[HN Gopher] Deputy US Marshal pleads guilty to obtaining cell ph...
       ___________________________________________________________________
        
       Deputy US Marshal pleads guilty to obtaining cell phone location
       unlawfully [pdf]
        
       Author : arkadiyt
       Score  : 146 points
       Date   : 2023-07-09 16:04 UTC (6 hours ago)
        
 (HTM) web link (oig.justice.gov)
 (TXT) w3m dump (oig.justice.gov)
        
       | amateuring wrote:
       | if you can spy without consequence on a sitting president, why
       | not on your ex as well?
        
       | hanniabu wrote:
       | > Pena pleaded guilty to unlawfully obtaining confidential phone
       | records. He faces a maximum penalty of 10 years in prison. A
       | sentencing date has not yet been set. A federal district court
       | judge will determine any sentence after considering the U.S.
       | Sentencing Guidelines and other statutory factors
       | 
       | He'll probably get 6 months probation
        
         | gruez wrote:
         | >He'll probably get 6 months probation
         | 
         | That's the standard for most first time, non-violent offenses.
        
           | public_defender wrote:
           | > That's the standard for most first time, non-violent
           | offenses
           | 
           | In what country?
        
             | gruez wrote:
             | US, as per federal sentencing guidelines[1]:
             | 
             | * baseline offense level of 9 [2]
             | 
             | * -2 adjustment for acceptance of responsibility[3]
             | 
             | * That gets you an offense level of 7, which puts him in
             | the 0-6 months band[4], making him eligible for
             | probation[5].
             | 
             | IANAL but all of this is for offenses that make it to
             | trial. If there's plea bargaining involved the sentences
             | are probably even lighter.
             | 
             | [1] https://www.ussc.gov/guidelines/2021-guidelines-manual-
             | annot...
             | 
             | [2] https://www.ussc.gov/guidelines/2021-guidelines-
             | manual/annot...
             | 
             | [3] https://www.ussc.gov/guidelines/2021-guidelines-
             | manual/annot...
             | 
             | [4]
             | https://www.ussc.gov/sites/default/files/pdf/guidelines-
             | manu...
             | 
             | [5] https://www.ussc.gov/guidelines/2021-guidelines-
             | manual/annot...
        
               | public_defender wrote:
               | This seems correct regarding this person and this
               | conduct, but I disagree that this type of penalty is "the
               | standard for most first time, non-violent offenses."
               | 
               | Federal cases are a small percentage of total criminal
               | prosecutions, and penalties vary widely across the
               | country.
        
           | KirillPanov wrote:
           | Like selling drugs or "money laundering"? I don't think so.
        
             | pclmulqdq wrote:
             | I mean, there are lots of worse penalties for things
             | related to organized crime. Things like minor fraud or
             | burglary are often also in the probation bucket.
        
               | devilbunny wrote:
               | Minor fraud and burglary generally don't generate a
               | federal prosecution. Doing what would otherwise be a
               | fairly minor crime under the color of law should generate
               | a hefty bench-slap (as the lawyers like to say).
        
       | jbmc wrote:
       | A similar recent story: https://www.sacbee.com/news/politics-
       | government/capitol-aler...
        
       | [deleted]
        
       | runlevel1 wrote:
       | And he got his access from the infamous Uvalde County Sheriff's
       | Office where he was assigned to the Lone Star Fugitive Task
       | Force.
       | 
       | Indictment here: https://www.justice.gov/d9/press-
       | releases/attachments/2022/0...
        
       | monero-xmr wrote:
       | It sounds like this was a piece of software where you uploaded a
       | PDF of "proof" that you had the authority to track anyone in
       | America, and then it let you. And someone finally bothered to
       | look at the proof and it was a blank page.
       | 
       | This is why I'm against giving the government the power to
       | intercept communications or middle-man encryption. They always
       | pitch it like "This power will be protected by courts and
       | warrants and Fort Knox level security!!" and then it's a checkbox
       | that any bureaucrat can use to violate civil liberties en masse.
        
