Hacker News new | ask | show | jobs
US startup Geofeedia 'allowed police to track protesters' (bbc.com)
136 points by xufi 3533 days ago
11 comments

What is special about these feeds? The Facebook data was only publicly available data; ie stuff I could get by going to the right page in by browser. Was it the same with twitter? Why is it bad for a government to aggregate public data? Not just public data, but messages I assume the writers intend to be broadcast to the world. Were not talking about private emails or messages here.

I'm not trying to defend what is happening in a lot of areas with the police, I am just genuinely curious about the nature and potential for impact of these feeds.

I'll bite.

> Why is it bad for a government to aggregate public data?

In the past, this has been problematic. There are several examples of government agencies using their authority to suppress political dissent. The Stasi in Germany, the KGB, Hoover's FBI. True, they had private data as well, but the problem wasn't the source of the data - it was that they used it for political suppression. It's clear that the agencies involved with Geofeedia would prefer the protesters just "go away" - they have no incentive to be supportive of their goals. Given the power imbalance and incentive misalignment, gathering information on them has an inherent smell to it, just from past experience.

While I can appreciate the slippery-slope argument against mass surveillance and bulk data collection, comparing municipal police with infamous clandestine federal investigative agencies borders on conspiracy theory. While I don't doubt that the police dislike like the criticism, it seems more likely that their strongest incentive is to keep the peace (specifically preventing the destruction, theft, assault, and murder that characterize so many of these "protests").
> While I can appreciate the slippery-slope argument against mass surveillance and bulk data collection, comparing municipal police with infamous clandestine federal investigative agencies borders on conspiracy theory.

If you look at the events of the last three years in the United States, municipal police have been much more aggressive in punitive actions against innocent people they perceive as inconvenient:

https://theintercept.com/2016/09/30/lawmaker-who-pushed-bill...

http://www.huffingtonpost.com/2014/08/03/ramsey-orta-arreste...

https://theintercept.com/2016/10/06/in-the-chicago-police-de...

This includes things like voter suppression at the request of the Republican party:

https://theintercept.com/2016/10/04/police-raid-indianas-lar...

> comparing municipal police with infamous clandestine federal investigative agencies borders on conspiracy theory

And yet: https://www.theguardian.com/us-news/2015/oct/19/homan-square...

Hoover's FBI is infamous because its practices were exposed. As we begin to look more closely at police departments around the country, we begin to see that there are many that end up using terrible tactics, and the only significant difference is that they're limited to their city and county borders.

One useful tactic that I use to give something "the smell test" is to reverse the targets. There have been cases where police acted improperly or illegally, so if this company was using cellphone data and aggregated social media data to let propestors know the identity and social media posts of all the police, would that be improper?

That feels wrong, so my "smell test" makes me also think that the other way around is wrong. Police should be acting on immediate actions of protestors, not potential actions based on some black box social graph algorithm that tells them who to arrest.

> if this company was using cellphone data and aggregated social media data to let propestors know the identity and social media posts of all the police, would that be improper?

Yes, but only because the protesters aren't imbued with any special authority over the police (besides participating in a representative democracy) nor trained to use such a power responsibly. The impropriety has nothing to do with the corporation or the technology.

So you argue that aggregating public data is still wrong, iff the publicizing party is an agent of an authority?

Would you then limit the impropriety to only those times when the agent is acting in official capacity upon that aggregating party, or do you think gathering social data about authorities should be blanket-banned until the aggregators take a class first?

In essence, I'm trying to figure out the implication of your use of the word "only". I suspect you intended it to qualify surveillance as a sanctionable, active operation, ignoring unordered or time-sensitive relationships and profiling.

No doubt the vast majority of police departments have good intentions.

But when the group protesting police malfeasance is then monitored by those same police in order to keep what those police consider to be the peace over them. And then they must rely on those same police not to target individual participants after the protest for retaliation, then that monitoring is obviously a very serious problem if the protesters be correct.

I really doubt that at this point. As a system, it's hard to ascribe good intentions to the behavior we've seen over the last few decades alone. The history of US policing is not a history of good intentions.
Yes, the history curated by sensationalist media and revisionist historians is dark indeed.
One issue is that Facebook makes it relatively difficult to clearly know what data is completely public and what is not, especially for casual users.

In addition, a lot of the data is geotagged in ways that are non-obvious to non-technical users.

If you're interested, a very similar article, from Ars Technica, was posted yesterday. We had a discussion on it at [1].

Geofeedia has since posted a response [2].

[1] https://news.ycombinator.com/item?id=12688548

[2] http://blog.geofeedia.com/a-commitment-to-freedom-of-speech-...

