A Case That Has Microsoft, Apple and Amazon Agreeing

http://www.bloomberg.com/news/articles/2015-09-02/as-microsoft-takes-on-the-feds-apple-and-amazon-watch-nervously

by andore_jr • 11 years ago

245 181 11 years ago

amgine• 11 years ago

It's great this article about Microsoft fighting for our privacy came put in the midst of the upset over Windows 10 phoning home.

saraha• 11 years ago

Microsoft aren't fighting for your rights here. They are fighting for market share. Not turning your data over to the FBI is now a product feature.

Spivak2• 11 years ago

And god damn would I be willing to pay top dollar for such a feature. Do you hear me $every_tech_company? I'll be more than willing to put my market demand where my mouth is, give me client side encryption and/or self-hosted versions of your products and I'll happily write the check.

nivla• 11 years ago

Which in turn is protecting our privacy. The same can also be said about all other corporations: Google, Mozilla etc.

ihsw• 11 years ago

I can't help but disagree -- they are caught between a rock and a hard place. Following the demands of one Federal government (Brazil) will result in them violating the laws of another (US).

They are fighting for a unified legal regime that spans across all international boundaries.

Dirlewanger• 11 years ago

It's kind of a red herring to connect these two. The case here involves the government seizing data from a foreign data center. Were Microsoft to lose, this says to foreign customers that any time the US government wants some information stored overseas, they will get it. Obviously not good for business.

Here in the states, Microsoft is going to collect everything it can about its customers and store it (and from there I imagine it eventually goes on in some form to the NSA).

Spivak2• 11 years ago

So your argument is that people and organizations worried about having their data seized in the US is not bad for business?

Most individuals didn't really care too much when the NSA documents were released but businesses sure did. Our security and privacy pitch to the management was bumped from, "would be nice someday" to "make it happen."

kgilpin4• 11 years ago

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem.

Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

valarauca12• 11 years ago

But then you can't leverage customer data to sell to advertisers. The problem is, you are the product for most internet companies.

Think of a Cow in a barn. The food/water/shelter is free, because you are what's to be sold.

reitanqild2• 11 years ago

This meme got old faster than I expected.

I am the only one that is aware of symbiosis?

Karunamon• 11 years ago

If by "you", you mean aggregated data about you in lieu of cash payment.

Google/Facebook/etc are not selling your data, they are not selling you, they are selling access to you via advertisers, more specifically, they are selling access to people who like certain things and who live in certain areas who have certain demographic profiles.

If you're curious about this, go sign up for an Adwords account and see how the targeting works - what you see there is the limit of what any advertiser using Google sees about its users. Facebook is much the same.

Get it right. Any ad-backed company of note does not "sell your data" and characterizing it as such is so divorced from reality as to be a blatant, willful lie.

lallysingh• 11 years ago

The larger issue is that you now have to push key management to the user, and the support problems that go with that. Key management is hard and painful. Telling a customer that they can't access their data on your service because they broke their laptop is going to make them very unhappy.

Otherwise, there'd be plenty of services competing with Drive, DropBox, etc, that did just that.

pdkl953• 11 years ago

push key management to the user

There is no other way. Unfortunately, there has been a serious lack of r&d in this area, so we have a lot of catching up to do. I believe it can be made to work, though, because this is not entirely a new idea for most people: they already understand physical keys and the problems associated with losing them.

Moving to digital (public-)keys isn't a perfect match, but it is entirely possible to leverage the skills and experience that people already have. For example, contrary to the advice used a decade ago, Schneier recommends[1] that people write down their passwords (avoiding the memorization problem). This can provide good enough security most of the time, because people already understand how to provide security for their wallet.

Incidentally, I always liked the basic idea of the Java Ring[2]. It was basically a fancy (for the time) smart card, but the idea of storing the chip in a ring is an attempt to make security management personal, which is an idea that had potential.

[1] https://www.schneier.com/blog/archives/2005/06/write_down_yo...

[2] http://www.javaworld.com/article/2076641/learn-java/an-intro...

edit: forgot a link

LordKano2• 11 years ago

Telling a customer that they can't access their data on your service because they broke their laptop is going to make them very unhappy.

Depending on your target market, that can be a selling point. Tell them early and tell them often that you don't keep copies of their keys and if they lose them, they won't be able to access the information. Remind them to make backups.

protomyth• 11 years ago

Tarsnap (a service that acts like your description) is quite nice, but the problem of "customer lost the keys" is a very real one. I love the idea, but someone really needs to come up with some decent key management (and offline backup and key migration) to make this consumer friendly.

bertomartin• 11 years ago

Then, we need a good service to store keys, with a key to get to your key

dbbolton• 11 years ago

decent key management

What about Hashicorp's Vault?

