Senator Wyden Letter Confirms NSA Is Buying US Persons' Data from Data Brokers

https://www.techdirt.com/2024/01/29/well-thats-everyone-senator-wyden-letter-confirms-the-nsa-is-buying-us-persons-data-from-data-brokers/

by rntn • 2 years ago

427 214 2 years ago

techdirt.com

miga• 2 years ago

While upsetting civil rights, one cannot leave commercial data brokers unmonitored by agencies.

If only because they should be able estimate risk of and prevent criminal activity on home soil.

lettergram2• 2 years ago

one cannot leave commercial data brokers unmonitored by agencies

That’s a feature haha. The largest lobbies are banks and organizations using those data brokers. The government leaves them alone, so they too can use them. It’s a way around laws.

jrmg• 2 years ago

I don’t really understand why it’s so much more controversial that agencies are buying commercially available data than that the data is being collected and made available to anyone that will pay in the first place.

treyd2• 2 years ago

Because Americans are so terrified of government that they can be completely okay with something terrible as long as it's private corporations doing it (and so, theoretically, you have the ability to not be a customer of that corporation) and not the government. Even if in practice your data is still being collected by that corporation indirectly or all of their competitors are also collecting and selling your data.

RobRivera• 2 years ago

Oh am I?

macspoofing2• 2 years ago

Because Americans are so terrified of government that they can be completely okay with something terrible as long as it's private corporations doing it

That's not it. I think it is perfectly reasonable to set up a government with constraints and a culture of respect for the citizenry. It isn't about trust or no trust in 'government', because government is made up of individuals, and individuals have all kinds of motivations. I generally trust the government, but I am aware that any specific policy or decision can be a corrupt action for the benefit of some individual within the beurocracy.

anon2914• 2 years ago

Private corporations in America regularly go bankrupt, lose tons of money, go out of business, go defunct, etc. The government does not. It's just not the same thing at all. Private corporations can be dissolved by government action. They can be handled much easier than the government.

bell-cot2• 2 years ago

My guess is that domestic spooks buying the data is a threat to many people's "Just Pretend"-privacy armor. If Larry's Lawn Care, Esther's Escort Service, and 47 assorted mafias and criminal gangs buy my data...well, other than more spam, what are they actually gonna do with it? (Or so I can tell myself.) Vs. the FBI & local cops & such might dig through my data and [danger music] find something, or start doing creepy targeting of me, and they are the law, with power to do whatever they want...

anonym292• 2 years ago

Your "anonymized" cell phone GPS data can be used pretty easily to determine when you're not home for purposes of burglary.

Your household size and firearm preferences data can tell a rapist how easy of a target you will be.

Your genetic information can be used by insurance companies to secretly deny you coverage for pre-existing conditions, even though this is illegal.

Your genetic information could also cause you to be targeted by racists.

Your sexual preferences could be used against you as blackmail if the government or cultural moment shifts away from tolerance and they become unacceptable.

Your purchasing habits could cause you to become a prime suspect for a terrorist who used those same items in your area for a recent attack, like if your wife was buying a pressure cooker while you were buying backpacks for your kids doing back to school shopping.

I know a lot of these sound crazy, but consider this: the fact that they sound so crazy would itself make you sound less believable to others if anyone ever did victimize you any of these ways, furthering their odds of being able to perform that successfully without repercussions.

bayindirh• 2 years ago

It's not the action of buying the data, but the action of buying data on people you're not supposed to spy on, plus the technical capabilities of the NSA which raises the question of what the heck are you doing all this data plus the data you collect covertly with methods you don't tell, and what are the consequences of this on personal, national and community level?.

oatmeal12• 2 years ago

It should be obvious. The government can use information to prosecute people. Corporations can't. The government is much less accountable than corporations for malicious behavior due to sovereign and qualified immunity.

austin-cheney11• 2 years ago

NSA is not law enforcement, neither is the Census Bureau and they do not require a warrant either even though they collect far more data.

bearjaws• 2 years ago

Credit report crashes 400pts due to them finding what you said on a forum when you were 14
no judge, jury or trial
try to live in America

I'd argue corporations persecute people far more often than the government does. e.g. when credit bureaus find out you have cancer your credit score drops at least 100pts.

JohnFen9• 2 years ago

The government is much less accountable than corporations for malicious behavior

I disagree with this assessment. I think it's the other way around -- corporations are held much less accountable than the government.