         | runlevel1 wrote:
         | Ironically, some of the documents he uploaded included award
         | certificates and a list of justifications for a merit
         | promotion.
         | 
         | Referenced in paragraph 13, but unfortunately not attached:
         | https://www.justice.gov/d9/press-releases/attachments/2022/0...
        
         | paddw wrote:
         | > and someone finally bothered to look at the proof and it was
         | a blank page.
         | 
         | I think I agree more than not with your worldview, but it seems
         | like in this case this was the first time the person tried to
         | improperly use the system... and he was caught and is now being
         | sentenced. So I would say this is an example of the system
         | "working".
         | 
         | I'm sure there are civil rights abuses that happen much more
         | frequently, which we don't here about, but this specific
         | incident seems like something that should be cheered.
        
           | asdfasdlfkj wrote:
           | According to the second sentence of the article, the officer
           | tracked multiple people and their locations. He clearly
           | wasn't caught the first time he used the tool inappropriately
           | because he was found guilty of using it illegally multiple
           | times.
           | 
           | The officer very clearly was not forthcoming with the
           | investigation, judging from him falsifying documents after
           | the investigation started. So he may have other undetected
           | crimes.
           | 
           | In fact, the only fair conclusion I think you can draw is
           | that some officer(s) use the tool inappropriately. Because
           | it's not clear if all uses are audited, or this officer was
           | found on a random check. But in my opinion saying "the system
           | worked" is inappropriate given the lack of data.
        
           | kelipso wrote:
           | Is this some kind of parody? He got caught because it was a
           | literal blank piece of paper. Anyone with any sense would
           | write some bullshit paragraph and I'm sure plenty did and got
           | away with it.
        
         | bjornsing wrote:
         | Yea I sometimes get a feeling that a large portion of the
         | population just doesn't understand conditionals. If you tell
         | them "you have the authority to do X if Y", they just ignore
         | the Y part.
        
           | matheusmoreira wrote:
           | People who are drunk on power subscribe to the "ask for
           | forgiveness, not permission" philosophy. They think
           | everything they do is right and just. They cannot understand
           | or even believe people would not trust them and see the
           | conditional as a pointless hindrance, bureaucratic red tape
           | meant to stifle upstanding people like them.
        
             | vjk800 wrote:
             | Also, the system doesn't really penalize this philosophy.
             | Try to do everything by the book and you find that you
             | can't really get anything done. Cut some corners, you get
             | shit done and, in the worst case, you get a mild slap on
             | the wrist several years later.
        
               | tourmalinetaco wrote:
               | And completely break down some walls, injuring others in
               | the process? Get a promotion, and if caught just move
               | somewhere else to do the same thing over again.
        
             | mopenstein wrote:
             | People love to wield power over those they oppose and don't
             | care if the system they implement is abused until they're
             | the targets of the abuse.
             | 
             | For example: most people love the police when they coercing
             | wealth from strangers to fund their projects but hate when
             | the same police step on their chest until they stop
             | breathing during a traffic stop.
        
               | vacuity wrote:
               | Your first sentence is generally true but
               | 
               | > when they coercing wealth from strangers to fund their
               | projects
               | 
               | I have no idea what you're referencing here, so I can't
               | say if it's abuse or not.
        
           | kelipso wrote:
           | Because the government and pretty much all those power ignore
           | Y, and whenever they get caught, vast majority of cases they
           | don't get punished. Of course anyone remotely intelligent
           | would ignore the Y part too. Only extremely gullible people
           | with their blind trust in government would look at Y part and
           | nod along. This particular case very much the exception.
        
           | vjk800 wrote:
           | It's not about understanding, it's about seeing these sort of
           | rules bent dozens of times first and then finally doing it
           | yourself. Rules are only as strong as their enforcement and
           | in many cases it turns out that no-one has neither the
           | incentive nor the ability to enforce them very hard.
        
             | bjornsing wrote:
             | After some bantering with Swedish police officers on
             | Twitter I've come to believe that many of them simply do
             | not make a distinction between what they have the authority
             | to do, and what they can get away with in practice.
        