Intermernet• 11 years ago

It's not really something that can be made "consumer friendly" as far as I can tell (But I'd love to be proven wrong!). How do you securely store the key to your securely stored data?

Admittedly, there are some recommendations on the Tarsnap site (http://www.tarsnap.com/gettingstarted.html):

"5. Keep your key file safe

Store your /root/tarsnap.key somewhere safe. If you lose tarsnap.key, you will not be able to access your archived data. The same encryption which ensures your data security also means that there is no way for anybody (including Tarsnap Backup Inc.) to restore your data without this key. There are many ways to keep it safe: Copy it to a different system. Put it on a USB disk. Give it to a friend. Print it out (it is printable text). Store it in a bank vault. Pick at least one and do it!"

The only other way I can think of to keep the key even safer would be to use Shamir's Secret Sharing to divide the key up and share it among trusted friends and family. (https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing).

ddlatham3• 11 years ago

If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.

rayiner6• 11 years ago

There is no reason that stuff can't be done on the client side.

Outlook works just peachy searching my GB's of emails and attachments from its local replica, using the internet only to sync.

harryh2• 11 years ago

Also displaying advertising based on keywords in your email.

kgilpin4• 11 years ago

When I submit a search, I can also submit the key.

Spam filtering can be done as the email streams in. Email databases which power the spam filter can be de-anonymize do and reduced to statistics.

I guess sharing is harder but it can still be done. If I share content with you, I'm giving you permission to have a copy so it can be encrypted with your key as well as mine.

rayiner6• 11 years ago

What's crazy is that it often just isn't an option.

Precisely for some of the reasons outlined in the above article (third party records are subject to subpoena pretty much everywhere, not just the U.S.) it's untenable in certain fields to keep sensitive information on the cloud.

Those concerns would be dramatically mitigated if at least there was an option to do client-side encryption. That way the government has to get jurisdiction over your person to get you to turn over the encryption keys, which puts you on much stronger legal footing.

jo9092• 11 years ago

That works for file and message/mail contents, and there already are functional external solutions for that (f.e. GPG). I agree that needs to be better integrated and supported.

But Google needs to know my search query to be able to serve me a results page. Google will know my phones location if I use their WiFi-positioning-system. Google needs to know my address and payment information to have me buy apps.

Encryption can not help me here. I need to be able to trust Google not to collect that data without my consent, that they do not store that data longer than needed to provide me the service and that they do not share that data with anybody that has no right to it. That can only be guaranteed by laws.

This is about laws, and the need for such laws will not go away by encryption alone.

MichaelGG2• 11 years ago

Right, and how would that be implemented, in, say, a web browser? Do you really think that the government that's forcing all this secret spying would just give up? Or more likely, would they require modifications to the software to leak the key or plaintext?

How would users verify that the software was working securely? A webmail provider would need to publish a full client-server API and protocol spec, so that you could run some independent software to audit what was being sent to be sure no leakage was happening. This is simply untenable.

Oh and what would really happen is that everyone would lose access to their data since, in general, nobody is able to maintain keys. It's pretty understandable that companies have little desire to redesign their whole systems to provide a crappy experience to a nearly non-existent market segment.

phkahler• 11 years ago

> If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem.

There is no value to the company in doing that. They can't mine the communications to determine what ads to serve you, or anything else. At that point they'd just be offering a free service. Why?

kgilpin4• 11 years ago

Sure they can. They want to run a job, they can get the key from me and run it. This can be transparent to me; eg my phone could transmit them the key every day until I decide to stop.

So many people are saying "your proposal breaks cloud services or requires client side compute", but that's not true. Be more imaginative and get outside the current model.

fauigerzigerk2• 11 years ago

They also wouldn't make any money from advertising and the government would pretty soon outlaw the practice.

morninj2• 11 years ago

Some actors in the US government have been trying to outlaw consumer cryptography for decades, and so far they haven't succeeded. See, e.g., the Clipper Chip battle from 1994.

vilmosi• 11 years ago

But then a lot of things wouldn't be able to exist.

Siri needs collective anonymous data to work and improve itself. Ads, like them or not, cannot function without large collections of data. No attempt to predict customer behaviour is possible, no usage analytics, no cutting edge improvements, a lot of cool things wouldn't be possible.

