it's entirely safe to ignore all of them.

I guarantee it will be 99.99% false positives. Until people learn to censor themselves.

But that's really irrelevant. The government shouldn't have the right to spy on people's private conversations, if they aren't suspects. Whether they occur in real life or on the internet is irrelevant. And people shouldn't live in fear of saying the wrong thing and being taken away, like they were in 1984.

How about trying to understand and deal with the root-cause of people shooting up schools?

You can do both.

In the UK, there isn't a day that goes by without me muttering something about killing one of my colleagues.

Thankfully in the UK, I do not really have the means to do this so it is obviously interpreted as an exagerated expression of annoyance.

In the US, the possibility of every exagerated threat being an actual, actionable threat is much higher.

Censorship is not the answer.

A couple differences that I believe are relevant:

a) Bank balances are a more controlled system from the beginning. They 'know' how much is in your account and when you transfer it they 'know' how much and to whom. Meanwhile, Google, Facebook and so on are not keeping active track of the nature of your conversations within chat and email in such a tightly controlled way. When I say "Hey, what's up" to a friend in Facebook Messenger it's not treated by FB as a bank would treat my sending the friend $200. (I realize this gets a bit ambiguous because the message is still recorded in a database and parsed for advertising...)

b) The activities we engage in on Facebook, Gmail, WhatsApp and the like overlap with speech and social relationships which are usually given more protection and consideration in society than specific transfers of items or materials (like cash, physical items, and so forth.) Imagine your local police tracking everyone's movement, conversations and social relationships in the neighborhood "just in case"—that'd raise concerns! Meanwhile a store owner keeping inventory of every sale is just seen as expected behavior.

> Meanwhile, Google, Facebook and so on are not keeping active track of the nature your conversations within chat and email in such a tightly controlled way.

The question is, should they? I'm sure banks weren't always as tightly regulated and didn't keep as tight a track of everything as they do now.

Should we ask web giants to start behaving in a more regulated way for various reasons ranging from the ability to get alibi from "I posted this on Facebok at X and couldn't possibly have been where you say I was", to the ability to have court evidence of what people were/are up to. If data isn't kept to a certain standard it becomes too unreliable in such cases.

On the other hand, do we actually need banks to have such a tight control over everything? Yes, we expect it. But do we need it?

In terms of court evidence, I believe internet companies are responsive to warrants (although some fight requests they consider unreasonable with more vigor than others.)

My reading of the article suggests this is more about active and ongoing surveillance, which gets into greyer areas (the feasibility of such monitoring, potential bias in algorithms, as well as issues like the concept of "pre-crime" and the legal concept of "prior restraint"...)

Or perhaps what we should be discussing is whether we have right to make payments through the standard financial system (without the need to recur to bitcoin et al) with some privacy. Should the bank have access to whatever comment I put on a payment to a friend? If my friend writes "Iran" on the comment, should a random Compliance officer have access to that communication between him and me?

We expect and demand that banks monitor billions of transactions between 100s of millions of customers for evidence of money laundering and terrorism financing

I most certainly don't expect that from my bank.

I expect most us agree that banks _should_ be held accountable for the legitimacy of their customers behaviour.

I disagree. Banks are not law enforcement.

Well even if you don't, regulators certainly do!

Regulators want more power. That surprises no one.

Might you be one of those who reels in horror that Google electronically sniffs your email to serve you ads?

I've been thinking for a while about something: Americans really need to live through a Communist/Stasi era that brings them to their knees and to live in fear of their neighbors or anyone working in the government for at least 2 decades or so.

Maybe after that ends with a revolution to be remembered, such nonsense would stop being proposed at least for another century or two.

Many Americans seem to quick to agree with mass surveillance and absolute power of the state if it they promise (without even proof of it) that such power will stop some common crime - without taking a second to recognize that if the state is so powerful so many more crimes will be done by that government against the population.

It seems many Americans have lost forgotten why their rights are important. That's why I think maybe they need to go through a really oppressive time, to remember.

So your cure to the sickness is to bring about the sickness itself?

The good thing about this point of view is that you will be happy whatever happens.

"Article 8 – Right to respect for private and family life
1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."

(The US has similar wording split between amendments 1 and 4).

The word "necessary" is where all the argument rests, as well as "in accordance with the law". Proportionality and transparency must be taken into account. Generally pure speech acts are not in themselves illegal, and we want to be very careful about creating offences which could make engaging in unconventional politics illegal.

In some ways the "report terrorist button" could be the most reasonable implementation of this. Leave private correspondence alone, but if someone sees threatening content there should be a mechanism for turning that in to evidence which could result in the poster being banned from the service.

Evidence is important. Legal processes generate evidence which can be used in trials. Secret services generate "intelligence" which is classified and cannot be used in public trials, resulting in pressure for secret trials.

Edit: getting downvoted for citing ECHR? I knew it was unpopular ...

Of course most people don't expect that. Why do you think bitcoin was so popular here?

Because you could buy drugs with it conveniently and in relative safety.

And how effective have those regulations been?

So should coffee shops be responsible for monitoring their customer's discussions and reporting suspicious behaviour to the police? Should they be forced to record the name and address and date visited for all their customers to aid any future investigation?

Is this just the first offer in a bid to get police access to data for investigation purposes - like ask for the world and then asking just for a mountain sounds reasonable.

In this case it would be asking that service providers monitor everyone; but, the actual desire is to allow investigative authorities (police, MI5, ...) access to suspected terrorists online dealings via the service providers at the back end.

In the Lee Rigby case it seems that the exchange about murdering soldier would have been sufficient to push the suspect in to the camp of making terrorist threats and allowed for an arrest.

It's curious in some ways as Adebowale had been the focus of investigations and yet GCHQ clearly didn't have information on all his online exchanges (that could be tied to him), yet a company in the USA did have access. This suggests that the level of integration in to online communications that GCHQ has is far less than we've recently been led to believe. We're being told left-and-right that government spooks know our every move and whisper - this seems not to be true, not even for people associated with terrorism investigations.

I don't think it's practical to require the likes of Facebook to monitor for terrorists and the like. After all one man's terrorist is another's freedom fighter. However it would be quite reasonable for them to choose to look out for that and bullying, grooming and the like especially if the posts are semi public.

I thought the global intelligence services already had access to Facebook etc. data, maybe the question in-light of the Ed Snowden leaks, is why they didn't see this. Except, as commented there would be an extreme false-positive rate. In which case, why do we continue to fund the intelligence services...

The title of this article is slightly misleading. The article actually says we should be monitoring known terrorists. Perhaps they should change the title to "Internet companies should not be monitoring non-terrorists".

I think that's a bit hard to do when your business model is built around user profiling, even if it is only for purely legal business ends.

Reply on news.ycombinator.com