But neither are being good actors here.

macspoofing2• 2 years ago

The government is supposed to play by different (more constrained) rules because it has a monopoly on force.

I don't know what the legality of the NSA buying private data is, but it feels like it violates the spirit of the law that says they shouldn't be spying on their citizens.

ilovetux2• 2 years ago

it has a monopoly on force

I don't think this is true. These guys are still around[0] even after garnering their bad reputation.

[0] https://pinkerton.com/

gruez4• 2 years ago

The government is supposed to play by different (more constrained) rules because it has a monopoly on force.

How is this relevant when the government is purchasing the data on the open market?

but it feels like it violates the spirit of the law that says they shouldn't be spying on their citizens.

No, the spirit of the law is that the government can't use its monopoly on violence to gather evidence.

fusslo• 2 years ago

I'll take a crack at a couple possibilities

well, first, companies having this information is inherently not ok to the average person

Second, agencies are purchasing this information with taxpayer money. So we're feeding a market that we may not agree with

Third, government agencies have rules, and when these agencies skirt around the rules or find loopholes, it has a negative effect on that agency. Generally, a population wants their government to have a good reputation and agents of the government are following the rules.

Fourth, and I think this may be the most important: government agencies have the authority and power to do things private companies cannot. government agencies can launch investigations, get legal advice from prosecutors, indite, get warrants, supena, arrest, detain, etc. All are invasive, expensive, and may result in a range of bad things (from paying lawyer costs all the way up to prison).

dgfitz• 2 years ago

well, first, companies having this information is inherently not ok to the average person

I sincerely disagree. The average person doesn't care. They should, but they absolutely do not. Don't fall into the hn-bubble trap.

Second, agencies are purchasing this information with taxpayer money. So we're feeding a market that we may not agree with

If I had a nickel for everything the government did with my money that I disagree with I could quit my day job.

Third, government agencies have rules, and when these agencies skirt around the rules or find loopholes, it has a negative effect on that agency. Generally, a population wants their government to have a good reputation and agents of the government are following the rules.

Generally, a population just wants to be "fat and happy" and secure. You're falling into the HN bubble trap again.

Fourth, and I think this may be the most important: government agencies have the authority and power to do things private companies cannot. government agencies can launch investigations, get legal advice from prosecutors, indite, get warrants, supena, arrest, detain, etc. All are invasive, expensive, and may result in a range of bad things (from paying lawyer costs all the way up to prison).

Sure. Otherwise what's the point?

abeppu• 2 years ago

The last step of the journey we're on is when individuals taking steps to limit the data collected about them by corporations are charged with obstruction of justice because the government cannot buy enough data about them.

mightybyte• 2 years ago

In short, the government is special because of its broad sweeping power to make laws that impact everyone. For example, consider the first amendment: "Congress shall make no law...abridging the freedom of speech". This applies to the government but not, say, to a third grade classroom rule against using curse words. It's perfectly reasonable for a private group to ban certain kinds of speech because if you don't like it, you can go somewhere else. But much more care must be taken when you're operating in the sphere of laws and government actions.

Another way to put it...the government is the only entity in society with a monopoly on the use of force. With great power there should also be a great degree of responsibility.

2OEH8eoCRo0• 2 years ago

They don't want the govt to be able to do that but they also don't want to cut off the money faucet for data brokers.

Personally, I think that if data brokers have it then it is essentially public information. What makes the public information from data brokers different from other public information like your address?

conductr• 2 years ago

Idk, I get your point but... Imagine a world where I could visit a site or ask a gpt to use the only thing I know about you, your apparently obfuscated HN username, and then I could track you in real time. Because it knew your username’s IP address, which then knew your phone, which then gave me a feed of your gps coordinates, which then gave me live video/audio of any networked camera/smart home device you were in view of. There would be very little shadow over you that people couldn’t watch, or record for future scrutiny. Your employer, business associates, religious groups, neighbors, etc would know everything about you. This is just the tip of the iceberg, your search history and porn viewing preferences and everything else you consider private would then be connected to the username you hide behind.

That would be a bit creepy but I wouldn’t be surprised at all if NSA had the data to build this capability. Money seems like a decent but exploitable way to keep all this data from being stitched together privately

JohnFen9• 2 years ago

Because the government is doing this specifically to evade controls that are supposed to help keep us safe from governmental abuse.

But I do agree with your premise: it's a travesty that this data is collected and made commercially available without informed consent in the first place.