It's just how it is.

ewzimm• 11 years ago

It's good to know there are people like Brad Smith standing up to government demands for full access to people's data. It brings up an interesting privacy contradiction. While storing data locally seems best for privacy, if it's on a networked computer, there are still ways for people to get it, and unless you have really good lawyers, nobody is going to challenge governments across the world if they want to access it. By moving data to the cloud, we are creating incentives for companies like Microsoft to fight against government intrusion.

zeveb• 11 years ago

I am not a lawyer, but it seems to me that an American court has the power to demand that an American citizen produce an item or information under his control, even if it happens to be in another country (e.g., a man getting divorced can't drive his car and all his gold and jewelry into Canada to shield them from his ex-wife). I imagine that most other countries would behave similarly: being within their borders and subject to their jurisdiction, they can compel someone to do something.

If that's indeed the case, then it seems that an American corporation—a legal person with a presence in the United States—may be compelled by a court to produce items or data it controls outside of our borders.

The thing we need to do is to limit the power of the subpoena generally.

sangnoir• 11 years ago

It gets more interesting where the American companies own subsidiaries incorporated in other countries. Can a US court compel Apple's Irish subsidiary (for instance) to release data?

idlewords• 11 years ago

I hear you're not a lawyer.

dpark2• 11 years ago

it seems to me that an American court has the power to demand that an American citizen produce an item or information under his control, even if it happens to be in another country

Does the American government have the power to compel someone to violate foreign law in order to produce an item held in a foreign country? Can the American government force an American citizen to violate Greek law and take a million Euros out of Greece for that hypothetical divorce settlement?

This is the scenario in question here. It is illegal in Ireland for Microsoft to provide the requested information to the US Government. The data resides in Ireland so complying would require performing an illegal act in Ireland. Does US law for some reason override Irish law? Can the US government compel Microsoft to violate Irish law?

crpatino• 11 years ago

Does US law for some reason override Irish law?

It's pretty simple. Whoever has more guns backing up their laws wins.

dogma11382• 11 years ago

You are not a lawyer, if some one does it they aren't forced to drive the car or jewelry back they might be sued for hiding assets in a civil court, this isn't the government suing people, divorce isn't a criminal procedure. In any case Corporations aren't people, and MSFT servers in Ireland probably belong to MSFT IE/EU which is a separate legal entity (which is why MSFT can say we don't have it). There is also a difference between a warrant an, order and a subpoena in this case and 1000's other issues that I also as some one who's not a lawyer can't even begin to imagine.

But you know who is a lawyer, MSFT's head legal council and i hear he also got a bunch others with him so i would think they would figure out how to handle this. But in general various agreements and treaties govern how law enforcement agencies and legal systems of different countries interact, some countries might accept a signed US court order (Canada for example), for others you will have to go through the extradition process codified in a treaty, and the list goes on and on and on.

*P.S. With several exception a court can't compel you to do anything if you violate a Subpoena you will be found in contempt and maybe charged for that, and while you can call that compelling It's not since the court will not actually force you to do anything.

lrem• 11 years ago

This gets better. See, Microsoft has an entity in Estonia. Now, how about an Estonian court compelling Microsoft Estonia to provide Obama's private email? Would anyone even treat such a thing seriously?

bitmapbrother• 11 years ago

It's important to remember that this is the same company that snooped through the emails and files of one of their users while looking for evidence of piracy. They came clean about their snooping moments before court documents were publicly released that detailed what they did.

soylentcola2• 11 years ago

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes."

See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval.

If Microsoft or Google or Apple or Amazon offer me a service and state that "hey, we'll provide this service for no cash outlay but data you submit to our servers will be analyzed to tailor search results, advertising, and other behavior to your usage" I can opt into that knowing that I'm trading targeted ads for free email or hosting or whatever. If I don't think that's a good deal, I don't use the service. If I think "OK, ads are a fair price for this stuff" then again, I'm cool with that.

But just because I agree to let Google read my location to send me traffic warnings before heading out to work doesn't mean I want the FBI to grab that data without my knowledge so they can determine if I might be a troublemaker. Just because I agree to let Amazon use my Amazon searches to suggest other products I might want doesn't mean I want the DEA demanding that info to decide if the gardening gear I purchased was for tomatoes or growing cannabis.

I'm perfectly aware that you pay for the things you get, whether it's directly with cash or indirectly from advertisers who pay for access to your eyeballs. Those are things I can consent to or decline. But when people with guns and the ability to throw me in jail can demand access to that info without my knowledge, I'm no longer agreeing to the same thing.

It's like signing a contract where someone else has the ability to change the fine print after I've signed it.

Tactic• 11 years ago

The government has this ability with near all other relationships you have. So much so that they have codified the few that it doesn't apply to. We put lawyers, doctors, clergy and spouses in a special category but others can be required to divulge any information they have on you with the appropriate order. (What's appropriate is another discussion)

Ultimately, realize that any dealing you have is open to the government if they so desire and make that part of your decision making process.

