[Dylan16807]

> They will classify the data as necessary for business purposes and collect it under a different name.

Laws are powerful enough to stop that.

> wiretaps

I said 99%, not 100%.

> any third party in range of the WiFi network can likely do the same thing passively

But they won't do it in bulk without a lot of motivation (like profit).

[aspenmayer]

When they are compelled to do it, they will not even know it is happening. Only the people doing it would know. That’s the reality of why it is done now. That there is a market for it should never have been allowed but the capability is necessary to troubleshoot the network. I guess it seems silly to say this is even a legal issue. They shouldn’t do a lot of things, but they are going to be legally compelled to do them, so the network structure’s form follows that function. If there is no market for that data, they will get the data by proxy by leasing access to the network or the customer or the metadata for security or other legal purposes via intermediaries or separate internal units. This is just how ISPs have to handle this kind of data request or other legal request. They have formal means to ask for what they need, and they will usually get enough data to find out anything they will need to find out that the CPE is emitting or doing.

I guess if you’re truly concerned you shouldn’t have WiFi at home or a mobile phone. Too bad 5G signals have similar capabilities, but at least the signals don’t propagate as well.

[fc417fc802]

> When they are compelled to do it, they will not even know it is happening.

That ... might or might not be an issue, but it's not _this_ issue, ie the one we were originally talking about here.

A targeted order to wiretap (or otherwise spy on) a specific person or entity is entirely different from widespread data collection, retention, and sale for whatever corporate purpose. With widespread collection the data is then sitting there in a data lake waiting to be subpoenaed by law enforcement at their leisure for any arbitrary reason they happen to think up potentially years in the future.

> they are going to be legally compelled to do them, so the network structure’s form follows that function

You can't be compelled to hand over that which you do not have. Neither can you be compelled to modify your product in a particular manner absent market wide legislation; see FBI v Apple if you doubt that.

[aspenmayer]

> A targeted order to wiretap (or otherwise spy on) a specific person or entity is entirely different from widespread data collection, retention, and sale for whatever corporate purpose. With widespread collection the data is then sitting there in a data lake waiting to be subpoenaed by law enforcement at their leisure for any arbitrary reason they happen to think up potentially years in the future.

I do see what you mean, but they are differences of degree, not kind. It could be considered a best practice to minimize PII etc, but even other groups don’t do any better. Signal still uses phone numbers.

> > they are going to be legally compelled to do them, so the network structure’s form follows that function

> You can't be compelled to hand over that which you do not have. Neither can you be compelled to modify your product in a particular manner absent market wide legislation; see FBI v Apple if you doubt that.

I agree. However, Apple is also confident enough in their legal team, reasoning, funding, and likely legal outcomes that they will flout NSLs in America, and yet they will cave to UK in that they disabled Apple’s Advanced Data Protection (in UK) which means that iCloud files aren’t really E2EE if the government can just say that you can’t do that anymore. Not your keys, not your files and the security and privacy of said effects thereof.