Thanks. I read the Ars article yesterday, but hadn't seen the response from Geofeedia.

I don't really buy that they have adequate safeguards against the police using this data inappropriately. Seems like a bold claim to me and requires further explanation. In the Ars story, they allege that as many as 500 different police departments across the country are using their data.

Based on this article at least, this doesn't sound like a big deal? It sounds like the service helped police discover when and where protests were happening. If bad cops used that information to illegally interfere with those protests (or the protesters themselves), that's obviously a bad thing, but that wasn't stated in the article.

I would expect good cops to also want that same information as part of doing their jobs. Protesting isn't illegal, but if a large group of people are legally gathering someplace to vent anger about something (anything really, it doesn't even have to be a political flashpoint), I would expect police would want to know about that too, for non-sinister reasons (like general awareness WRT potentially disruptive events happening in their city that day). To police who are just doing their (non-evil) jobs, protests are important to know about for the same reasons that it's important for them to know about any other potential sources of civic chaos that day (concerts, etc.).

It feels like the article presents the facts with an unstated assumption of "bad cops using intel for nefarious purposes", but if that's true, there wasn't any supporting evidence presented in the article.

Because in practice, cops use this sort of data to lock down protest sites, before the protests ever actually happen. People start attempting to congregate in a given area, and are immediately escorted out by police.

That forces protest movements to organize more and more potential protest sites, and have more and more logistical organization to gather people into same location.

It becomes an escalation of logistical requirements to even get people organized enough _to_ protest. When you add in the fact that police are also using social network monitoring (and I mean that not just in the online term of social network websites, but as in social network monitoring overall), and regularly use face recognition at protest events (I'm speaking mostly about nypd here), and what you're left with is the bitter truth that if the NYPD truly doesn't want you to have a protest, you're not going to be able to do it. The sites you try to go to will be locked down before people arrive. The people you send to help route people to impromptu backup collections will be arrested on first sight. etc, etc, etc.

Sure, is this all wildly illegal and unconstitutional behavior on the part of the police? Absolutely. But anyone who has ever worked for any politicized cause knows that its also par de course. New York, Chicago, and Oakland are famous for a break-the-law-now, pay the fines later type of police enforcement, but I've watched cops plow SUVs through 50 person hippie protest marches, light their own cars on fire, or attack protestors with knives and chainsaws (seriously, chainsaws) in more places than I care to admit, just so tomorrow's papers can say "Peaceful protest goes violent", and anyone who sells this sort of data to the police is aware that that's the reality on the ground.

When the governor says jump, the police always do, regardless of legality, and this type of info just makes them that much more effective.

MuckRock has written about this and has published their public records requests: https://www.muckrock.com/news/archives/2016/may/18/followed/

I don't know what offended me more, that Geofeedias work was so laughably amateur, or that they got paid so much for it. Good for the social media companies to shut them out, even if just to save face.

Unless I'm missing something, and I may be, this is relying on the geotagging information you include in tweets, something you can control. I'm not sure I see much advantage in having your location broadcast every time you tweet.
Geotagging is something that tends to be on by default, and lots of people aren't aware they can shut it off. (or that it's happening in the first place)
The Twitter app properly communicates when you're geotagging your tweets or not, and allows deactivation using a simple click before you submit. If that's all it takes for privacy, then I'm ok with this. Facebook is much more sneaky. I would be curious to know how many protesters shared their location without wanting to. Witnessing my family of tech-unaware people, privacy leaks is a monster they're all afraid of, thanks to headlines of media, and they often ask "Not to be tagged on fb" or "How can I be sure that ...". Protesters are probably even more conscious of this.
Defaults are strong and powerful, though. This is the main issue which companies like this have taken advantage of.

Many users don't know that something is on by default, and if the default is to geotag, people will nearly always forget to disable the geotagging.

You or I might know what it means when the 'place' icon is highlighted during a tweet. Non technical users might not understand the implication of thier actions.

Only something like 2% of posts have geolocation enabled, though services like Geofeedia also try to discern your location through other means (eg. mentioning you're at a particular area/place).
I'm certain in the future that companies that sell third-party data to the government for this type of thing will get limited by large social networks due less to the reputational risk but more to the fear that the knowledge people are being watched will cause them to change or even limit their behavior on the platform. To wit, it behooves Facebook to ensure that the majority of two individuals' social media interactions are captured via platforms they control. Any threat to that is a direct threat to their profit center, ads.
I doubt they'll actually have a choice in limiting it, but I expect they'll pretend like it's not happening either by force or because, like you said, it's not in their best interest to make people aware of it. People just need to learn not to trust anyone. It's the only path to happy life.
in any case, it's probably best to assume police and other government agencies can access your social network data.

the ACLU may well win a million court cases, but the data is out there.

i don't see an effective way to stop police, as individuals, or as small independently organized groups, from accessing this sort of data, whether legally or illegally. someone will find a way to get that information to the police if the police want it.