317070• 11 years ago

As a European citizen, I have a different view on this issue. While I do trust Google/Microsoft with some of my data, and I kind of trust my own government with my data, I don't trust the U.S. government for one bit, especially its judicial system.

Luckily, I don't normally need to account for that, and I'd rather keep it like that. But this is like somebody at the other end of the planet changing the small letters of my contract which I made with a local subsidiary of the American giant. The contract was between me and a local vendor, and suddenly we have the American government intervening?

jo9092• 11 years ago

Exactly. The police can read all my letters if a judge allows it. They can tap my phone, bug my bedroom, track my movement, perform a cavity search, take my blood and DNA, detain me, and if I make really bad decisions even kill me.

And I am totally fine with that in principle, only not with a few somewhat minor details and missing checks and balances.

I want _my_ government to be able to do all that, according to the laws of _my_ country, which I am able to change and influence.

colechristensen• 11 years ago

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The US Government does _not_ have the legal authority to arbitrarily collect or seize data without a warrant specifying exactly where and what they're looking for.

So much so that they have codified the few that it doesn't apply to.

There are a few exceptions on whom you can get warrants for, but we're not complaining about warrants with probable cause.

The complaint is that our "persons, houses, papers, and effects" are being violated without probable cause and without "particularly describing the place to be searched, and the persons or things to be seized".

CosmicHorrorSam5• 11 years ago

What you said may truly capture what's necessary- we need to codify additional relationships for the digital space that enjoy this level of protection, and codify them such that violations result in criminal cases being thrown out and/or reparations being paid! I envision this like the police force and falsifying evidence/respecting your rights- there's certainly some of all that happening, but police are eager to prove that they've done things correctly, because if evidence falsification or certain rights trampling happens, it result not only in internal probes and scrutiny, but dismissed potential convictions! The incentives generally line up.

Lawtonfogle• 11 years ago

doctors

Might want to remove them from your list. Mandated reporting by therapists and doctors does more than most anything else I can think of to stop those most needing therapy from seeking it. From potential offenders who fear being outed to victims who fear their therapy records being made public at trial and used against them.

deelowe• 11 years ago

Agreed. It's not ironic at all. If you are in the business of data mining and some competitor comes along screwing up the data mining business for you (the government's actions and it's impact on PR), you'd be very interested fixing this problem as well.

Most generally didn't care about this until they became aware of the government's activities.

CosmicHorrorSam5• 11 years ago

Hot dang, that last line is insightful.

Some people will argue that whenever you let someone have data about yourself, you're implicitly giving access to practically everyone by virtue of often imperfect security.

I believe that those people are full of shit.

dkarapetyan• 11 years ago

As long as there is a data silo that is not under your explicit control you have indeed implicitly granted all parties willing to invest enough to break into that silo implicit access. Where exactly is that full of shit? The problem isn't the implicit agreements. The problem is lack of control and centralization.

P.S.: I'd also tone down the language. We're having a discussion and calling someone else's opinion "full of shit" defeats the purpose of having the discussion in the first place.

orf• 11 years ago

whenever you let someone have data about yourself, you're implicitly giving access to practically everyone

I believe there is truth in that. The way I see it is you don't have much control over information entered into any computer. You can practice good security hygiene and that means you can trust information on your personal network, but that really that means you trust your combination of OS vendor, browser, antivirus, router manufacturer, etc. A hole in any one (or more likely a combination) of these could lead to someone gaining access to your data. This applies even more to info stored in 3rd parties/data sent over the net.

Then you're at the mercy of the people who stole your data, they could very well release it to everyone, or sell to the highest bidder (and you wouldn't even know).

joesb2• 11 years ago

That's like saying that, by letting the bank hold your money, you're implicitly giving bank robbers the access to the money, by virtue of imperfect security.

And since your own house's security is also imperfect, you are also giving everyone access to your house and properties.

twblalock2• 11 years ago

A lot of people trusted Apple with their photos, and Apple did not release any photos, but that doesn't really matter because they were stolen.

A lot of people trusted Ashley Madison, and Ashley Madison did not release any data, but that doesn't really matter because it was also stolen.

