[nneonneo]

My entry point into this whole fiasco was finding a bug that let anyone track anybody with just a cellphone number: https://arstechnica.com/information-technology/2018/05/servi...

In this case, the site was selling real-time location data from cell carriers, meaning that there was virtually nothing that an individual could use to protect themselves (short of using a burner or no phone at all).

It’s great to see some strong action is being taken here against the sale of location data, and I hope the bans can be extended more broadly (and to Canada, please!)

[1vuio0pswjnm7]

"Krebs went on to cite an official at the Electronic Frontier Foundation who said cellular carriers by law are required to know the approximate location of customers in the event it's needed by emergency 911 services. Whether the carriers are permitted to sell or otherwise provide the information to other third parties is less clear. Expect there to be much more scrutiny about this in the coming weeks and months."

To see this in practice, check out MVNOs offering prepaid mobile service. Some will disable certain features unless this physical E911 address is submitted by the customer.

What if there were a limitation on how that data can be used.

[Terr_]

> Krebs went on to cite an official at the Electronic Frontier Foundation who said cellular carriers by law are required to know the approximate location of customers in the event it's needed by emergency 911 services.

IANAL but the RAY BAUM’S act (yes, it's all caps because it's a silly initialism) only applies to location data that goes "with" a particular 911 call. Not your location before the call, nor your location after the call.

So if your cell-carrier is recording your location at all moments and persisting it indefinitely, or sharing anything beyond the data generated for that particular 911 call, no law is forcing them to do that, they are choosing to disrespect your privacy for their own profits or laziness.

[sacnoradhq]

E911 came about to address lost and immobilized callers.

Unfortunately, it's inconsistently deployed and not universally usable. This is likely the result of a lack of a sufficiently-staffed regulatory body auditing for compliance and correctness because it doesn't work everywhere with all phones on all carriers even when there is the technical ability, e.g., phone has a fix. It hasn't delivered completely on its promise because it's an under-funded, under-audited mandate that needs serious carrots and sticks to ensure it's reliable.

[smcin]

No, "finding lost and immobilized callers" was the cover-story nominally used when E911 legislation was pushed hard in Congress in 1999/2000 (by the wireless industry, not directly by law enforcement).

Do we really believe that Congress authored a law to improve "safety" but that had enormous negative privacy implications, while accidentally forgetting to even speak to the other 99.999+% of the time that the average person's location data is not involved with an emergency? Why were the legislation (and debate) conspicuously silent on limiting (let alone criminalizing) use and retention of location data, let alone resale (e.g. to data brokers or private parties?)

Let's not pretend this exact outcome wasn't predicted and raised in strenuous objections by consumer advocates back in 1999; the following reads like a to-do list from lobbyists (why e.g. did the industry push for immunity for non-911 calls?)

> 10/4/1999 WIRELESS 911 BILL HITS LIABILITY, PRIVACY OBSTACLES

> Failure to pass the 911 bill-the centerpiece of the wireless industry’s lobbying campaign in 1999-would be a serious setback for carriers and 911 vendors that want immunity from lawsuits before rolling out... caller identification and position location.

> Holding the bill over until 2000 could prove highly problematic for industry, given it is an election year. Moreover, a delay would buy time for consumer groups and others that are beginning to surface and speak out on wireless liability issues pending before Congress, the Federal Communications Commission and state courts.

> In addition to liability protection for 911 and non-911 wireless calls...

> Such broad liability immunity for wireless carriers has caused an uproar from consumer advocates who claim 911 legislation is part a master plan by industry to secure shielding from virtually all lawsuits.

> In some state courts, consumers have brought litigation against wireless firms for being charged for rounded up and dropped calls, fraudulent advertising and other carrier practices. [boo hoo hoo]

https://www.rcrwireless.com/19991004/archived-articles/wirel...

[rkagerer]

Great job on exposing this. Do you think Canadian carriers are providing access to this type of information to third parties? Are there any you would expect are not, eg. who have a track record of ethical behaviour and consumer advocacy (eg. like tbe TekSavvy of carriers)?

[nneonneo]

They definitely were at the time I found the bug, since I could track some Canadian numbers. However, I don’t know if that’s still the case.

[uggabuggalives]

> (short of using a burner or no phone at all).

Not carrying a phone won't help you.

Pulling the SIM won't help you.

Look around you. See all those cameras? Not just the ones above your head in the supermarket that advertise HERE I AM, I'M A CAMERA, but every camera on every phone in the hands of every person you see can identify you and identify your exact location to the meter instantly based on your face and x other biometrics.

Everytime you speak, your voice pattern identifies you instantly.

Burner phones are a thing of the distant past. The moment you speak, the moment the camera "sees" you, your burner phone's IMEI is/can be mapped to your identity in double time.

The methods in use today are just way more sophisticated than the tech you've read about.

A drone at 20,000 feet can identify you in a crowd of 2,000 people based on the sound of your heart, your respiration, the shape of your head, your ears, your nose, your face, your facial profile, the shadow your body casts at x time of day, and/or the uniqueness of your gate. Combine them altogether with a scant amount of stat analysis and you can't hide even with effort.

Think darkness will hide you? Nope.

[bradgessler]

This is why I think technical solutions alone to privacy are mostly pointless. There’s 7 billion people in the world—at some point (if we haven’t already reached it) monitoring all of us in real-time will be trivial. Even people who live “off the grid” in a cabin in the woods will be trackable.

What’s needed is an agreement between all of us, in the form of privacy laws, that make certain uses of this data illegal.