EasyMark5• 2 years ago

Private corporations can't imprison you (well not without government blessing) and take away your basic freedoms, the government can. Also, the Bill of Rights & Constitution is by and large meant to protect you from the excesses of government and not private citizens, regular laws are meant for that, mostly at the state and local level. That's always been the legal distinction in the USA

lettergram2• 2 years ago

Hasn’t that been pretty open since Snowden like 10 years ago?

Also, if anyone ever wonders how insidious the government is here’s food for thought — why does the US have such a crazy tax code? Quite literally all your life’s details give you small breaks on taxes - who you donated to, when you donated, why you donated. What property you own, what you did with it, new car? Is it an EV? Does it have power steering? Etc.

It would be far far easier to pass a flat tax or remove most breaks. Interesting enough, they want to track all transactions now to increase tax revenue

https://www.npr.org/2021/10/25/1048485043/irs-banks-taxes-fi...

https://www.cnbc.com/select/irs-600-reporting-rule-delayed/

But again, you don’t keep some of these $50 savings on taxes, then monitor all transactions. Unless it’s for something else

rayiner• 2 years ago

Because the US tries to micromanage people’s behavior through the tax code. E.g. it offers EV credits because they want you to buy an EV instead of a gas car.

HumblyTossed• 2 years ago

This. A lot of people don't understand this, but taxes shape behaviors.

xyzzyz• 2 years ago

I mean, I get why they would not understand it when the government micromanages companies by targeted tax breaks (called “tax loopholes”): they just hate companies and markets, and so they blame them for doing the exact thing the government wants them to do. But how can you not understand that the purpose of EV tax credits is to make people buy more EVs? That’s the whole point!

rblatz• 2 years ago

The issue is that it’s the NSA, they’re not supposed to be investigate US citizens. They are supposed to be foreign signals intelligence.

I’d fully expect the FBI or CIA to do this. I’m not even sure it’s wrong for them to do that. At least no more wrong than anyone else that buys it in order to advertise you.

BurningFrog• 2 years ago

That the NSA spies on Americans on a massive scale was revealed by Snowden in 2013.

There is no excuse to be surprised by it in 2024.

snarkyturtle• 2 years ago

What does "foreign" even mean in the internet? It's not like there are clear lines between plots of land. Everything is everywhere.

austin-cheney11• 2 years ago

That’s not completely correct. The CIA has the least reason to access this data as they are only charted for intelligence collection outside the US. The FBI is law enforcement so they cannot touch or view any of that data without a warrant else they could invalid all manners of data collection in many open cases.

The NSA is chartered to collect data on communications entering and leaving the US. Decades ago that was completely unambiguous but less so now. Their collection of data on Americans is not illegal depending upon what they do with it. That was the most revealing part of the Snowden releases: insider threats misusing NSA data collected on Americans for personal use.

willcipriano2• 2 years ago

The FBI is law enforcement so they cannot touch or view any of that data without a warrant else they could invalid all manners of data collection in many open cases.

https://en.m.wikipedia.org/wiki/Parallel_construction

hiatus2• 2 years ago

The FBI is law enforcement so they cannot touch or view any of that data without a warrant else they could invalid all manners of data collection in many open cases.

This is just plain false. It is a long-held idea in American jurisprudence that information given to law enforcement by third parties can be used so long as that information was not collected under the direction of the government. https://en.wikipedia.org/wiki/Third-party_doctrine

RcouF1uZ4gsC• 2 years ago

I think it would actually be a dereliction of duty if they did not buy the data.

If the data is available for purchase, they should buy and analyze it, if for no other reason than to know what everyone else knows.

Making the NSA intentionally blind to available data, seems like a bad thing.

ikjasdlk2234• 2 years ago

I mostly agree. If I were them, this acquisition would be to augment building a baseline of traffic and patterns of life so they can better identify anomalies in the future.

NegativeK3• 2 years ago

It seems like a dereliction of duty for the NSA not to go to Congress and scream about needing to close this gaping flaw in the security of our nation.

jensensbutton• 2 years ago

I cannot imagine being upset over this instead of the fact that data brokers can sell all this info in the first place.

uncletammy• 2 years ago

I cannot imagine not being furious about both, simultaneously.

That being said, one of these is the culmination of tens of thousands of tiny consent violations made by hundreds or thousands of immoral, largely anonymous villians.