Given that nobody has invented perfect security, it is reasonable to assume that any data anywhere can be stolen, and therefore you have no control over who accesses it.

revelation• 11 years ago

Actually, my problem with giving someone else data is that apparently US law considers data given to a third-party to be essentially a free for all for law enforcement agencies. There is zero protection for anything you have at one point shared with a third-party company, even if a device did the sharing.

wfo• 11 years ago

Except that companies generally reserve the right to modify their privacy policies at any time without your permission, only notification, and that's if they even follow them in the first place.

roflchoppa• 11 years ago

Hey man people always bring up this point, does anyone have MORE information about how that infrastructure works? I made a Facebook account for my class the other day, with nothing but my name and email. Now I'm 50 friends deep with old classmates // co-workers. Creepy. But HOW intrusive is this system?

mindslight2• 11 years ago

It seems like you're perfectly content for Googappazon to turn around and voluntarily sell "your" data to governments.

Given that it's really their data about you, they don't even need to disclose this in the TOS. The best you could hope for is for companies to loudly prevent themselves in their contracts. Of course they could end up going through commercial third parties, or any other plausibly justifiable loophole when they get serious about increasing earnings. Even if they wholeheartedly break your contract and you provably find out, what was your consideration actually worth - a few dollars? You'd be in an even weaker position to show damages than you are now with the NSA.

The ability to consent/decline is indeed a powerful distinction between corporations and government - I believe our world would be much better if every association were voluntary and we could opt out of things we found harmful. But juxtaposing governments/corporations and arguing against one by wholesale endorsing of the other, especially for something as slippery as data, is a Faustian bargain.

abritinthebay• 11 years ago

It seems like you're perfectly content if Googappazon turns around and voluntarily sells "your" data to governments, since you've consented for them to use it.

Use it under the limited license you agreed to. Not to use it for any purpose at all. This is disingenuous rubbish and you know it.

SilasX2• 11 years ago

It's like signing a contract where someone else has the ability to change the fine print after I've signed it.

I don't disagree with your points about government access to this cloud information ... but this point would carry a lot more weight if these services didn't routinely get away with unilaterally changing their privacy terms.

I also really doubt people have well-formed beliefs about exactly which privacy rights they are giving up for these services, and government agents would probably be in a lot more trouble if they misled you about which rights you were waiving.

SonicSoul• 11 years ago

Sounds like you're saying that frequent privacy rights changes and people not understanding their own rights in some way justifies this ?

compactmani• 11 years ago

Last I checked, the government gets in zero trouble when misleading you about which rights you are waiving. I thought that was quite clear by now?

axelfreeman• 11 years ago

You say that you don't want (your data) to be abused and you don't want to have problems because of that. Nobody wants that in any other case. It's not that special. Only the subject has changed to digital data on the internet.

(German guy here. My english could be bad.)

CosmicHorrorSam5• 11 years ago

My general understanding of the difference here is that, while you're correct that we don't want any of our information- our mail, phone calls, movements, etc.- to be abused and give us problems, the issue here is that law enforcement DOES have a legal and legitimate need to look at all those things sometimes with a warrant, issued by a judge, who has reviewed the evidence collected so far and deemed there to be probable cause.

The situation we fear will come about instead is this one: law enforcement has access to all of our data, uses our data to find probable cause, present this to a judge, and arrest us.

It's upside down- law enforcement is supposed to be limited in what it can do until it 'picks up the scent' of criminal activity, after which it can use an expanded power set. If we give law enforcement a greatly expanded power set to use before it has 'picked up the scent' of criminal activity, we would foolish not to expect all kinds of abuse (especially given the nature of 'big data'-driven methods of 'picking up the scent').

np422• 11 years ago

If google makes a mistake when data-mining my e-mail, I may get an inappropriate ad displayed next to my e-mail.

It the authorities make a mistake when looking at my data, I may end up in jail or on the no fly list.

rayiner6• 11 years ago

But just because I agree to let Google read my location to send me traffic warnings before heading out to work doesn't mean I want the FBI to grab that data without my knowledge so they can determine if I might be a troublemaker

Constitutionally, privacy is a pretty cut-and-dry concept. Information is either private or not. Private information isn't "information I don't want the government to have" it's "information I don't want anyone else to have."

I'm not saying we couldn't restructure the law to express what you're talking about. But it's not just a matter of extending our existing principles to this new situation. You're throwing the concept of "privacy" on its head by saying that you have this information that's "private" but that at the same time some third-party entity (and its employees) actively sifts through to target advertising to you.

LordKano2• 11 years ago

Constitutionally, privacy is a pretty cut-and-dry concept. Private information isn't "information I don't want the government to have" it's "information I don't want anyone else to have."

You are incorrect. Your line of thinking runs in direct opposition to Roe V. Wade.

You can share information with your doctor that you specifically do not want the government to have. There's nothing special about doctors, in a constitutional sense. They are a third party providing a service and it is most certainly possible to have shared information with a third party that is still private.

jack9• 11 years ago

Constitutionally, privacy is a pretty cut-and-dry concept

You clearly don't understand the US Constitution or existing US law. Saying it's cut-and-dry doesn't make it so.