In the future if you’re caught committing a crime by data captured in a manner illegal under these laws, it would have to be thrown out and can’t be used against you. Corps would also be banned from collecting, storing, and using personal data in an unlawful manner.

Feels like a pipe dream since there’s so much money in the industrial advertising complex, but I’m pretty sure that’s what it will take achieve reasonable levels of privacy.

[AnthonyMouse]

> This is why I think technical solutions alone to privacy are mostly pointless.

Technical solutions to privacy are not required to be alone. They're required to be ubiquitous. If your country is an authoritarian hellhole, you encrypt everything to help you not get murdered by the secret police. If your country has strong privacy protections, you encrypt everything to help ensure that it never becomes an authoritarian hellhole, and protect you against bureaucratic failures as defense in depth.

To invade your privacy, an attacker should have to break the law and break the encryption.

[Frondo]

Life in an authoritarian hellhole almost by definition means technology won't save you. If they can haul you off when you're walking down the street, who cares whether your stuff is encrypted? They'll make something up.

Even if you're innocent, they'll make something up. I lived for a year in one of those authoritarian hellholes and in that time knew two people who were arrested and hauled from station to station til someone paid a bribe- these weren't the dissidents either, just some guys. The dissident was stabbed to death on his doorstep.

Encryption is good to save us from marketing, from megacorps making our lives hell. Laws and norms constrain the rest.

[AnthonyMouse]

Authoritarian hellholes will make something up when they don't like you, but they'll also spy on everyone to decide who they don't like. At which point anyone attempting to resist them is going to want to get extremely familiar with operational security before they get dead, and a big part of that is things like encryption and steganography.

[Frondo]

Encryption will not keep you hidden from an authoritarian government for long, and certainly not for long if you're trying to build a movement with any sort of wide-spread support.

[zirgs]

Authoritarian hellholes don't have human rights and if they find out that you're using encryption - that's enough for them to arrest you.

[bilalq]

Agreed that this is not a problem that can be solved via a technical solution. However, I don't think a political solution is possible either. Even in the US, police can literally get away with murder today. Why would they have any difficulty getting away with privacy violations? Big Brother is inevitable. All you can do at this point is teach children and future generations to live with the understanding that they are being monitored at all times. This isn't me trying to be edgy or cynical. The genie's out of the bottle at this point and it's just reality.

[xapata]

The way to fight back is ubiquitous public monitoring of the state. We should understand that the state is always watching, but the state should also be aware that all its actions will be public knowledge.

Note the increased awareness brought by widely available cameras with immediate upload capability. The commenter above implied this is dystopian, but the opposite seems to have occurred -- as the public gains the capability to surveil the state, it constrains the state.

[handity]

WikiLeaks tried that, Assange is still in Belmarsh and the MSM is still largely allowing him to rot there.

[ncphil]

This is a good point. Of course anyone who thought the MSM, or print journalism, were in business to reveal the actual truth really needs to review their history. The worst part is that Julian (whether intentionally or not) probably made that sacrifice for nothing. At least here in the US most people don't know or care. That's a shame. And an embarrassment.

[xapata]

I was thinking of something more communal/distributed. WikiLeaks wanted centralization.

[adrr]

He could just stop fighting the extradition unless there are concerns he wouldn’t get a fair trial in the US. I haven’t heard of such concerns and he could probably get a solid legal defense team with private donations.

[xapata]

What's the goal of preventing use of these data? Are there alternative methods that could achieve the same goal?

[LakeBoat]

Gonna need a source on this. The US has trouble solving simple murders when people are present, let alone some sci-fi stuff you’re talking about.

[AnthonyMouse]

The technology exists but the false positive rate is high, most cameras don't actually implement these things and there is no convincing evidence that all cellphone cameras are secretly always on (though a compromised device could be).

[TeMPOraL]

I tend to think of it this way: it's theoretically within our technological capabilities, and has been for at least a decade. However, it's fractally difficult - there are technical challenges, political issues, PR issues, principal-agent problems, all mixing together - and importantly, there is no strong enough economical (or political) incentive to do it. Not when doing a small fraction of work, and a shitty job at this, still showers you with money while avoiding most of the problems.

An not to push my favorite TV show that doesn't involve aliens from outer space too much, but recent advances in AI are changing the equation here, making Person of Interest even more accurate and relevant than it already was.

[doublerabbit]

Maybe in the Metro parts of the USA, but China is next level scary: https://www.youtube.com/watch?v=Oo_FM3mjBCY

It's all possible.

[jbm]

The more disorder we see, the more people are going to reach for these extremist solutions.

It's all scary - until one is the victim of a crime and the police don't think it's worth following up, or the presiding judge decides your time and suffering is less important than the future prospects of the criminal.

[trompetenaccoun]

It sounds logical but at least in the case of China there was no disorder to begin with, it's always been relatively safe in terms of violent crime. In China, the violent criminals are the government and the police. You can become a torture victim for as much as splashing ink on a Xi poster or just being Uyghur and existing.

The cameras are not there to protect you from crime, they're there for control, to protect the CCP from the people.

I'm not principally against surveillance for public security but it's very hard to not have it abused - for a start you need authorities and a police force that have good intentions and work for the people, not against them. In most countries that's not a given.

[5m17h]

is American, watch everyone in the world to WWW3

[wnevets]

aren't you describing a plot point of The Dark Knight

[ThePowerOfFuet]

Your tinfoil hat is on far too tight.