The other is one enormous and brazen violation of the constitution, made by a government organization which is funded by citizens to protect and serve them.

Both violations warrant the strictest repercussions.

Andrex• 2 years ago

I'm at a low simmer of jaded yet annoyed with all of it.

flandish2• 2 years ago

What I don’t understand is how they tie data to a specific human in meatspace. Like my car - I own it but if you drive it, you get the speeding ticket.

But with data - sure this post is from a meatspace device registered in my name / but does not indicate I am the actual meatspace person using it.

hn_acker• 2 years ago

Consider public IP addresses. Geolocation can link an IP address to a region as imprecise to a country to a more precise region such as a city. Combining rough location to a few other data points can greatly narrow down meatspace candidates for a particular account [1]:

According to one landmark study, these three characteristics are enough to uniquely identify 87% of the U.S. population. A different study showed that 63% of the U.S. population can be uniquely identified from these three facts.

If you have a significant online presence, your gender or age might be revealed by the way other users address you on some website. If a website happens to collect gender or birthday, then the website might share/sell the info to data brokers.

If police manage to narrow down the location of a potentially incriminating online action to a household, then the police could physically show up with a warrant and ask about who was using which computer in the house at that time.

[1] https://www.eff.org/deeplinks/2023/11/debunking-myth-anonymo...

flandish2• 2 years ago

Oh for sure. I don’t disagree - it’s just so.. easily “faked” too. Nothing is anon but also nothing short of me showing a cop looking over my shoulder is proof positive.

dogman144• 2 years ago

Correlation across multiple signals, described here

https://restoreprivacy[.]com/rtb-data-leveraged-for-user-sur...

lumb634• 2 years ago

It seems to me that the government accessing, even if by purchase, information of citizens without probable cause is a violation, if not in letter, then in spirit, of the fourth amendment. I’d like to see an amendment to the Constitution to update the fourth amendment for the modern era, where a huge amount of information can be gathered about people without “searches and seizures”. The general issue of data collection is obviously one of the largest of our time, but I think most people would agree our own government should not be using our money (or debt) to legally circumvent our rights.

cyanydeez2• 2 years ago

seems to me, the upstream problem is data brokers.

zer00eyz• 2 years ago

You're not wrong, but the implied solution of no data brokers is gonna be a bad thing.

The information is out there, it's stupid easy to correlate and collate it. It's even easier to use that to do something profitable.

Getting rid of data brokers, making them not exist just makes a gray market for the information, one that is just as lucrative and is going to be untaxed and unregulated.

641a was the moment privacy died. We're not getting it back. We need to come up with a better method/idea...

toolz• 2 years ago

There are multiple problems here, but only one of those problems works for the US people. It's clear to me which problem should be most easily addressed with the highest impact for the effort.

We're talking about the difference in trying to influence arbitrary third parties behaviors and the difference in trying to influence the behavior of your own employees.

nonethewiser2• 2 years ago

But upstream of that is people volunteering their personal information.

nonethewiser2• 2 years ago

It seems to me that the government accessing, even if by purchase, information of citizens without probable cause is a violation, if not in letter, then in spirit, of the fourth amendment.

Tragically the 4th amendment is kinda narrow. I would definitely appreciate some additions which enshrine a more specific right to privacy. Protecting against "unlawful" searches (AKA you have to take the case to court afterwards) is far to close to meaningless. Feels like the 4th amendment is about 10% as powerful as it should be.

ajross2• 2 years ago

It seems to me that the government accessing, even if by purchase, information of citizens without probable cause is a violation

The fourth amendment is a prohibition on UNREASONABLE searches and seizures. What possible definition of "reasonable" would exclude "legally purchased on the open market"? What other perfectly reasonable techniques would you deny to law enforcement? Should they not be able to look at someone's LinkedIn? Look up their address in a phone book?

No, the constitution isn't going to protect you from the government doing what everyone else can. If we want this stuff not to be available for sale, we should regulate it.

lcnPylGDnU4H9OF2• 2 years ago

No, the constitution isn't going to protect you from the government doing what everyone else can.

That's actually it's literal intended purpose as far as I can tell. For example, my employer can make certain demands of my speech or otherwise punish me for my expressed opinions, while such behavior is explicitly forbidden from the government by the constitution.

c0pium• 2 years ago

Who are you more concerned about being able to query your LexisNexis report, the NSA or the domestic terrorists?

Unfortunately many (most?) people on here are in the advertising/data merchant business. You will never convince someone to understand a thing if their livelihood depends on them not understanding it.

prpl• 2 years ago

Going a step further, they can just pay another middleman to do the analysis and write up reports to generate information to execute reasonable searches and seizures.

abofh• 2 years ago

While I get your point, the constitution is fundamentally _about_ hamstringing the government in ways you're fully allowed to privately contract away. It's about saying the government may pass any and all laws within these guidelines -- that's why you can shout fire at the top of a mountain and nobody cares, but in a privately owned theater it's not a free-speech issue.

Or something like that - point is, if it wasn't doing anything wrong, why was it obscuring that fact through classification and NDA's until now - when as you say - it's public data that the government would (in your theory of constitutional law) be entitled to purchase?

troyvit• 2 years ago

Wyden's letter[1] is a lot more targeted than the Techdirt article. The letter says this:

"The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans’ privacy are not just unethical, but illegal,"

and refers specifically to an FTC order[2] that prohibits the government buying data from a specific shady broker (X-Mode Social).

He summarizes the letter on his own site without the editorializing that honestly I love so much about Techdirt.[3]

On a side-note, according to Wyden, 'Through this case, the FTC announced that Americans must be told and agree to their data being sold to “government contractors for national security purposes,” for the practice to be allowed.' I don't know how that's enforceable given how many hands user data goes through. Most organizations that suck that data up sell it to several third parties who can then sell it to whoever they want. All the NSA has to do is go a few steps down the chain.

So it doesn't matter. The NSA will continue, as you noted, to lawfully buy this data from third parties who are slightly less sketchy than X-Mode Social (what a name) and the FTC's toothless rule won't change a thing.

[1] https://www.wyden.senate.gov/imo/media/doc/signed_wyden_lett...

[2] https://www.ftc.gov/news-events/news/press-releases/2024/01/...

[3] https://www.wyden.senate.gov/news/press-releases/wyden-relea...

lumb634• 2 years ago

I see your point. Data collection is required to some degree to, e.g., prosecute criminals. Any agency tasked with law enforcement would use all means at their disposal to do that, and legally purchasing data on the open market does seem reasonable. I agree with you that the Constitution and laws as they are today are unlikely to find any issue with the practices in place. However, my interpretation of the spirit of the fourth amendment is that Americans should not have to tolerate their government (or its agencies) infringing on their privacy unless they are suspected of having done something wrong, which is why the purchase of data from data brokers seems wrong to me.

Personally, I would deem such means permissible to investigate someone suspected of having committed a crime. Where I find issue is the widespread use of such techniques to monitor for crimes, since they come at such a large cost to personal privacy, and are searching for a needle in a haystack. Millions will have their privacy compromised so that maybe a single criminal can be caught, and personally, that cost is too high. I understand some folks might disagree that, but I hope Sen. Wyden, and others who join forces with him or follow him, will continue to represent that idea, and pursue legislation to codify it in law.

tantalor• 2 years ago

They also use this to solve cold cases by scanning genetic databases for near matches.

https://www.nytimes.com/2018/10/15/science/gedmatch-genealog...

EasyMark5• 2 years ago

another thing that should also be illegal. You shouldn't be able to use a 3rd party (company) to break the law (4th amendment)

hammock• 2 years ago

Can’t you give a false name when you submit your DNA to those ancestry services?

mechhacker2• 2 years ago

That and the third amendment for stationing a "soldier" (tracking and data collection) in our home (phone). And it needs to be extended to monopoly involuntary "private" entities with known federal sweetheart deals.

gur485• 2 years ago

The same phone you voluntarily purchased, brought into your home and agreed to the terms of service on?

JohnFen9• 2 years ago

where a huge amount of information can be gathered about people without “searches and seizures”

Although in my opinion, the vast majority of this data collection and use absolutely counts as "searches and seizures" -- just by private corporations rather than the government. Which, in my view, is worse than if it were just the government.

psychlops3• 2 years ago

Which, in my view, is worse than if it were just the government.

Consider that no matter how evil the corporation, they can't seize your property or freedom. Be careful who you empower.

cj2• 2 years ago

I think there needs to be some kind of "responsible and clear disclosure" laws that require companies to very clearly and overtly disclose what data they're collecting and how they're using it.

Some kind of standardized "label" (something like the standardized nutritional facts on food products) that is easy for consumers to read and comprehend, not buried in pages of paperwork, without needing to read a 20 page TOS / Privacy Policy.

The legal problem is everyone is "consenting" to data collection by accepting a TOS which protects companies and makes it "legally acceptable". The real problem that needs solving is consumers are rarely aware of what they're consenting to. Companies might not hoover up and sell as much data if they were required to clearly tell everyone they're doing it.

Basically, let's get rid of this idea that agreeing to a 20 page TOS / Privacy Policy is legally binding when < 1% of people actually read what they're agreeing to.

tootie• 2 years ago

I doubt it. The data collected by brokers is going to all be indemnified by whoever collected the data. If they have all have posted privacy policies that include data collection and dissemination then it's fair game. I'm not sure the policies would even need to be airtight so long as the NSA and data brokers acted in good faith that they believed the policies were sound.

caseysoftware2• 2 years ago

This goes back to Third Party Doctrine.

It's the premise that once you give up data to a third party, you no longer have any "reasonable expectation of privacy" so therefore it's not a search.

There is similar case law backing up searching your garbage can. While it's up against your house (aka still under your control), you have rights to it.. once you put it on the street for the garbage truck to collect, you've surrendered those rights.

I'm NOT saying this is good or what I like - specifically, I hate it - but it's how it currently works under US case law.

Therefore, to change things, we need Congress to write new laws and/or new Amendments. Our opinions of "how it should be done" are irrelevant unless backed by the law.

Eji17002• 2 years ago

Yes but I think the courts would instantly shoot down having the NSA collect everyone’s garbage and sift through it for anything incriminating

kmeisthax3• 2 years ago

The funny thing is, when it comes to freedom of speech, the courts made the opposite decision with the State Actors doctrine. If the government wants to censor you, they can't reach through a private institution to do it. But the Third Party Doctrine says they can reach through a private institution to search and seize your property.

This is an arbitrary distinction chosen purely by judicial fiat. There was no democratic movement to strengthen 1A and weaken 4A/5A in this manner. Ergo, we shouldn't necessarily have to get Congress involved just to fix this weird inconsistency in caselaw. The courts have an understandable aversion to "legislating from the bench", but if you've already done so, I think it's fine to at least fix obvious mistakes.

voxic113• 2 years ago

Yeah certain information held by third parties is already protected by statute such as video tape rental or sale records, or emails held by a service provider for less than 180 days. There really isn't a reason why congress couldn't expand similar provisions to all or most personal data held by third parties.

https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Stored_Communications_Act

Projectiboga• 2 years ago

There is a whole subject called Garbology.

https://en.wikipedia.org/wiki/Garbology

electrondood• 2 years ago

I'd wager you could argue that it's not possible to participate in society without internet services, and that it's not possible to use internet services without divulging personal data.

It's practically impossible to avoid giving your information to a 3rd party.

gur485• 2 years ago

"Rights" - even those enshrined in the Bill of Rights - are trampled on daily.

Try traveling with a concealed firearm across state lines. Or telling a K-9 police officer they can't search your car after the dog has alerted. Or use your free speech privilege to spread alleged vitriol.

There's no such thing as "rights" - only what individuals can defend in the current place and time they're in.

tastyfreeze3• 2 years ago

Or simply having the audacity to travel on an airplane.

There's no such thing as "rights" - only what individuals can defend in the current place and time they're in.

I suppose that is the way it always has been. When the government was small people just didn't care what they were up to. The people became complacent and allowed a beast to grow. If the rights we are supposed to have keep getting trampled on revolution is inevitable. It may take a long hellish time to happen but that is one fork in the path we are on.

BobaFloutist3• 2 years ago

It seems to me that the government accessing, even if by purchase, information of citizens without probable cause is a violation, if not in letter, then in spirit, of the fourth amendment.

On the one hand, I fully agree. On the other hand, I also agree with the intuitive argument that it's very strange to let private corporations surveil and gather, buy, and sell information about citizens to exploit for profit, but then say that the government can't buy that same information for law enforcement and national security.

It feels wrong to say that it's fine for someone with only a profit motive to use private data in small, petty ways to extract more profit from someone that's already paid them, but that the duly elected representative government can't use it for big, important things. Or, if law enforcement and national security are too fraught, what about, say, public health policy?