             | AnthonyMouse wrote:
             | One of the things that would help this if anytime any of
             | these surveillance powers get used, they have to be used as
             | part of a _specific_ ongoing investigation, and when that
             | investigation is closed, everything related to it becomes a
             | matter of public record.
             | 
             | And then you have some hard rules like, investigations are
             | automatically closed after the statute of limitations runs,
             | or if the target of the investigation dies, or the victim
             | chooses not to press charges etc. Things not in the control
             | of the investigators, so they can't keep an investigation
             | open forever to prevent their abuses from becoming public.
        
               | zozbot234 wrote:
               | This is unworkable, sadly. I don't want my past location
               | data to become a "matter of public record" merely because
               | I have been caught up as a bystander in some random law
               | enforcement investigation and it all ends up in the case
               | file.
        
               | AnthonyMouse wrote:
               | Obviously personally identifying information could be
               | redacted without doing so for the request itself.
               | 
               | But you're just reiterating the problem that third
               | parties are _collecting_ the location data of _innocent
               | bystanders_. Otherwise it wouldn 't exist to be in the
               | file.
        
         | matheusmoreira wrote:
         | See also LOVEINT. Every once in a while, some NSA spy gets
         | caught spying on their loved ones. Not even incompetence, just
         | plain malice and abuse. Looks like they don't even face any
         | criminal charges either.
         | 
         | Governments are essentially adversaries, enemies we have to
         | defend against. It must be mathematically impossible for them
         | to abuse their power. Anything short of that is not enough.
        
           | theossuary wrote:
           | That's just impossible. Even if everyone had perfect e2e
           | encryption, the government could just ban it and throw people
           | who use it in jail.
           | 
           | You can't solve social problems with technology.
           | 
           | What is necessary is a governmental system which tends away
           | from the abuse of power. This requires better voting, more
           | transparency, and the literacy and engagement of its
           | citizens.
           | 
           | The problem is, just like in Conway's game of life, the
           | current system's state informs what states it'll progress to.
           | If a system tends toward corruption or abuse and isn't
           | actively changed, well eventually it no longer will be
           | possible to change.
           | 
           | https://xkcd.com/538
        
             | neodymiumphish wrote:
             | That's why you use a constitution strong enough to prevent
             | the government from having authority to ban a tool like
             | that. The solution's been known and described for 250+
             | years now.
        
               | mschuster91 wrote:
               | The problem is, if you rely on tools - and a constitution
               | is nothing else than a tool - you will end up developing
               | a reliance on that tool. And all of a sudden, that tool
               | breaks, and you're fucked.
               | 
               | Democracy must be fought for _every single day_ , and for
               | that matter so does _all_ progress. Democracy isn 't
               | something a society automatically converges to and which
               | everyone loves, it must actively be maintained or someone
               | _will_ come, sow mistrust and preach  "easy" solutions -
               | and then you wake up and your country isn't a democracy
               | any more.
        
               | vacuity wrote:
               | The US Constitution certainly isn't modern or flexible
               | enough to definitively protect (users of) E2EE. There are
               | arguments for their protection, but none is ironclad
               | (like "this is speech that is protected" ironclad). I'm
               | not saying the Bill of Rights was wrong in its time
               | period, but it would be more appropriate to lay out
               | fundamental principles that must be upheld, and
               | protection for E2EE (users) could then be derived.
               | There's some of that already, but not in a clear and
               | comprehensive manner.
        
               | theossuary wrote:
               | That's silly. A constitution is just a piece of paper. It
               | has no inherent power. It's the institutions put in place
               | to enforce the constitution that give it power. If those
               | institutions rot, the constitution will not protect you.
               | As we've seen time and again.
        
             | tchalla wrote:
             | You can address social problems with transparency in
             | access.
        
           | wpietri wrote:
           | > Anything short of that is not enough.
           | 
           | I like that in spirit, but not as a practical standard. A
           | major function of government is to prevent abuses of power.
           | So I'm more inclined to shoot for overall minimization of
           | abuse.
        
