Proposed Jail Time for Tech Companies Who Steal Data

https://trofire.com/2019/02/08/democrat-proposes-jail-time-for-tech-companies-who-steal-your-data/

by badrabbit • 7 years ago

261 200 7 years ago

Wyden seems like he's been on top of the ball recently.

maxxxxx6• 7 years ago

Wyden is one of the few people in Congress who seems to make a real effort to address difficult issues in balanced and reasonable way.

bitxbitxbitcoin• 7 years ago

S.420 is another good example of Wyden being on top of the ball recently.

vjeux2• 7 years ago

“Oops, we didn’t notice, but it’s another to be a company like Facebook that takes your private messages and sells that data. It takes your address, it takes your interest, it takes your browsing history and sells that to people without your permission Wydens.”

Does anyone know what context he refers to? I wasn’t aware that Facebook ever directly sold private messages. Same for address, interest...

simplecomplex7• 7 years ago

They don’t. It’s just part of the privacy and Facebook hysteria being pushed by the rage-machine that is the news cycle now.

blub4• 7 years ago

When people start realising they've been getting proper fucked for more than a decade by the SV surveilance capitalism machine (led by Google and Facebook) they will get a bit hysterical.

I'd prepare myself for the incoming fines and regulation if I were you, instead of trying to do damage control.

crooked-v7• 7 years ago

They don't sell your private messages. What they actually do is just give them away to business partners.

https://www.nytimes.com/2018/12/18/technology/facebook-priva...

Facebook allowed Microsoft’s Bing search engine to see the names of virtually all Facebook users’ friends without consent, the records show, and gave Netflix and Spotify the ability to read Facebook users’ private messages.

simplecomplex7• 7 years ago

No, they didn’t “give it away”. Please let’s stick to facts. The news is being extremely dishonest. Apps that you could send FB messages through could see the message (how else would it work?) And it was explicitly opt-in, users had to authorize it.

“Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature.”

https://www.thewrap.com/members/2018/12/19/facebook-admits-n...

mimixco13• 7 years ago

Quit expecting governments to save you. The easiest fix for this problem is to stop using these products! No matter how much bad news comes out about Facebook, Apple, Google, and Amazon using your data in bad ways -- people still keep using them. If enough people quit, this will stop or a competitor will rise up who doesn't do this stuff.

Mirioron• 7 years ago

We should also demand for more control over what data our browsers send out.

crooked-v7• 7 years ago

"Let the invisible hand of the market fix it" is not something that has a history of actually working on near-monopoly actors.

maxxxxx6• 7 years ago

How do you even know who does bad stuff?

mimixco13• 7 years ago

Monopolies have to be propped-up by governments. No monopoly can survive in a truly free market. Never has; never will.

Power companies, cable companies, and telco operators are all monopolies propped up by government. An actually free market will always eliminate them when some competitor rises up with a lower cost, a better product, or better service.

There has never in history been a monopoly company that could operate in a free market without government support.

maxxxxx6• 7 years ago

Most people don’t know about these issues or don’t care. Also how do you know what company uses your data in bad ways? There are probably plenty of others who do shady stuff you never hear about. We need privacy laws so products that are on the market can be safely used. Otherwise let’s abolish food safety rules and tell people just not to eat at places where food with salmonella gets sold.

donatj2• 7 years ago

I think comparing food safety to data safety is comparing unlike types and levels of safety. No one has ever died from targeted advertising.

mimixco13• 7 years ago

If you have a Facebook account, you know their using your data in bad ways. If you don't know that already, that's on you.

As I've said before and will say again, a social network is not a human necessity nor a right. Delete your account and watch these problems go away in a flash.

anonymousab• 7 years ago

Governments are one lever through which society enacts changes upon itself. They are made up of the people themselves, after all.

It's no less valid than other ways for people to collectively pool influence to enact change (i.e. boycotts or forming other types of organizations).

mimixco13• 7 years ago

Governments are not made up of people; they're made of politicians. The most powerful dynamic in the marketplace is purchasing power. If you don't like something, quit using it and the company will eventually fold (most likely) or morph into something people want (far less likely).

vjeux2• 7 years ago

For the Equifax breach, most of the people affected didn’t have any direct relationship with Equifax. So this advice wouldn’t apply in that case.

mnm13• 7 years ago

Nonsense.