The obvious answer is that corporations shouldn't have access to it either, but that's a much harder sell, and so we're in this weird limbo.

w42• 2 years ago

It feels wrong to say that it's fine for someone with only a profit motive to use private data in small, petty ways to extract more profit from someone that's already paid them, but that the duly elected representative government can't use it for big, important things.

We make this distinction all the time in areas like speech and searches, for good reason. The government is the only entity with near-omnipotent power over you. Corporations may be powerful, but they are ultimately restrained by the government’s monopoly on force; the government has no such restraints because it has the monopoly on force. It’s therefore reasonable and prudent to have different, more stringent rules for the government. If someone working for a corporation doesn’t like you, they can’t kill or imprison you (legally). Not so for the government.

With that being said, whether or not anyone at all should be allowed to collect or use this data is also a totally valid topic for discussion and disagreement.

kube-system6• 2 years ago

It seems to me that the government accessing, even if by purchase, information of citizens without probable cause is a violation, if not in letter, then in spirit, of the fourth amendment.

It is and always has been legal for other people to volunteer information about you to the police. Doesn't matter if they're operating a business or not.

I can call the police right now and tell them that lumb63 posted a comment on HN at 2024-01-30T14:14:13. If I had more detailed information, I could tell them that too, and they could legally listen to me. I could tell them literally anything that I know about anyone.

Why would that be illegal?

This situation doesn't have anything to do with the 4th amendment. The 4th amendment prevents the government from forcibly taking information.

godelski9• 2 years ago

The parent understands all that, you do not need to repeat what they said themselves.

Times change, so do effects and outcomes. Laws don't have to be fixed for eternity. It would be really dumb if they did. Fortunately a system was designed to update laws in accordance with a dynamic environment.

onionisafruit• 2 years ago

The article says this about the NSA:

It’s completely capable of engaging in domestic surveillance. And, indeed, it often does! So why would it need to purchase something it can obtain (more legitimately[?]) from its own dragnets and risk having part of its collection techniques exposed?

I don’t think the NSA needs to worry about adversaries learning the technique of exchanging money for information. Hacking the data brokers would cause more potential exposure of proprietary techniques.

kingwill101• 2 years ago

The irony here is that it's not been done by China or Russia. Why does it seem there's much less outrage if any when it's been done my local agencies?

__MatrixMan__3• 2 years ago

Because your tax dollars do not pay for the Chinese surveillance apparatus. Of course they're spying on you, that's their job.

Our country is ostensibly different than theirs precisely because we don't treat our citizens like enemies... as much.

bemusedthrow75• 2 years ago

HN should maybe try engaging with this with the same urgency and focussed outrage as they would if they were told the perfidious, unreconstructed Brits were doing it.

Something something US citizens something something unaccountable governments something something secretly breaking laws.

SEJeff• 2 years ago

This is not new. As an example, the US Department of Homeland Security has been known to use Web of Science to help them identify foreign born researchers working in the US tied to their home country militaries.

deadbabe• 2 years ago

Can we buy our own data from a data broker?

gorbachev• 2 years ago

I think I'd rather buy data about data brokers' executives.

NegativeK3• 2 years ago

Have a business address, get visited by a data broker rep to prove that you're actually a business, and then pay something like $10/person.

Pentest firms do this to show their clients the concerns around data brokers.

dhx• 2 years ago

"For example, such information is critical to protecting the US Defense Industrial Base" is not an overly convincing argument for purchasing "NetFlow"[1].

The US State department Exchange Online hack is an example of where "NetFlow" being purchased could be more interesting as an example. IP addresses such as those registered in Russia and to OVH data centres logging into State Department executive mailboxes at 3:00AM in US time zones should be laughably easy to detect.[4] Rented US virtual servers and AWS/Azure/GCP servers outside federal government availability zones would also be trivial to detect as suspicious source locations. The question that purchased "NetFlow" would help answer is what is connecting to those suspicious IP addresses, what is connected to those, what else do the chain of IP addresses found communicate with, etc.[5]

- Worst case there was no one was watching that attack as it occurred over ~4 months through use of "NetFlow" that may have been available and useful to use.

- Controversial case is someone was watching (possibly including attacker's use, if any, of US servers) and decided that it was better to keep watching and following the attackers than to immediately prevent a few State Department emails being leaked.

- Best case (not implemented) would seemingly be to fix terribly configured government systems so they can only be accessed from trusted locations and not random rented virtual server IPs, and "NetFlow" analysis is then probably not required. Security features such as "We've noticed your account is accessing this system from a new ISP--confirm this is really you?" aren't new.

[1] https://en.wikipedia.org/wiki/NetFlow

[2] https://en.wikipedia.org/wiki/DShield

[3] https://web.archive.org/web/20010205010100/http://dshield.or...

[4] https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...

[5] https://blog.torproject.org/traffic-correlation-using-netflo...

skywhopper• 2 years ago

Not surprised in the least, and yet I probably trust the NSA with the data more than literally any other customer of those data brokers. Not that I trust the NSA all that much.

zoklet-enjoyer2• 2 years ago

1. What can the average person do to avoid having their personal data collected and sold?

2. How would one go about creating fake data that gets collected and sold?

eszed• 2 years ago

1) Nothing.

2) This is a wonderful "Hacker-ish" approach to the problem: Pollute the Database! My fear is that in the real (ie non tech-hacker) world, whatever false data my dbPollution script put into the table dedicated to me would be used to target me, and that the argument "No, I didn't make [suspicious searches 1, 2, and 3] - this tool designed to make Law Enforcement's job harder did!" would not be a winning argument with a) Judges, and b) a jury of my normie "peers".

In theory I love it; in practice, it scares the shit out of me.

zoklet-enjoyer2• 2 years ago

I'm thinking there needs to be more tools like this https://www.bleepingcomputer.com/news/google/google-bans-adn...

Maybe it would be easy to sort through, but maybe not

WhackyIdeas• 2 years ago

What are Apple and Google doing to protect their Android and iOS devices from these data brokers? Or are they just allowing and making it easier for them? Why give apps the power to do these things, why not give the power to the person who bought with their hard earned money these devices - why not let them choose whether to allow an app to grab all the data they can?

mark_l_watson• 2 years ago

I wish in the US we had some form of privacy protection as in the EU. What the EU has is not perfect, but I wish we had it.

My understanding is that one man, Senator Chuck Schumer, blocks any meaningful privacy legislation in his committee. A one man privacy wrecking ball. I read somewhere that his two daughters have high paying jobs at, I think, Meta and Microsoft.

EDIT: my point is that if we had better privacy, then corporations would have less information to sell.

shutupnerd0000• 2 years ago

How are his daughters relevant to the point?

pnt12• 2 years ago

Could be a bribe: defend the interests of the companies, get some cozy jobs for your family in return.

nashashmi• 2 years ago

This is what Facebook was also doing. They were buying data from any website they could. (They made data buying a profitable thing because they knew they could use that for ad serving.)

If the US govt, if intelligence agencies are doing the same, are we calling this "illegal" or wrong? If so, why? If the US govt were to be doing this with a healthy dose of govt reach, then it would be a violation of law. But they are buying what is already available.

tastyfreeze3• 2 years ago

Making selling personal information illegal solves this problem. If there is no profit motive to collecting the data most companies will just not collect it.

pphysch2• 2 years ago

Trading illegal drugs is illegal, but entire black markets still exist for that purpose. Monitoring illegal transactions that have no physical footprint (unlike drugs) is very difficult.

tastyfreeze3• 2 years ago

If it is illegal to sell then ostensibly the government cannot legally purchase it.

mass_and_energy• 2 years ago

This is why Clearview AI and things like it are such a major threat to our privacy and security.

0xbadcafebee• 2 years ago

This isn't a surprise, is it? It's not illegal, and this is the NSA we're talking about. The people who hacked domestic corporations for chuckles. If it's not illegal, and it's surveillance related, they're doing it.

Wyden's demand that companies stop selling our data "without consent" is political bullshit. It just means the companies have to stuff a "you consent to X" in their ToS. Which nobody reads, so nobody will push back on. Business as usual.

joloooo• 2 years ago

Hasn't this been accepted with things like the Five Eyes alliance? https://en.wikipedia.org/wiki/Five_Eyes

mcny2• 2 years ago

The question we should be asking is with what money and on whose authority? Defund the NSA.

chiefalchemist• 2 years ago

Why is this a surprise? If the NSA et al is willing to break the law or at least bend it (a la Snowden revelations) why wouldn't they do something that is well within the law?

Are we really still this naive?

ChrisArchitect• 2 years ago

[Dupe] again from techdirt, wasting our time OP

Last week's news: https://news.ycombinator.com/item?id=39136770

Senator Wyden Letter Confirms NSA Is Buying US Persons' Data from Data Brokers

Related Stories