             | zozbot234 wrote:
             | Well, in this case a random law enforcement deputy could
             | get sensitive location information about random people with
             | no meaningful cross-check of any sort - and this has only
             | come to light after the fact, as part of a criminal
             | investigation. So there's reason to be highly skeptical
             | that the status quo is the best we can do when it comes to
             | preventing abuse across the board.
        
             | AnthonyMouse wrote:
             | > A major function of government is to prevent abuses of
             | power.
             | 
             | But they can still do this. If you want to know where
             | someone is, instead of compelling devices or carriers to
             | spy on everyone at all times, you attach a tracker to the
             | suspect's vehicle, or assign an agent to follow them.
             | That's more expensive -- which is the deterrent to abuse.
             | 
             | A bad cop doesn't have time to follow around their ex all
             | day. They do have time to follow around the subject of an
             | official investigation, because that's their job. Tracking
             | devices cost money, so it limits the number of people who
             | can be tracked at once and prevents mass surveillance.
             | 
             | The argument for compulsory backdoors is purely an
             | efficiency case, but efficiency is less important than
             | preventing abuse.
        
               | zozbot234 wrote:
               | The carrier is not spying on you here. A cell phone
               | network has to know your phone's location in order to
               | function at all, and this info has only gotten more and
               | more fine-grained with newer network standards. There's
               | nothing wrong with granting access to such data with
               | proper authorization.
               | 
               | The "expense" involved in getting warrants approved is a
               | better check on abuse, since it's very easy to do this as
               | part of official law enforcement duties, and quite hard
               | otherwise - the corrupt cop will need to come up with
               | some reasonable justification, and not have it fall apart
               | under deeper scrutiny. Of course if your local judge will
               | rubber-stamp blank_document.docx as a proper "warrant"
               | you have a problem again. But that can be addressed in
               | turn.
        
               | AnthonyMouse wrote:
               | It would be simple to design a cellular data network that
               | didn't tie account holders to devices. Issue access
               | tokens good for e.g. 10 GB of data to the mobile device.
               | Don't store the token in connection with the account.
               | Anyone could buy a prepaid card with tokens for cash at
               | any convenience store. The network identifies the device
               | via the token, which is temporary and anonymous.
               | Telephone routing is done via VoIP which anyone has the
               | option of routing through a VPN.
               | 
               | It's designed the way it is now on purpose, to spy on
               | everyone.
               | 
               | > The "expense" involved in getting warrants approved is
               | a better check on abuse
               | 
               | Except that they don't actually get warrants when they're
               | doing abuse, they just lie about it because the phone
               | company has minimal incentive to check and the victim who
               | does typically isn't notified.
               | 
               | > Of course if your local judge will rubber-stamp
               | blank_document.docx as a proper "warrant" you have a
               | problem again. But that can be addressed in turn.
               | 
               | "Quis custodiet ipsos custodes" is in latin because it
               | was published circa 100 AD. No effective solution to this
               | problem has yet been uncovered.
        
           | vacuity wrote:
           | Want mathematical assurance that your government won't abuse
           | power against you? Either you have to be the government or
           | you don't live in a society with a government. Abuse isn't so
           | easily constrained. Try proactive regulations, vigilance, and
           | strict punishments (not comprehensive). Best effort, but what
           | else can you do?
        
             | AnthonyMouse wrote:
             | "Government can never abuse power or government can
             | systemically abuse power" is a false dichotomy. You can
             | make it cost more so it happens less.
             | 
             | Encryption is the common example. As far as anybody knows
             | the government can't break e.g. AES. But they can still
             | find out what's on your device because with a warrant they
             | can install surveillance devices in your house to capture
             | it when you enter your passphrase, then seize your device.
             | 
             | Which makes it possible but not easy, which limits the
             | scope for abuse.
        
               | vacuity wrote:
               | > "Government can never abuse power or government can
               | systemically abuse power" is a false dichotomy.
               | 
               | I didn't make it a dichotomy. I was just commenting that
               | "mathematically impossible" is too strong to the point of
               | absurdity. Not fun at parties, but I would hope it's fine
               | on Hacker News. I then provided a rough overview of a
               | system to mitigate abuse. We're not even disagreeing
               | about trying to minimize government abuse.
               | 
               | To discuss your example of encryption, the abuse is the
               | government installing and using the surveillance devices
               | (let's assume the suspicion isn't beyond reasonable doubt
               | or whatever and the warrant is invalid). The question is
               | whether that abuse is prevented or routed and justice is
               | enacted.
        