Information is either private or not

I'm sorry, I made a mistake. You don't understand privacy as a concept at all. Privacy is about access controls.

What's more all this frothing about privacy is not the issue under consideration. The issue is about extranational data being subject to US law because the legal entity in control of the data, is a US company. Other countries have similar requirements (Want to run a cloud service in China? Set up shop in a chinese data center, no AWS for you), and it makes sense to me as a nationalistic interest. What's more, you have these companies deflecting HARD "timeless values should endure. Privacy is a timeless value" which is a red flag. I don't care that the French have a firm grasp of privacy, this is a US issue. These companies are free to leave the US if they really believe this is wrong (they wont).

bad_user• 11 years ago

You're talking about secrecy, privacy is not secrecy and I don't think you understand what privacy is.

Are you a homosexual or a transgender? Did you ever have an extramarital affair? Do you have HIV, or diabetes? Do you have a criminal record? Are you a muslim or a jew? Have you been abused as a child? Do you have a history of drug usage? Are you in a lower caste? Are you a war veteran? Have you ever spoken against your government to your peers? Have you ever gotten drunk at parties? If you have kids, have you ever taken pictures of them naked?

Depending on context, like the community you leave in, or the mood of your government, there is plenty of criteria for discrimination. In the right context, some of these can get you fired, some can get you killed.

And privacy is not secrecy, but rather the right to not be monitored. By not being monitored, even though you cannot hide your identity, you can control what facets of yourself people see. Privacy is about having control. On the other hand by being monitored, you're on file and likely to get fucked in the future by traits that today may be innocuous, as history shows. And you can also be blackmailed. And skipping the doomsday scenarios, most government institutions are filled with incompetents and do you really, really trust those incompetents to handle that data? I could tell you stories.

soylentcola2• 11 years ago

I admit my post was more a personal complaint/rant than a legal argument. I guess my concern isn't so much about privacy as it is about the ability (or inability) to decide on at least a general level where to send information.

Put way-too-simplisticly, if someone said to me:

"Would you let my widget track where you drive in exchange for a discount on fuel based on mileage?" Maybe I would say yes. Maybe I would say no.

How about if the offer also said that "the way we pay for this is by scanning the data we collect. That way we can sell ad space to businesses near your common driving areas. They never get your actual data but a shop on your morning commute will pay us to show their ads to people that may pass by." Maybe I would still agree. Or maybe I'd think, "eh....I dunno. Raw data for discounts is one thing but analyzing it for third parties seems sketchy." Again, my choice in general even if I don't ever know the exact workings of the software and transactions or any of the third party businesses buying ad space.

I think of it more like contract law and knowing (at least broadly) what you're agreeing to before you sign.

To continue this ludicrously oversimplified example, let's say I agree to the terms because on one hand, all this targeted advertising seems a little tacky or creepy but on the other hand, it really does beat getting blasted with ads for stores in other towns or items I'd never buy. Plus hey...the discounts on gas mean I'm spending $50 less every month!

Well, without my knowledge, the local Drug Enforcement Agency has decided that the best way to stop trafficking is to either secretly demand all the data collected by this ads-for-fuel service or just install some dodgy new data collection towers that connect to the tracking widget and intercept it all without anyone's knowledge.

That is the point where I have a problem. It's not that I expect complete privacy in public. If law enforcement wants to get a warrant to track my car because they think I'm a criminal suspect, that's something that can happen. But to demand (or just take) mass amounts of data that was only volunteered for other uses is just not cool.

Maybe my animosity comes from thinking that if the state wants all of this info, they ought to develop their own ways of getting it, rather than just taking advantage of legit services that people choose to use. Or maybe if they just came out and said "we're putting a tracker on everyone's car" people would go apeshit.

It's like if you can't convince everyone to submit to tracking by the state/law enforcement, just wait until someone else develops a service everyone wants to sign up for, then demand or steal their data.

dragontamer3• 11 years ago

Constitutionally, privacy is a pretty cut-and-dry concept.

That's true. Privacy is anything you kept on your own person or in your own property.

Emails however, are stored on another person's computer and therefore have no expectation of privacy. (some 1980s case IIRC).

Constitutionally, privacy is a cut-and-dry concept for the 1800s when the Bill of Rights were written. The fact of the matter is, the people who wrote the Constitution had no concept of "Cloud Computing" or "Computing" in general.