Can you provide a way I can get Equifax and similar companies to stop stealing and selling my data? I've been trying to do that for decades. No. Your argument is bullshit. I didn't sign up for this shit and neither did anyone else, yet we still got fucked. How do you propose we fix it now? The cellular companies are still selling my data. Should I not own a cell phone because I can't get a cell plan that won't steal and sell my data? The ISPs are selling my data. Should I not have an Internet connection? Yes, I can get rid of those, lose my job, be homeless and starve while I wait for the idiot masses to do the same so maybe a competitor could rise up. That's your brilliant solution. And it still doesn't deal with the fact that companies I didn't sign up with are stealing and selling my data.

simplecomplex7• 7 years ago

Equifax is a credit reporting agency. So, for example, someone gets a loan from a bank, then fails to pay it and the bank reports that to them. Other lenders check with them before lending to people.

You’re being disingenuous by equating that with theft.

mimixco13• 7 years ago

You can get out of the credit game. You can use a cell phone without a Google account, or buy one of the new open source ones coming to market.

No one needs a social network like FB. Just stop using it and they will go away.

mimixco13• 7 years ago

And actually, you did sign up for it. You might not have read it, but every credit app you sign gives them permission to do exactly that.

Do you need credit cards to survive? No, you don't. If you sign up, you get what you deserve.

While consumer credit is a useful service, Facebook is not. No one's life or business is going to be affected because they don't have FB. If you oppose their business model, simply quit and they will wither away and die.

Facebook will not be "a thing" in 10 years. If more people quit today, it could have a shorter lifespan that that.

foobandit• 7 years ago

This isn't going to happen while the problems are still theoretical. Few people care if companies have their data as long as it isn't used against them.

9080872• 7 years ago

These companies collect that data specifically to use it against you for their own financial gain.

olefoo• 7 years ago

I too wish I had the resources to go live in the woods and not deal with the modern world.

xorgar8312• 7 years ago

Or if we all get together and decide a company shouldn't behave in a certain way, that's another option. We call that government regulation when we everyone gets together to do that. You can think of it as voting with your money, just without the money part.

mimixco13• 7 years ago

Governments have never consisted of "everyone getting together." That's a myth that smacks of socialism. The best way to get the products and services you want (and wipe out the ones you don't) is to vote with your pocketbook.

With Facebook and other "free" services, you are the product -- not the customer. Stopping this is very simple; just don't agree to be the product anymore.

No one needs a social network. There isn't one compelling reason for anyone to join one unless you are a shareholder. You don't need the government to protect you from social networks or fix their ills. You need to delete your account and take personal responsibility for your complicity.

gpderetta2• 7 years ago

Exactly! For example I have hired a food taster to try my food, and I'm currently looking for someone willing to be a guinea pig next time I interview a bunch of surgeons for a job.

Of course I had the engineers stand under the bridge while my army was marching across.

fzeroracer5• 7 years ago

Facebook collects data on people that never even use or touch or go near facebook. How exactly do you stop using their product?

mimixco13• 7 years ago

Lots of companies that you've never used collect data on you. Look at the amount of junk mail you receive from people you've never done business with, and all of them have data on you.

This part isn't fixable. But by having an FB account and actively using the service, you become part of the problem. FB would not have nearly the market value that they do if no one used their product. Actually, they would have zero value.

Is there something in your life that requires FB so badly that you're willing to continue being their product? No, there isn't. You can still phone your friends. You can still text your family. There are plenty of other methods of communication without FB.

FB is not a communications tool, though they pitch themselves that way. They are a data gathering and advertising tool. If you agree to be part of that, that's on you.

sonnyblarney2• 7 years ago

"Quit expecting governments to save you. The easiest fix for this problem is to stop using these products! "

No, this is why we have regulations for cars, food, and everything else.

Free markets don't work well in most of these areas because information can't flow properly. If it did, markets might work quite well.