       | bettercallsalad wrote:
       | But three letter agencies do it all the time without any warrants
       | and when caught no repercussion either last I checked. Maybe the
       | DOJ attorneys can get to those as well?
        
       | runlevel1 wrote:
       | It's disturbing how much this information is sold and resold:
       | 
       | * Securus purchased the location data from 3Cinteractive
       | Corporation, which was located in Boca Raton, Florida.
       | 
       | * 3Cinteractive Corporation, in turn, purchased such data from
       | Technocom Corporation (doing business as LocationSmart), which
       | was located in Carlsbad, California.
       | 
       | * Technocom Corporation (doing business as LocationSmart)
       | purchased this data directly from telecommunications services
       | providers.
       | 
       | * This capability enabled Securus's registered users to obtain
       | the location data entered in the LBS platform, or, in other
       | words, to ascertain the approximate physical location of a
       | particular cellular telephone on demand.
       | 
       | Source: https://www.justice.gov/d9/press-
       | releases/attachments/2022/0...
        
         | jhelps wrote:
         | The cellphone companies have been selling the realtime location
         | of all subscribers since at least 2018. It doesn't depend on
         | whether you have location enabled either, since it figures out
         | your location from the towers! On top of that, one of them had
         | an unauthenticated API, meaning anyone in the world could track
         | the realtime location of any US phone #[0].
         | 
         | If all of this bothers you, contact your state legislators.
         | Most state privacy laws don't protect against ISPs selling your
         | location & browsing info, even though that would be the common
         | expectation. Maine's law is simple and does a good job[1][2].
         | 
         | 0: https://www.wired.com/story/locationsmart-securus-
         | location-d...
         | 
         | 1: https://www.natlawreview.com/article/maine-s-new-internet-
         | pr...
         | 
         | 2: Maine's law survived a federal challenge, and ISPs have
         | dropped their appeals:
         | https://www.mediapost.com/publications/article/377285/broadb...
        
           | csdvrx wrote:
           | > It doesn't depend on whether you have location enabled
           | 
           | It's even better: the location can be enabled through a
           | network initiated request. This is because A-GPS works "both
           | ways". See https://en.wikipedia.org/wiki/Assisted_GNSS#SUPL :
           | SUPL Position Calculation Function (SPCF) lets the client or
           | the server ask for the client's location.
           | 
           | As part of the FCC's updated 911 requirements, where cell
           | phones (with no set location) are required to be routed to
           | the correct 911 center, aGPS was developed to not only help
           | GPS get a faster TTFF (time to first fix), but to transmit
           | location data to the carrier (and to anyone else who can
           | intercept the data)
           | 
           | > If all of this bothers you, contact your state legislators
           | 
           | If you don't like that and want a quick fix, on android
           | devices check /data/vendor/agps_supl/agps_profiles_conf2.xml
           | for ni_request="true": this is the Network-Induced Location
           | Request functionality, where the network asks for the GPS
           | position. Change that to false.
           | 
           | Personally, I believe 911 AGPS is of limited use: if I'm
           | unconscious and can't dial, the phone 911 AGPS working won't
           | do me any good. If I'm conscious and I can dial, I can also
           | open a map app.
           | 
           | Still, if you want to keep the 911 stuff, just change
           | reject_non911_nilr_enable="false" to true (because yes, by
           | default, everything goes - 911 or not)
           | 
           | There's also lpp_enable="true" (LTE Positioning Protocol, yet
           | another method by which cellular providers can pinpoint your
           | location via aGP S), imsi_enable="true" (which transmit a
           | unique identifier along with the AGPS request!)
           | 
           | Check also /data/vendor/agps_supl/agps_profiles_conf2_prv.xml
           | 
           | Or even better: don't use a phone. I have a 5G/LTE module in
           | my laptop when I need internet connectivity: it's turned off
           | the rest of the time (rfkill block wwan). You can also
           | disable the power to this M2 port (saving battery if you care
           | about that)
        
             | gszr wrote:
             | This is very interesting - thank you for sharing your
             | knowledge. Any other related rererences - the tech that
             | enables this sort of tracking?
        
