Hacker News new | past | comments | ask | show | jobs | submit login
How a Radio Shack Robbery Could Spur a New Era in Digital Privacy (nytimes.com)
122 points by petethomas on Nov 27, 2017 | hide | past | favorite | 48 comments



> Mr. Wessler said prosecutors should be required to obtain a warrant when they seek more than 24 hours’ worth of location data.

When even the defense is saying that you don't actually need a warrant to search phone GPS records, only to conduct long-term nonspecific espionage then the goal-posts have moved so far beyond anything recognizable as rights and into a land of bizarre technicalities with arbitrary bright-lines in the sand completely devoid of the intented meaning of the bill of rights. Here's the only question they should be asking: did you get a warrant? No? Then fuck off.

If you want to submit evidence to convict someone in a court of law, you have to first demonstrate to an unbiased third party that you have the right to gather that evidence. The meaning of that amendment was plain to common people in 1791 and it means the same thing in 2017. Warrant first then you can use it as evidence.


So if I was unlucky enough to be near a couple of the robbery locations, I might be swept up in the dragnet based on my phone location. Even if 6 of 8 robbery locations my phone was clearly elsewhere the police may still try to make a case that I only participated in two of the robberies.

That's some scary excrement right there. There needs to be a much larger burden or proof than location info. Even if a suspected phone is at 8/8 locations (like the robbers have a way of steeling an someone's phone and putting it back before/after a robbery just to help incriminate someone else). (See the movie Rampage)


> So if I was unlucky enough to be near a couple of the robbery locations, I might be swept up in the dragnet based on my phone location. Even if 6 of 8 robbery locations my phone was clearly elsewhere the police may still try to make a case that I only participated in two of the robberies.

I don't think you are reading this right. This wasn't some random person who happened to be in the same place as the robberies. I believe one of the robbers testified that he was their ringleader.

I feel like the cellphone data needlessly jeopardized the whole operation. A judge would probably have given an actual warrant to search online data for 12 people on the contact list of the robber. But this is the thing: the police in this case were used to getting by without a warrant and so probably didn't think twice about getting all that data (which they should). The question being considered is whether that warrant less search is illegal.

If SCOTUS does overturn this decision, the guy's conviction would be thrown out causing much outrage. I hope they do: the privacy laws are clearly not strong enough.


A former lawyer on Planet Money discussed this case and said that it may not throw out the conviction. That the "Good Faith" exception may allow the conviction to stand.


That could be true, I was mainly going off the article's notion that it was the 127 days of phone records - and if it was all phones nearby or his phone records wasn't clear in the article.


Are you sure that the conviction would be thrown out?

SCOTUS rules all the time to reverse precedents set by a lower court while moving finding of fact to the original venue.


Get scared. you can be arrested, tried, and convicted, all for dealing non existent drugs where the driving force behind it all was the law enforcement scam that put it all in place and dropped hints.

I know some distrust Cato, but please read the following and tell me, how do we protect ourselves from such as this without dragging it out in the open?

https://www.cato.org/blog/stash-house-stings-when-government...

So we best hope the Supreme Court decides there was over reach in gathering cell data because its apparent some district courts are more than willing let law enforcement create a crime and manufacturer criminals as needed


And you know there's a LE conversation happening that goes, "well, if they didn't commit this crime, we have plenty of unsolved ones to compare the data against."


Pretty much. The sales guy from Seisent (bought by Lexis/Nexus) gave examples of their data mining of demographic data helped solve cold cases. Back in 2005. Both awesome AND scary.


> See the movie Rampage

Which one? https://en.wikipedia.org/wiki/Rampage


The 2009 one, directed by Uwe Boll

https://en.wikipedia.org/wiki/Rampage_(2009_film)


It's a start, but the real problem is that the data exists in the first place. Modern "surveillance capitalism" is the underlying cancer, and warrantless government snooping and targeted ads are just symptoms.


Is it?

There are valid reasons why cellular provider would create that information in the first place - largely to do with automated network repair stuff (you can find malconfigured neighbor lists in CDMA systems for example), or automated network metrics.

The issue isn't creating this kind of data, its excessive retention, warrantless government use of it, and using it as another revenue stream to tell it to third parties - but the generation itself on the surface seems perfectly valid.


> The issue isn't creating this kind of data, its excessive retention,...

Exactly. As Maciej Ceglowski (@idlewords) has put it, companies should view data as nuclear waste: http://idlewords.com/talks/haunted_by_data.htm

I would say it's more like human waste: it's necessary, and you can do useful things with it, but you don't want to keep it around.


Even for TDMA networks you need some surprisingly precise idea of where the user is (more precise than which is used for call routing) for the radio interface to actually work. This has to do with the need to compensate for speed of light to retain synchronisation of the radio interface framing (for GSM-like TDMA this is mostly relevant for rural areas and gets you precision of ~250m, but it has to be significantly more precise for CDMA) and with planing of handovers.