So it is up to the job of today's Politicians and Judges to figure out what to do in these cases. And that isn't a very easy job to do.

losvedir• 11 years ago

Wow, I had no idea this was the case. Thanks for sharing. I seem to remember that you're a lawyer so I'll have to assume you know what you're talking about. :)

some third-party entity (and its employees) actively sifts through

Just to be clear, is this condition important to your statement? That is, can you store information with a third-party entity with the assumption that it's constitutionally "private" there if you don't let them sift through it? Say, a bank safe deposit box, or some sort of encrypted enterprise crowd storage, or cperciva's tarsnap?

aluhut2• 11 years ago

Yeah that opt out theory was nice some years ago. Now it's not that simple anymore. Most of the times you just have no choice.

What right has Amazon to do this? They get their share from the fact that I buy stuff though them. So I pay and still get analyzed. There are many more services that work like that. You can get around some of them by spending much money or acquiring special skills that would allow you to run things on your own but all that will remain a solution for few. The majority is trapped because data mining became natural. The legend of "free for data" now just applies to everyone. It went so far that some advertise with the fact that they DONT data mine.

Privacy as a product.

Also it's not like this majority ever understood what they are saying yes to. You know that long awful text nobody reads.

The government looks very small to me if I consider all the other data mining parties currently active. Even with what Snowden toughed us. This fear that now somebody really connects the dots is a healthy one. Strangely the revelations did not lead to the same conclusions regarding the private sector. Good marketing.

My workaround to this: I teach people how to create and manage useful fake identities.

rarepostinlurkr• 11 years ago

Not useful enough to be able to acquire a bank account, which requires a drivers license or social security number, which then requires a birth certificate.

And as it turns out, it seem acquiring any of these things for purposes of a false identity is illegal. So much for remaining anonymous online just because I'd like to be, not because I need to be.

xorcist• 11 years ago

Sure you can, and that behaviour is rather mainstream by now, but it wasn't long ago it was considered very egoistical.

Every time you install an app and you agree to upload your contact list to someone? That data was not yours to share.

Every time you put a little tracking script on your web page in exchange for traffic graphs it is your customers data you sell. Not your.

Every time you email me everything I write ends up indexed under my email address, to be sold to another company and cross referenced. I didn't agree to this.

That like button you put up that reports all your visitors behaviours? Not your data.

nickbauman• 11 years ago

I don't see the irony either. I believe the critical difference is that corporations aren't (or at worst case shouldn't) in the business of using data in a way that they can legitimize the use force against their customers. Unlike government.

throwaway77675• 11 years ago

Microsoft has shown that they are quite willing to access induviduals private data if they have a financial stake in it [0]. Yes, they eventually backtracked under public pressure (after trying very hard to justify how it's totally okay because they were going to pay a lawyer to rubber-stamp things in the future), but it's rather hard to listen to their general council talking about how they value privacy on principle given their history. It's quite obvious they only care about privacy insofar as it affects their bottom line.

The article also conflates (intentionally?) this issue with the mass-surveillance issue, bringing Snowden into it and insinuating that this ruling would have an effect on that, which is just silly [1].

The whole "Company F" section is interesting (hadn't heard before that microsoft is challenging the statement that they were willingly providing user data to the NSA), but it's a bit hard to square with the leaked documents which list microsoft as the first participating partner in the PRISM program [2]

[0] http://www.geekwire.com/2014/microsoft-defends-hotmail-snoop... [1] http://www.cbsnews.com/news/patriot-act-can-obtain-data-in-e... [2] http://www.motherjones.com/politics/2013/09/nsa-timeline-sur...

MichaelGG2• 11 years ago

Is there any evidence that any companies were willingly going along with PRISM? Seems like they were under gag orders and potential fines (Yahoo said $250K a day). Not sure what choice they had.

Though MS accessing user's data via Hotmail for internal review really does scuttle their credibility.

throwaway77675• 11 years ago

Is there any evidence that any companies were willingly going along with PRISM? Seems like they were under gag orders and potential fines (Yahoo said $250K a day). Not sure what choice they had.

I'm not aware of any evidence of their intent, no, just that they assisted in collection. I believe Glenn Greenwald has stated that they were a willing and proactive participant, but that that information came from NSA internal forums and not official documentation so it would not be released.

I don't think it really matters though. Whether they were willing or not, the end result is the same. If you don't trust the USG, you cannot trust US corporations (yes, of course this applies not just to the US but others as well; it's just that we currently have more information about the fiveeyes programs, and the US is a big player geopolitically so they have interests to protect in a lot of areas).

On an more personal level, I would say that even if they collaborated with this under legal threats, they are still morally responsible for their decisions to support the surveillance state. I cannot accept that we give people or companies a clean slate for evil just because they had financial interests to protect. Everyone has financial interests to protect, and it's usually more convenient to ignore evil than to put oneself at risk.

task_queue4• 11 years ago

You gain a lot: connections, contracts, insider information and special privilege if you play nice with the government.

If it's a secret program, what do they really have to lose?

ikeboy4• 11 years ago

Their statement says

In this case, there was a thorough review by a legal team separate from the investigating team and strong evidence of a criminal act that met a standard comparable to that required to obtain a legal order to search other sites.

I don't think that supports your claim that they would only ask a lawyer in the future.

throwaway77675• 11 years ago

Their statement says
In this case, there was a thorough review by a legal team separate from the investigating team and strong evidence of a criminal act that met a standard comparable to that required to obtain a legal order to search other sites.
I don't think that supports your claim that they would only ask a lawyer in the future.

From the link I included in my comment, Microsoft deputy general counsel John Frank is quoted: "As a new and additional step, we will then submit this evidence to an outside attorney who is a former federal judge. We will conduct such a search only if this former judge similarly concludes that there is evidence sufficient for a court order."

This lawyer (his past employment as a judge has no bearing here) would have been paid by Microsoft.

Could you explain how that does not fit with my earlier comment?

And to preempt the inevitable, yes, as I said in the original comment they eventually backtracked on this and said they'd report such future crimes to the police. You know, what they should have done in the beginning, and would have done if they had the respect for privacy-on-principle that they are now trying to shower themselves in.

snarfy• 11 years ago

If they lose, the solution is of course to re-incorporate outside of the US.

dpark2• 11 years ago

Is that a working solution? Does the US government claim jurisdiction over US corporations or over corporations operating in the US?

kalleboo• 11 years ago

Microsoft, Apple and Amazon can probably afford to buy themselves their own nice little Caribbean tax paradise and write their own laws...

harrumph2• 11 years ago

Agreeing "for once"?

Hardly. Apple and Microsoft are already on record as agreeing to fix wages, creating a cartel affecting a million tech workers.

https://pando.com/2014/03/22/revealed-apple-and-googles-wage...

alyx• 11 years ago

You mean Apple and Google.

harrumph2• 11 years ago

I mean Apple, Microsoft, Google, et al.

warfangle2• 11 years ago

And because tech workers see unions as evil....

task_queue4• 11 years ago

I'm a 10x unicorn making 1x salary. I don't need a union.

walterbell• 11 years ago

The pending TISA trade treaty may limit data sovereignty, http://www.zdnet.com/article/wikileaks-leak-shows-data-sover...

"50 countries including Australia and the US may be signing away rights to ensure sensitive customer data remains in its country of origin ... the draft document reveals that the United States and the European Union are pushing to prevent signatory countries from preventing the transfer of data across nation borders."

doguozkan• 11 years ago

First thing that came to my mind when I read the headline: "Google has to go."

jheriko• 11 years ago

this is sad. for all the misguided hate against the US there is a lot of very justified hate that comes from these sorts of attitudes coming from its government and enforcement agencies. they should have more respect for the laws of other countries, especially somewhere like Ireland which could, not unreasonably, be called a crime free paradise compared to the US.

its terrifying when law enforcement doesn't understand the difference between right and wrong...

serge2k• 11 years ago

Microsoft has lost twice

No kidding, they are trying to convince the US to recognize that they actually have limits on their power outside of the country.

downandout• 11 years ago

Of course this appeal will fail. The US believes that it has jurisdiction essentially everywhere. One need only look at the FCPA (Foreign Corrupt Practices Act) to see this firmly held belief in action. The US Government is increasingly using it [1] to prosecute people and companies it simply doesn't like by punishing conduct that occurs outside the US that in many cases has no effect on any US citizen or company.

That said, if you're a high level drug trafficker, and you're not at least using PGP, you deserve whatever you get. This is Darwinism at work. Even normal, non-criminals should be using the strongest encryption they can get their hands on, because no one knows what kind of conduct the government will seek to punish going forward. Prosecutors get more creative every day in applying our extremely broad laws to increasingly wide swaths of behavior.

[1] http://www.fcpaprofessor.com/a-focus-on-doj-fcpa-individual-...

skaushik92• 11 years ago

Interesting side note... the author must have originally called this something along the lines of: "As Microsoft takes on the feds, Apple and Amazon watch nervously" or something like that, since the link to the article is "as-microsoft-takes-on-the-feds-apple-and-amazon-watch-nervously".

unics• 11 years ago

Not to change the subject but why does this sound like Gibson Guitar all over again? National law vs External laws = sovereignty?

A Case That Has Microsoft, Apple and Amazon Agreeing

Related Stories