               | csdvrx wrote:
               | > Any other related rererences - the tech that enables
               | this sort of tracking?
               | 
               | It's everywhere in mobile devices. It's better not to use
               | them.
               | 
               | If you must use one, you must at least have root to
               | disable AGPS + add stringent iptable rules to disable any
               | outgoing communication by default: you should only enable
               | connections per app, or per IP/domain for what you need.
               | 
               | Still, that'll be of a limited help since the baseband
               | manages connections (3GPP profiles etc) and does the
               | equivalent of NAT to your device.
               | 
               | For all I know, the baseband could tell android "location
               | disabled? sure thing!" while still getting GPS fixes +
               | sending the position by UDP packets processed by the
               | baseband OS: Android won't even see it! Yet by virtue of
               | sharing the same IP (or being "enriched" with your IMSI
               | as you can see above), you will be totally trackable.
               | 
               | Doing anything more requires running free software on the
               | baseband: there're now free-software firmwares like
               | https://github.com/the-modem-distro/pinephone_modem_sdk
               | (I'll submit that for discussion)
               | 
               | It started from initiatives like https://www.reddit.com/r
               | /PINE64official/comments/hflat0/pine... but now you even
               | have a free software bootloader for the modem (see
               | https://github.com/Biktorgj/quectel_lk)
               | 
               | If you want, you can also recover the stock firmware
               | (https://github.com/Biktorgj/quectel_eg25_recovery), but
               | the ability to audit from top to bottom to disable data
               | exfiltration requires a 100% free software solution.
        
         | mistrial9 wrote:
         | there were rumors of gray market identity traders in the 2000
         | times, within the USA. What changes is accuracy, timeliness,
         | noise levels and verifiability, off the top of my head...
         | Apparently completely legal identity document sales have gone
         | on since the 1950s at least, around driving registration, home
         | address, employment and related things. Since that is in the
         | USA, with newer laws and an alleged emphasis on citizen rights,
         | I can only imagine that other large political powers have had
         | this for centuries.
        
         | ClumsyPilot wrote:
         | this reads like a supply chain of a drug cartel
        
         | ransackdev wrote:
         | I've been asking where the hell these companies are getting our
         | data to begin with for awhile because it has to be through
         | shady means, even if technically legal.
         | 
         | Tracking a user and selling that data should not be able to be
         | slapped deep down in some TOS that grants intrusion into your
         | life at that level. I wish laws would be changed to require
         | explicit tracking requests for this type of data, that has to
         | be conspicuous and separately authorized in addiction to any
         | TOS.
         | 
         | I wonder if these are all shell companies to hide the "origin
         | server" for this CDN of unauthorized surveillance data.
         | 
         | I'm also curious how many of these are just middle men that do
         | nothing but markup and resell, vs how many of these companies
         | do anything to enrich the data before flipping it.
         | 
         | Wouldn't it be funny if someone were to use these systems to
         | get the location information for the executives at all of these
         | companies, and it ended up online everywhere? I wonder if they
         | would change their opinions on technical loopholes allowing the
         | tracking of people without consent
        
           | ianlevesque wrote:
           | The answer is in the comment you replied to, "directly from
           | telecommunications services providers".
        
             | ransackdev wrote:
             | Still doesn't answer my question of where my PII was
             | acquired.
        
               | mcculley wrote:
               | I don't understand your question. Your telecom provider
               | has your PII.
        
               | ransackdev wrote:
               | I'd like a definitive list which contains the source for
               | each piece of data, the means that source acquired it,
               | when they acquired it, and proof of my consent for it to
               | be collected, stored, and sold to other parties who then
               | sell it off to the highest bidder.
               | 
               | "It came from teleco companies" is not due diligence
               | enough for me, and it shouldn't be for you. That answer
               | isn't an answer and the lack of accountability is how the
               | companies continue to violate our right to privacy and
               | flourish.
        
               | ianlevesque wrote:
               | Just to clarify my point I'm not condoning this at all,
               | but the telcos themselves have been selling live location
               | data of their subscribers to aggregator services for
               | years.
               | 
               | It's really infuriating to me that people say Google or
               | Facebook are "selling their data" (they're not, they
               | hoard data and sell targeted ads) when Verizon, T-Mobile,
               | and AT&T literally sell your live, personally
               | identifiable, non-aggregated, location data to third
               | parties, hiding behind their subscriber agreement
               | legalese.
        
               | ianlevesque wrote:
               | One of many sources:
               | https://www.fiercewireless.com/regulatory/t-mobile-to-
               | fight-...
               | 
               | Just google it, more examples are easy to find.
        
               | mcculley wrote:
               | > "It came from teleco companies" is not due diligence
               | enough for
               | 
               | I never claimed this. I replied to the question about how
               | a telecom provider would have PII. My mobile provider
               | knows my legal name and other details. They obviously
               | know which tower is closest to my phone at all times or
               | my phone would not work. That it is terrible of them to
               | sell this data was not in question.
        
               | runlevel1 wrote:
               | Your cell phone company knows your name, address, and can
               | infer where you've been based on the cell towers your
               | phone checks in with. So that one's a given.
               | 
               | Here's a sampling of others:
               | 
               | Mastercard sells information on your purchases.[^1]
               | (Based on the info Oracle had on me, I suspect they might
               | be one of the sources for Oracle Advertising.[^2])
               | 
               | Equifax, who gets information from your bank, your car
               | insurance company, your cable company, and loads of other
               | places, makes a nice profit off selling your
               | info.[^3][^4]
               | 
               | ISPs know who you are, can infer a lot about you from
               | unencrypted DNS queries and HTTPS SNI snooping, and
               | they're happy to sell information about you.[^5]
               | 
               | Then there are several tiers of companies that buy
               | information from various other companies, aggregate it,
               | and then sell that off. A veritable snowball rolling down
               | a hill of privacy violation.
               | 
               | [1]: https://www.wired.com/2012/10/mastercard-data-
               | mining-holiday...
               | 
               | [2]: https://datacloudoptout.oracle.com/request-your-
               | data/verify-...
               | 
               | [3]: https://www.inc.com/associated-press/equifax-data-
               | money.html
               | 
               | [4]: https://www.equifax.com/about-equifax/why-
               | equifax/differenti...
               | 
               | [5]: https://www.vice.com/en/article/93b9nv/internet-
               | service-prov...
        
               | ianlevesque wrote:
               | And for completeness, here's an article about the
               | telecoms themselves:
               | https://www.washingtonpost.com/news/the-
               | switch/wp/2018/06/19...
        
           | wildrhythms wrote:
           | Our gerontocracy is unprepared to deal with issues related to
           | technology and privacy. I don't think these data brokers need
           | to hide at all. We already see how legislators (failed to)
           | comprehend issues related to technology in the many of
           | unproductive congressional hearings over the past few years
           | (Google, Tiktok, Twitter, Facebook... all brought before
           | congress with nothing to show for it now). I think issues of
           | technology and privacy are moving too fast for our
           | gerontocracy to possibly keep up.
           | 
           | And I think our legislators show their ass in the case of the
           | Tiktok hearing; effectively stating oh it's fine if the data
           | is being bought and sold _by a US company_ (Oracle).
        
             | ransackdev wrote:
             | If our legal system isn't prepared to properly handle such
             | things then it should default to being illegal to collect
             | and sell data until the legislation is created to properly
             | protect the rights of those who put them in office and pay
             | their salaries.
             | 
             | The default of "you will be violated until we get to it, if
             | we are able to comprehend it" is a dystopia I hadn't
             | imagined, yet here we are.
        
       ___________________________________________________________________
       (page generated 2023-07-09 23:01 UTC)