Storing some of this stuff might be valid for diagnostics and network planning, but it is mostly stored as part of government required (meta)data retention policies. Whether telcos really have to store this kind of data is somewhat questionable and certainly jurisdiction-specific, but usually they just dump all signalisation traffic somewhere and are done with it with the expectation that it is simpler and cheaper to store all of it than to design (which involves legal analysis) and implement some kind of filtering mechanism.


As a foreigner i have found it highly annoying how US companies, particular Amazon, simply store my credit card data without any clear prompting or similar.

If i want to trade there, i am perfectly capable of inputting the various digits and such each time, thank you very much.


It's harder for folks to make impulse purchases if they have to take time to locate their credit card and enter the digits every time. This behavior you have observed is by design.


In other words, the US consumer economy is a massive hamster wheel...


That may be true, but I'm not sure how you glean it just from the observation that smart companies try to make it as easy as possible for customers to spend money with them. Every smart businessman since the stone age has tried to do the same thing.


Making something easy is one thing. Forcing users to use the "easy" thing while risking customer funds, security and privacy is maleficent.


Sure, it's business pocketing benefits and shirking costs. I'm not saying it's not bad, just that I'm not sure how this relates to "the US consumer economy [being] a massive hamster wheel". It was either a non-sequitor or I don't see the logical connection, if there is one.


In the US, our funds aren't at risk. If someone hacks my Amazon account and steals my credit card info, the credit card company will cover any losses (and presumably go after Amazon to recover them.) The incentives of the various parties are actually pretty rationally aligned here.

So I'll thank you for not making it more of a pain in the neck to buy stuff online than it already is.


Finally someone addressed digi_owl's point that it wasn't about making it easy but that Amazon didn't clearly state the number would be recorded and saved in a database.

Most other non-Amazon shopping carts have checkboxes like "Store this credit card for future purchases" but I imagine we could make better payment solutions by pushing all risk to a QR code (instead of NF) + Apple/Android Pay + payment agreement button on the phone.


As soon as you input and use it once, it is recorded roughly forever. There is nothing to be gained from typing it every time.


It's unfortunate that so often the constitution is defended in cases where there's clear wrongdoing, but I sure hope the fourth is upheld, and law enforcement learns to - and is forced to by court rulings - knock it off with massive orwellian surveillance


How else could it be defended? Considering that someone has to show injury before courts will take up a case, it's usually going to be someone that's been charged with a crime whose privacy has been invaded.


ahh i see the lack of clarity - i was referring to cases where the person whose rights were violated was someone clearly guilty of or at least very likely did commit the crime with which they are charged


I think they're saying that people would be more sympathetic and supportive of the amendment if it turned out that the accused was innocent.


The FBI/NSA/Police won't let those cases get to this point.

Every time a case with an innocent starts winding through, the government drops the case, after having caused much grief to the innocent in question, rather than risk having their surveillance powers curtailed.


The point is that if there is such clear wrongdoing, law enforcement should not have to trample a suspect's rights to find such wrongdoing.


Exactly. If they're so guilty then doing everything perfect and by the book should be a walk in the park.


I'd argue its neither massive, nor terribly orwellian, right now its a bunch of private companies generating a huge number of data points, which the government then sometimes uses.

There is no known program to monitor in real time the position of every citizen - right now all of the data the government uses is incidental to the voluntary use of another service. I don't take much issue with the service generating that data - but in no case should it be considered commoditizable nor should the government be able to access it on a whim for whatever purpose the government sees fit.

Right now the process is working as defined, the law exists to constrain abuses, and to a lesser extent prevent them - but the presumption of the founders was that government will always try to take the maximum amount of power it can, and that the courts exist largely to strike the balance.


Planet money did a take on this robbery and its digital privacy implications. Worth a listen.https://www.npr.org/sections/money/2017/11/08/562888974/epis...


There was an interesting discussion about 4A implications between Orin Kerr (who thinks, that according to 3rd party doctrine, there was no need for a warrant, and therefore no 4A protections of cell-cite data) and Alex Abdo (of ACLU, who argues that, since the collection was too excessive, it does trigger 4A protections).

Link: https://www.youtube.com/watch?v=hW32k7x7zE0


My question to any lawyers or legal experts in the room.

Would the opposite be true? If my phone isn't at the location of the crime, can I argue that I also wasn't there?

Therefore a criminal just needs to leave his/her cell phone at home and present the location data as evidence.


No. Because your cellphone may not have been on your person.

If it isn't clear yet: the cellphone records were used to find the suspected ringleader (the appealing person in the case). They weren't the sole evidence for his conviction by lower courts.


I see, so even if the SCOTUS finds the police over reached with the data they gathered, Tiny Tim could still have his sentence upheld.