> it's probably best to assume police and other government agencies can access your social network data.

A hundred times over. Your social media posts are included in both your credit score and the criminal risk score algorithms used by police to prioritize covert civilian investigations.

The ACLU has spoken pretty powerfully on the use of police risk scoring algorithms and individualized data tracking, but it's the wave of the future with states and municipalities being pressured and incentivized by federal police to adopt the technologies and practices. IIRC it's close to a hundred US cities now that have official per-citizen social media and data surveillance feeds?

If only there was some way to not voluntarily post all one's personal data and activities online.
Much of it isn't voluntary.

People are sold a phone to which they provide some details including social media logins and install some apps.

They then carry their phone around with them not realizing that the phone is automatically uploading it's location to various services.

If you were to poll people, "Does having Facebook installed imply your location will be broadcast to Facebook 24/7?", I think you might be surprised to find out that even despite that leading question that people in fact don't realize that.

To use an adroid phone requires a google account to which your location will be transmitted. You can ask google to stop this happening but then you're back to the issue that people need to be aware this is even happening.

In tech circles people are well educated about this particular issue. More widely this is less well known.

Much of it is. Facebook claims that the data Geofeedia was accessing was publicly shared, as in, not related to the location pings used by the service to find nearby friends.

That means pictures and posts with GPS data attached (read: willfully created by the user), unless there's some kind of proof that this company had a level of API access that goes beyond the level any other developer can access.

People oversharing is a huge problem.

Yea--I would love to live in a world where we aren't all forced to have "social media logins" in the first place!
I would be curious to know whether Facebook, Twitter and Instagram knew Geofeedia was selling the data to the police and in general how much they regulate third parties that access their data.
I would be willing to bet that at least someone at Facebook and Twitter knew that this data was being sold to them and knew they were likely to use it for this purpose.

Although this data is all "public", it is still not convenient or in-line with their terms of service to access it en-masse, and in real time, for these types of purposes without an explicit agreement with them.

Personally, I would think that Facebook and Twitter only cancelled the contract with Geofeedia because the ACLU called them out so publicly.

I've always found it curious why no one sets up a class-action lawsuit about the privacy and 3rd party selling of data.
In the US, you are free to collect any data you can observe (assuming you don't interfere with others' rights). You are also free to trade what you collect with others.

On what basis could someone bring a class-action lawsuit about sales of data that was lawfully collected by a third-party?

Well, the argument would be that it wasn't within the lawful allowed use.
You mean breach of contract which could be a tort, but not a "crime". Unless a given state has local laws which have provisions against that... Where advertisers would also fall under... Unless they lobbied for a provision exempting them... To make FB et al viable as an advertising platform.

Social networks are double edged swords by their nature.

The collection of the data is illegal for the government, not the use of it. The laws need to be updated.
Good thing this didn't exist in 1776, otherwise I'd be writing this from the British empire.
It seems reasonable at time when "protesting" means shutting down infrastructure.
There is a long history of blocking crucial infrastructure during civil unrest and protesting. Its used as a tactic because its effective. Nothing about it is new or specific to today's society.

How does that justify potentially infringing upon the protected rights of the protestors?

> Its used as a tactic because its effective.

So are armed mobs that murder political opponents. Might does not equal right.

People have a right to protest.

They don't have a right to destroy property that doesn't belong them.

They don't have the right to circumvent democracy and infringing upon the rights of everyone else by shutting down infrastructure that belongs to the all people.

De-facto, might almost certainly means right.

Most protests happen because the government uses physical force, or the threat of physical force to infringe upon the rights of its constituents.

I agree that protestors have no right to destroy property that doesn't belong to them.

I don't agree that the police should be expected to confront protestors just because they shut down an interstate. You have no basic human right to not be inconvenienced at all by non-violent protestors. Non-violent protests that happen to shut down an interstate at some point should not be met with riot shields and swat teams.

We're going to disagree on that because the alternative is a breakdown in the rule of law. If you're going to block a major thoroughfare, you should expect police response (it's illegal for a good reason), and that response to escalate if you don't cooperate.

You don't get an exception to law to harass hundreds, possibly thousands of innocent people just because you feel put upon.

The United States was founded on the principle that yes, you can harass hundreds, possibly thousands of innocent people just because you feel put upon. I think that even has been called the American revolution (With a little helping of the Civil War.)

Not to mention that almost every form of social progress came at the cost of inconveniencing all those poor, poor people who want nothing to do with the struggle for civil rights, universal suffrage, etc...

When you put convenience and order over basic human and constitutional rights, yes, you bloody well should be inconvenienced. The status quo 'inconveniences' these people every day - far worse then a blocked freeway. Perhaps you should channel your inconvenience at the oppressor, rather then the victim.

> You have no basic human right to not be inconvenienced at all by non-violent protestors.

I absolutely have a right not to be held hostage. I also have a right to use public infrastructure, especially when that infrastructure is used by emergency vehicles. Such protests should be met with the minimal necessary force to quickly restore order. Most importantly, these protests are often turn violent, so I'm thankful the police take (non-infringing) precautions to protect themselves and the safety and property of law-abiding citizens.

> There is a long history of blocking crucial infrastructure during civil unrest and protesting. Its used as a tactic because its effective. Nothing about it is new or specific to today's society.

What does this have to do with anything? Is this supposed to justify the tactics?

> How does that justify potentially infringing upon the protected rights of the protestors?

Why do you think police need justification to enforce the law without infringing on the rights of protesters?

>What does this have to do with anything? Is this supposed to justify the tactics?

Original commenter specifically mentioned "at time..." which I took as an implication that there was something special about today's society.

>Why do you think police need justification to enforce the law without infringing on the rights of protesters?

Because you don't lose your rights when you protest, even if you break the law? The police don't have ultimate power to enforce the law. There are purposeful limits to the power of the police. That's the point of having certain rights enshrined into the legal system. Do you disagree?

You misread my statement. To be clear, the police don't need extra justification to enforce the law so long as they are respecting the rights of the protesters.
If a protest doesn't inconvenience anyone, why would the powers that be pay attention to it?

"Shut up, go home, you live in a democracy, so complain at the ballot box" isn't a civilized response to a protest issue. When it's used to justify tyranny of the majority, it is borderline fascism.

I'll take the "borderline fascism" of protecting the rights of law-abiding citizens over the actual anarchy of allowing protesters to infringe upon those rights with impunity. Democracy isn't perfect, but anarchy is worse. Further, would your tune change if the protesters were right-wing? Would you support their right to block critical infrastructure (not to mention the violence that characterizes so many of these "protests") in defense of what they perceive as their rights?
A protest is an organized expression of dissatisfaction, not anarchy--they're obeying the law as much as everyone else. If I'm inconvenienced, that's fine--there are ways to get around it, and it's a cost I'd gladly pay for the freedom of association and protest.

> Further, would your tune change if the protesters were right-wing?

Absolutely. Conservatives, reactionaries, and fascists have exactly the same rights that I do.

> Would you support their right to block critical infrastructure (not to mention the violence that characterizes so many of these "protests") in defense of what they perceive as their rights?

Critical infrastructure almost always has redundancies, and in case there isn't one (e.g. a protest in front of a hospital), the police should just clear a route with minimum force and no legal actions afterwards. Violence is another issue entirely--if people are being violent in a protest, then stop and arrest them for being violent, not for merely protesting, and leave the other protesters alone.

>A protest is an organized expression of dissatisfaction, not anarchy--they're obeying the law as much as everyone else.

No on is disputing this, the key part being "obeying the law."

>Critical infrastructure almost always has redundancies, and in case there isn't one (e.g. a protest in front of a hospital), the police should just clear a route with minimum force and no legal actions afterwards.

And here is the bait the switch. Now the protesters are no longer law abiding.

>Absolutely. Conservatives, reactionaries, and fascists have exactly the same rights that I do.

So you supported the Oregon protesters that occupied Federal land in protest?

> And here is the bait the switch. Now the protesters are no longer law abiding.

You mean bait & switch. It isn't--in many cases marches and protests are lawful even if they block roads. If they aren't, use muscle, batons, and shields so that the law is no longer being violated. Don't go after them afterwards.

> So you supported the Oregon protesters that occupied Federal land in protest?

Absolutely, up to the point where guns became involved.

An abolitionist stealing a slave impedes on the rights of a law-abiding citizen to own another human being as chattel.

Is this really the hill you want to die on?

People turn to protest, violent, or otherwise, when other forms of petition have failed.

Are you really comparing "going to work without being held hostage", "not having your property looted or burned", and "not being assaulted/murdered" to slavery? Is this really the hill you want to die on?
> It seems reasonable at time when "protesting" means shutting down infrastructure.

---

> It seems reasonable at time when "legislating" means shutting down infrastructure.

I'm curious why you complain about one and not the other? The latter is being used to take away people's access to things like voting, etc. by shutting down polling locations, changing times, etc. to reduce access to people who vote for the "wrong" party.

protesting doesn't work very well unless there's some threat to the normal order of things