But they don't, and players cheat, so we need regulations.

mimixco13• 7 years ago

It might surprise you to learn that governments actually support monopolies and encourage them. A monopoly cannot exist in a true free market and has never done so in history.

uberman2• 7 years ago

You can't stop using Equifax, Experian, or Trans Union. While it is likely you can stop using Target, there are plenty of other retailers who have been the subject of data breaches.

Here is just a partial list:

https://en.wikipedia.org/wiki/List_of_data_breaches

When these companies have data breaches and loose your credit data into the public they should pay a real price. At the moment their penalty is offering you "a years worth of credit monitoring".

There is virtually no accountability for protecting this data yet your credit profile is used extensively for everything from getting a load, to rending an apartment, security and background checks.

mimixco13• 7 years ago

Stop borrowing money on credit cards. Live within your means and it won't matter what any credit card company thinks of you.

Here again, personal responsibility trumps government salvation every time.

edoo• 7 years ago

If a human would have gone to jail for the crime the company should have its charter revoked for at least an equal amount of time. Even the giants.

Usually at best a corporation gets a fine and it just becomes a cost of doing business. Everyone involved including the government profits from the crime.

mnm13• 7 years ago

About fucking time. Until legislation like this passes, nothing will change. I'm glad at least one of our senators has the balls to actually hold CEOs and companies accountable for their atrocious actions. This behavior should be criminal and this should be just the start. It doesn't make sense to send petty thieves to jail and hard labor, yet reward CEOs who cause millions or billions of dollars of damage to our society with gigantic resignation packages. These CEOs should languish in jail and find out for themselves what it's like to work for pennies a day. I'd bet any amount of money that once CEOs are actually held responsible for their reprehensible actions, things will change in regards to security and other overlooked practices. Once a company's profit and the CEO's resignation package can be clawed back with fines, these CEOs will think twice. Perhaps as a society we may rethink the idea of limited (in reality that just means nonexistent) liability corporations where even the officers who have the power of life or death over millions have no repercussions when they inevitably abuse and misuse that power to hurt and even kill people. That will probably take a lot longer, however. Until then, the best way to commit a crime and get away with it (including murder, poisoning, and other atrocious crimes) is still being a company executive.

plainOldText2• 7 years ago

  > ...including jail time, if their companies steal and sell user data, 
  > or allow a massive data breach to occur at their company.

What if the government loses our data? Then what? Will they go to jail too?

Software is a moving target. It has become such a complex endeavor, always changing, always evolving. It's difficult to determine who's responsible for which part of the system; and by this I'm not suggesting we abolish responsibility. Good outcomes will be the result of multiple forces, balanced in the right mix:

A. Users should ask more of their favorite companies (and mean it, e.g. boycott your favorite tech company when they behave unethically)

B. Legislators should be more mindful of the legislation they propose (for one separate data (re)selling from data breaches, and what exactly is my data vs data generated by machines, etc)

C. Reckless tech leaders should have their reputation affected by lose security, privacy & business practices

D. And engineers should be more aware their craft affects the lives of millions and maintain a high standard of quality across their work

In the grand scheme of things, we've just barely gotten off the ground with this thing called software. And software changed everything, but so did agriculture, which is 10,000 years old.

If we develop careless regulation and start throwing people in jail for software faults, we're hardly encouraging innovation.

donatj2• 7 years ago

Of course not. The government is never held accountable.

SiempreViernes2• 7 years ago

Yes, but they obviously can't all fit at once so they will have to take turns serving it, just like how all employees of companies are also collectively sentenced.

SiempreViernes2• 7 years ago

Seriously though, what sort of question is that, don't you have rule of law in your country?

gmuslera• 7 years ago

"loses"? What about collecting, and even forcing private companies to give them your data without telling you? What was disclosed on 2013 is still running.

The reason I don't think this will work is because the government and related contractors are major players on collecting, distributing and hacking private data. And if this works, it won't be because the government will stop doing it, but because want to control who else does.

9080872• 7 years ago

How many more decades does the "tech" industry get to continue using the "you can't regulate us because we're new and stuff, also innovation or something" line for?

I've been working in this industry for nearly 30 years, and it wasn't even "new" when I got my start. I can't help but laugh at people who act as though it just popped up last year. Is this just a result of young kids trying to convince themselves and others that they got in on the ground floor of something that existed well before they were born?

plainOldText2• 7 years ago

Software is unlike any industry we've had before. Software is now the craft of developing extensions of our minds, and it is evolving rapidly.

It's easier to delegate responsibility and enforcement rights to some higher authority, but since software is so complex, a much more powerful and robust solution in the long run is to embrace personal responsibility and agency. Complex systems evolve faster without or limited centralized control.

For example, the cryptocurrency space is already providing us with a playground where we can experiment with the next generation social systems. But like I've mentioned earlier, we're just beginning to scratch the surface and no one truly knows what will come next. But the beauty of it, is that we have the freedom to thinker, and figure out what works best.

Cyclone_• 7 years ago

What if a data breach happens due to an 0 day exploit with a 3rd party library? Do people from the company where the data breach happened still go to jail then?

foolrush• 7 years ago

In law, the term “negligence” usually plays an important role. “What ifs” have already been played out historically, which is case law.

sigfubar• 7 years ago

Double the term: once for the breach, and again for poor security review & architecture.

currymj• 7 years ago

as far as I can tell, this bill would only allow jail time if there was a serious breach, at a large company, and higher-ups left it out of an official report they would be required to make to the government.

in other words, all they have to do is fulfill their obligation disclose that they were hit by this 0-day, in order to at least be protected from jail time.

pm90• 7 years ago

Which seems like a reasonable policy IMO. Its encouraging companies to be forthcoming with their data breaches .... or else.

spydum2• 7 years ago

My guess is prudent man principal applies - did they have a reasonable plan to remediate once the 0-day was known? How would peers in the industry have been affected? If it’s truly a 0-day, and they followed reporting the breach, I don’t see it being likely.

You could argue a single 0-day should not result in a breach (security is best as a layered defense), but that’s probably far less likely to find.

https://en.wikipedia.org/wiki/Prudent_man_rule

srkmno7• 7 years ago

Pitchfork mobs dictating policy, that is why you don't elect an ex state attorney general to the legislative branch: prosecution and grandstanding is all they know.

Also the principle concept of "stealing your data" is more ludicrous than "stealing" in the copyright sense; that data is meta data and it's not yours, it was generated by machines you don't own and have no claim over.

crooked-v7• 7 years ago

that data is meta data and it's not yours, it was generated by machines you don't own and have no claim over

I'm pretty sure that, for example, the list of grocery brands someone buys using a store loyalty card isn't "metadata", and while "stealing" is hyperbole, I'm pretty sure most people would be upset upon realizing how far and wide that information is being sold.

smsm425• 7 years ago

People might be upset about a lot of things, the question is whether you have legal ownership on the knowledge about the facts about you. Can you sue somebody for disclosing true information about you as "theft"? Is writing a Wikipedia article about you means "stealing" your life facts? Does making your photo steal your soul? I'm pretty sure the only reason to use "steal" in this context is to hopelessly confuse the matter.

srkmno7• 7 years ago

Zealots would be upset sure but I'd argue most people won't.

A shopping list is metadata and the issue here is data ownership, you can't own a shopping list, you can't even copyright one, if you don't want it to be associated with you, you should be able to opt out, but no one should be burned at the stake for it.

rayiner• 7 years ago

I’m really enjoying watching tech transform before my eyes from regulatory optimism to hardened regulatory pessimism.

srkmno7• 7 years ago

Yeah let's restrict, ban and kill every new idea in it's crib, that'll surly make the world a better place, I'm happy you're enjoying your time in this entrepreneur community.

Let's also make sure all future gains are made by the lawyers and other middle men so that world peace will finally be at hand.

sonnyblarney2• 7 years ago

"it was generated by machines"

No it wasn't.

fzeroracer5• 7 years ago

Let's say someone really hates Facebook. What exactly is their recourse for them to say 'I don't want you to keep a shadow profile and I don't want you to sell or use that in any way shape for form'.

In that case, they're directly monetizing data about me as a person.

throw23421• 7 years ago

That person can simply choose not to use Facebook.

smsm425• 7 years ago

Let's say person A really hates person B. Does A have a legal right to ban B from recognizing A on the street?

There are laws against stalking in the US, which define stalking as:

engaging in a course of conduct directed at a specific person that would cause a reasonable person to:

(A) fear for his or her safety or the safety of others;

(B) suffer substantial emotional distress.

If you succeed in proving that Facebook tracking causes you substantial emotional distress, and that would be the case for a reasonable person too, you might have a case here.

boudin• 7 years ago

I wonder if it is possible to licence myself, the same way a software, for example, is licenced. Meaning that any company like facebook monetizing data whithout any agreement between me and them would fall under my licence. I have absolutly no legal knowledge and i have no idea what could be enforced this way. I'm also sure that nothing could be done by one person because of the need to lawyer up to enforce anything... But if it could be possible and would gain enough momentum, I'm thinking it could be quite an interesting thing to do.

chatmasta• 7 years ago

I really love the simplicity of this argument. If you generate the metadata, you own it, no questions asked.

ajkjk• 7 years ago

It's a simple principle, but since it makes the world shittier, let's not adopt it.

sperm• 7 years ago

This would enable a black market for the data, at which point good luck regulating

AlexandrB• 7 years ago

What does "you generate the metadata" mean? If an app on my phone "generates metadata" I own it under this principle. Likewise for code running on my computer.

xorgar8312• 7 years ago

it’s one thing to just be bad at your job and you leak a bunch of data and oops, you didn’t notice that a hacker was in your system like a Kofax for months.

Na, I'm tired of these excuses too. Maybe jail is too extreme in this case, but being sloppy isn't ok. Or not supporting MFA when you're dealing with financial data.

Animats• 7 years ago

A tough interpretation of the existing US Computer Fraud and Abuse Act, which has criminal penalties, could do much of that right now. See the "exceeds authorized access" provisions. Any slip-up in asking for permission could place a company stealing your data in serious legal jeopardy.

solomatov2• 7 years ago

I am not a lawyer, but vague laws are unconstitutional, so, your interpretation is highly unlikely to pass scrutiny.

tarr11• 7 years ago

Is personal information really a kind of property, that can be stolen? If it is, aren’t we doing this all the time, any time we perceive anything about anyone?

How is this different than taking a picture of someone? The image is owned by the photographer, not the subject(s) according to current laws.

if I meet someone on the street, and record their name, the conversation we had, and the location where I met them, and their phone number, have I “taken their data”?

Do they have the right to demand that I not record that information?

Does my perspective or interpretation of that information give me some ownership to that data?

What if I use that information for commercial gain? Is that what makes this illegal?

Or is it only if I do this at a scale beyond which humans are not capable, and store it digitally, is that what makes this illegal?

coldtea2• 7 years ago

Is personal information really a kind of property, that can be stolen? If it is, aren’t we doing this all the time, any time we perceive anything about anyone?

We are flexible and smarter than Vulcans. Something doesn't have to be necessarily expressible into a single, unambiguous universal formula to be made illegal.

We can e.g. allow people to perceive things about other people in their brains (or even notebooks) as we've done for millennia, but not allow them to compile them into large aggregated digital databases of thousands or millions of people without their consent, or give them to advertisers.

How is this different than taking a picture of someone? The image is owned by the photographer, not the subject(s) according to current laws.

Depending on the jurisdiction, taking an image of someone can be illegal. Sometimes, even if it's a public space. And using an image of someone to advertise stuff without their consent is illegal, including in public space.

wbl• 7 years ago

Rule of law demands it be clear what is and is not illegal. Make it illegal to film people in public and the guy who made the Rodney King tape is going to jail.

paulddraper3• 7 years ago

Something doesn't have to be necessarily expressible into a single, unambiguous universal formula to be made illegal.

It doesn't have to be expressed with a precise mathematical formula, but it does need to be expressed with a clear legal formula.

Otherwise, people cannot know whether or not their actions are legal, and the law becomes a fearsome weapon in the hands of its interpreters.

---

EDIT: I'm not claiming it's impossible for such a rule to be formulated in this case; I merely point out that clarity is absolutely necessary.

simple_phrases• 7 years ago

How is this different than taking a picture of someone? The image is owned by the photographer, not the subject(s) according to current laws.

There is no reasonable expectation of privacy in public.

Meanwhile, advertisements and depictions of people who have unlicensed but copyrighted images tattoos on their person open up those who distribute media with their likeness to lawsuits by the owners of the copyrighted material.

quicklime• 7 years ago

I'm reasonably comfortable with a company keeping records of its interactions with me, as long as they're taking proper precautions to keep it secure.

Where I draw the line is when they start sharing it with third parties, especially without my consent.

fhbdukfrh• 7 years ago

Here's the rub though, what is the definition of "reasonable"? How about "record" or critically, "interaction"? Does browsing a web page allow them to build a shadow profile under the guise of recording an interaction?

Funny enough, the thing you object to is usually the one thing explicitly spelled out in ToS that they are allowed to do with your information

jashmatthews• 7 years ago

This analogy breaks down immediately in other countries.

In Germany, people have some claim to the copyright of their own image, much in line with the German view that you own your private information.

https://www.co-berlin.org/en/watch-out

bsder4• 7 years ago

How is this different than taking a picture of someone? The image is owned by the photographer, not the subject(s) according to current laws.

The photographer may own the image, but the subject may also need to sign a release for the photographer to monetize.

if I meet someone on the street, and record their name, the conversation we had, and the location where I met them, and their phone number, have I “taken their data”?
Do they have the right to demand that I not record that information?

In some US states, yes. Many states have what is called "two party consent" and you cannot record a conversation with a device unless both parties agree.

Or is it only if I do this at a scale beyond which humans are not capable, and store it digitally, is that what makes this illegal?

There are many different factors. However, one of the big ones I would put forth is if I don't ever interact with your service and you still have a profile on me.

My friends tag pictures on Facebook. This means that Facebook now has a profile on me that I did NOT consent to. What is MY recourse?

paulddraper3• 7 years ago

What is MY recourse?

Your first statement would imply that the photographer has some responsibility to gain consent for the picture and its use.

ggggtez• 7 years ago

It's already illegal to take certain kinds of photos. For example, upskirt photos or bathroom/locker room photos. The victim may never know the data was captured, but a crime still occurred.

xkcd-sucks• 7 years ago

If only people all believed that getting photographed steals your soul. Tongue only partially in cheek

indigochill2• 7 years ago

If we consider laws around privacy in meatspace, then here's the common dividing line (according to my memory of an information law class I took something like eight years ago):

If someone is in a public space (such as a park) and you take a photograph for instance that happens to include them in it, then you're not violating their privacy. If they're in their home and you photograph them through their window, that is a violation of privacy because there's a legal expectation of privacy in a private residence.

People are going into the digital equivalent of a park and getting upset when data collection happens there which happens to include them. What happens with that data (selling to advertisers, etc) is not really relevant to the legal privacy discussion. They gave away their data by participating in a public space.

It's sort of like if some organization running public CCTV systems decided to sell recordings of public spaces they covered to advertisers (or heck, even data extracted from those recordings using facial recognition). Creepy? Sure. But not a violation of privacy as such since there is no legal expectation of privacy in a public space. (Incidentally, I'm not sure about the legal details of this specific example, but the point is privacy is dependent on location)

The conclusion, then, is that people who care about legal protection of their privacy online should own the platform where they communicate, such as by hosting a Diaspora pod.

evgen• 7 years ago

If you go into a park and take a picture of the park that has a person standing in the distance and then sell that picture then you have committed no crime.

If you follow someone around the park constantly taking their picture and then decide to sell the ones that look the best without either the permission of nor compensation for the subject of your photo then they have a legitimate claim against you.

People are not getting upset that they are being photographed in the park by someone who is an enthusiast about outdoor architecture and park planning, they are getting upset that the digital paparazzi are recording every footfall and selling it without permission. The idea that this data collection is not something that can or should be regulated is perverse and thankfully the general public is coming around to this viewpoint.

NeedMoreTea• 7 years ago

How is this different than taking a picture of someone? The image is owned by the photographer

I think there is a good argument that this is often not just. The iconic image of many events may have the victims preferring not to be that iconic representation years later. They may want their life to be known for them, not a moment long past. For the most obvious example, the famous image of a child running during the Vietnam war[1]. She's famous for being terrified of a napalm attack against civilians and allied forces. The photographer gets to decide if it may be reused, and he will, where it's proved to be his meal ticket. There's many less significant examples of where resting with the photographer is inappropriate.

Rights resting with every subject would raise its own, different problems. I'm not sure how to improve the balance without unreasonably restricting the freedom to take perfectly reasonable snaps.

if I meet someone on the street .. right to demand that I not record that information

They should, unequivocally. I can walk past a person with clip board taking a survey. I prefer unannounced recordings to be left to authorities and journalists.

Does my perspective or interpretation of that information give me some ownership to that data?

Nope. If it's about me, I care not what you are trying to interpret from my eye colour, location and my presence in a shop. Just whether I have agreed to your monitoring of me, or whether you are one of a limited number of exceptions. Which seems to be the sensible starting point of GDPR.

What if I use that information for commercial gain

See above. Makes no difference, other than hugely reducing my sympathy for its collection. I don't care if it concerns 10 or 10m if it's without informed consent (no dark patterns etc).

[1] https://en.wikipedia.org/wiki/Phan_Thi_Kim_Phuc

Shivetya• 7 years ago

First off, I think the proposal is one of those "looks good on the surface but is dumb when the details come to light". Simply put it is too vague and borderline an election campaign trial balloon, meaning we will see similar on someone's platform.

However the real kicker here is, if they hold private companies to this then how do they excuse the government from similar actions and how does a law assigning this level of protection and declaration of personal property not affect law enforcement? In particular in that your phone/email account/etc has no rights even though your data is there.

If this does get somewhere, what if companies choose to encrypt it all and when stolen it is just encrypted. does the government demand the keys at all times?

desc• 7 years ago

The problem, as always, is externalisation of costs.

If they don't pay for the consequences of the risks they take (such as prioritising profits over security, etc) market forces demand that they take those risks.

People talk about the market fixing things, but that only works if it's not possible to externalise costs.

Unfortunately, the only practical way to enforce that is through government regulation.

The government is also a system which seeks to externalise costs...

leroy_masochist• 7 years ago

There is no reason why any person on Capitol Hill should vote against this.

If I were an elected official, one reason why I would be very cautious about voting for this is that, if we make allowing a data breach a felony punishable by imprisonment, it is likely to have a somewhat chilling effect on the likelihood of engineers to start new companies where they as founders would be potentially prosecutable for such failures.

I share the author's stated frustrations, and agree that jail time for gross data-related negligence would be right at least in some cases, but it's not the simple problem-simple solution issue he's making it out to be.

crooked-v7• 7 years ago

it is likely to have a somewhat chilling effect on the likelihood of engineers to start new companies where they as founders would be potentially prosecutable for such failures

You seem to think that's a bad thing, for some reason.

chillacy5• 7 years ago

Perhaps some of us browsing HN, a site by a venture capital firm in the bay area, might want to consider the effects of legislation on tech startups.

thekyle• 7 years ago

Well, less competition is generally considered to be a bad thing.

rfrey• 7 years ago

A chilling effect on the likelihood of engineers to start new companies whose business model is the collection and monetization of user data, to be a bit more specific.

smsm425• 7 years ago

Looking at actual bill, it proposes:

- Creating a paid "no tracking" option. Obvious failure mode: the option price is $100M, and anybody who uses it is unable to use 99% of the functionality, since it requires some form of tracking. Obvious next step - the law requiring this option to be no more than 10% more expensive than regular membership. Obvious next failure mode: inapplicable to sites that do not charge for membership. Obvious next step - creating a government commission empowered to decide what sites are supposed to charge for "no tracking" membership and which services it is supposed to cover. If you like your site subscription - you can keep your site subscription.

- Penalize large companies that submit false information in their annual privacy report - thought submitting false information to any government agency is a crime anyway? And for a public company, I assume publishing almost any false report would immediately put them under the shadow of fraud charges from SEC. So declaring something that is already a crime a crime again is supposed to... what?

- Require companies to assess their algorithms for accuracy, fairness, bias and discrimination. Obvious failure mode: who does the assessment? Obvious next step: creating a government commission empowered to approve algorithm fairness assessment standards. Obvious failure mode: since nobody knows what "fairness" it, it turns into another partisan tug of war, to be used as a club against companies affiliated with opposite tribe or just representing a good jumpstart to the next political campaign. Reasonable academic discussion of algorithmic bias becomes impossible, buried under layers of partisan tribal rhetoric and professional offense miners. Billions are spent annually on "bias prevention", without any shade of solution on the horizon, on the contrary, the problem becomes worse every day - at least if you're listen to bias prevention industry, but they're the only ones who are allowed to speak on the topic.

bsder4• 7 years ago

It's easy to complain, but the problem is that status quo ISN'T WORKING. That's no longer on the table.

So, you either have to come up with something constructive, or someone else will.

smsm425• 7 years ago

That's called "politician's fallacy" - "something needs to be done! This is something, therefore this needs to be done!".

Obvious comment on it is that "something" must improve the situation after being done, merely doing something that doesn't work because current situation doesn't work is not likely to make it work.

And if you're implying I have to right to criticize stupid proposals from politicians before I myself am elected into political office and make a full-formed policy proposal that solves all the problems - sorry, it's not how this thing works.

JacobJans• 7 years ago

The great irony here is that people have no issue stealing data -- copyright theft is considered "normal" by many people.

However, if it's your data, then maybe jail time should be on the table?

majewsky• 7 years ago

Yes, because the potential damage is much more severe. If someone pirates a movie, the damage is about the price of a movie ticket. If someone's private data gets stolen, it can ruin their entire life.

Dylan168074• 7 years ago

It's not irony. It's you being willfully blind to the difference between "this has copyright" and "this is personal data". Those two aren't even similar!

scarejunba2• 7 years ago

It's not "stealing" because the data isn't being taken away. It's "copying".

donohoe• 7 years ago

I love how we understand the value of intellectual property, but when we talk about private personal information we are unable.

skybrian2• 7 years ago

It's strange how some people think that gossip and intellectual property are somehow the same thing. You have no right to be paid when people talk about you.

chillacy5• 7 years ago

But I think everyone understands that it's shitty to be on the receiving end of gossip, especially if the rumors are untrue or can be used against you.

ilovecaching• 7 years ago

Putting people in jail is the wrong solution. You're going to put CEOs in jail because some angry employee at the company decided to add some backdoors, or someone in middle management made the wrong call. Either way, the CEO and high level execs can't constantly monitor every part of a world scale business. Anyone in technology also knows it's impossible to become invulnerable to breaches.

The people in congress/senate have no idea how technology works, because the younger generations are severely underrepresented, and so are technologists.

badrabbit• 7 years ago

Laws are usually clear about criminal intent. If it was done without the CEOs knowledge,the CEO would not be liabel.

escape_goat• 7 years ago

Most of the responses so far seem to concern themselves with law and policy rather than technology. It might be a bit more on-point to complain that the people in technology have no idea how laws or legislation works, perhaps because the older generations are severely underrepresented, as are lawyers/legislators.

E_Quivocation• 7 years ago

I was going to laugh at how stupid this sounds, but, then again, It would be cool to see corporate overlords suffering a comparable level of punishment for the equivalent of peer-to-peer MP3 file sharing.

Bonus points if we can write a law for something like genetic profiling, or abuse of facial recognition, or microphone eavesdropping that becomes the corporate equivalent of internet child pornography, and carries the death penalty for C level officers.

Perhaps by way of equivocating that voice, face and gene surveillance endangers the privacy of children because it is indiscriminate like chemical or biological weapons, so life in prison and capital punishment for upper echelon high command at the Nuremburg trials.

solomatov2• 7 years ago

If you are interested in a text of the bill, one of its drafts is available here: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...

Proposed Jail Time for Tech Companies Who Steal Data

Related Stories