Hopefully the ruling encompasses other modern technologies and methods for location tracking such as smart tag data, facial recognition and license plate readers. All of them result in data similar to person X was at location Y at time Z.


>urging the Supreme Court to continue to bring Fourth Amendment law into the modern era.

If the Supreme Court can do this, then perhaps it could bring the Second Amendment law into the modern era.


The fundamental premise is no longer valid. It was premised not on the state-based popular militia as a counterbalance to government forces, but the government's dependence on the state-based popular militia to meet it's need for significant forces, with the limited standing forces forming a cadre for a wartime/emergency force comprised nearly entirely of mobilized popular militia. The large standing post-WWII force undermined that premise, and the transition to an all-volunteer force demolished it.

While Fourth Amendment law needs some serious reconsideration of the mechanism by which the protections are best given effect given new technologies and social context, that’s a lot smaller issue than addressing the modern realization of the goals of the Second Amendment.


> The fundamental premise is no longer valid

That is exactly true, but the problem with abiding by a written constitution is that as long as the words are in there, it is the Supreme Law of the land. Its rather unfortunate, but its one of the risks assumed when a country decides on the Constitutional System. And all the political partisanship makes it unlikely that this will be changed (i.e. Constitution changed) anytime soon.


It's funny that you say "bring [it] into the modern era" when countries have been asking citizens to not use weapons for centuries.

https://en.m.wikipedia.org/wiki/Wounded_Knee_Massacre

https://en.m.wikipedia.org/wiki/Disarmament_of_the_German_Je...

You could argue that a 'modern' reimagining would disarm all citizens...except that this would leave us 1) without a militia and 2) with only a military...directly commanded by the President.

If you want to reduce the number of deaths per year, there are better ways to do it. I highly recommend providing a means of getting mental health care to people who need it--except that many people who like being able to have a weapon on hand for self-defense won't want to go, as they fear their ability to defend themselves will be taken away if they are declared to be of unsound mind. The paranoid will refuse because it'll seem like a conspiracy to disarm them, and the sane will refuse because they'd rather not give up the ability to wield a weapon, particularly against a regime that already mirrors the Nazis in uncomfortable ways.


Trying to compare the Second and Fourth for reworking does not work well since they are fundamentally different concepts.

In the case of both amendments the laws enacted surrounding them are the issues. In the case of the fourth amendment there are problematic laws such as civil asset forfeiture that are overreaching and result in the lost of property loss with little to no resource. In the case of the second amendment the laws are usually created by people who don't even know how guns work at a fundamental level.


>In the case of the second amendment the laws are usually created by people who don't even know how guns work at a fundamental level.

Fair enough, then, what fundamental knowledge about guns do you feel would be necessary to enable a lawmaker to enact more reasonable gun legislation?


Taking a gun safety course that teaches the basics of firearms and how they work. Just spending some time talking to a firing range safety officer to help clear up misconceptions.

Off on a tangent the best two examples of bad/attempt legislation I can think of at the moment:

1.) Bans on "silencers". They're actually called suppressors and they don't silence anything. Suppressed weapons typically still have a noise level over 100 decibels and hearing protection still must be worn.

2.) Bans on "scary weapons". The color or stylistic choices of a weapon does not change how deadly a bullet is when it hits a fleshy target. In general bans on characteristics of firearms that do not change how deadly they are.

Best two examples of loop holes that got around poorly written legislation that resulted in wonky interpretation by the ATF:

1.) Bump stocks and hand cranks to get around automatic weapon bans. No one needs automatic weapons for sport shooting or hunting. While I don't speak for everyone I would never want an automatic weapon for either of those since it is useless for them and just wastes ammunition. Current ATF rules require every shot be accompanied by an user initiated action such as a finger movement. So technically those two devices create an user initiated action for every shot per the ATF's interpretation of the written laws. For example a manual hand crank is allowed since the user has to continually perform the action, but the same crank operated by a powered motor and switch would not be allowed since a single user action would result in more than one shot fired.

2.) Being able to shoulder a pistol with a stock that was not intended to be a stock.(Arm brace) This is a weird area of the law. AR-15 pistols(barrel length under 16") are not allowed by shouldered since they are pistols, but you can attach an arm brace and shoulder it anyway. The ATF recently more or less gave up enforcing it since firearms evolved and changed so much since it was original written.

There is a lot more in depth in the world of firearms I could into and how easy it is for a gun owner to accidentally commit a felony due to bad legislation.


What would good legislation look like, then, given that more practical understanding?

I believe you're correct that a lot of gun legislation is driven by an unreasonable fear of guns, and that those laws simply aren't effective as a result. However, I also believe there is also an unreasonable fear among a lot of gun owners regarding the motives behind gun control as well.


> In the case of the second amendment the laws are usually created by people who don't even know how guns work at a fundamental level.

That's funny, I've described a lot of computer laws like that, often specifically with regards to government search of people's data.


Absolutely agreed on that.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: