#usausausa | Explore Tumblr Posts and Blogs

mostlysignssomeportents · 1 year

Text

We should ban TikTok('s surveillance)

With the RESTRICT Act, Congress is proposing to continue Trump’s war on Tiktok, enacting a US ban on the Chinese-owned service. How will they do this? Congress isn’t clear. In practice, banning stuff on the internet is hard, especially if you don’t have a national firewall:

https://doctorow.medium.com/theyre-still-trying-to-ban-cryptography-33aa668dc602

If you’d like an essay-formatted version of this post to read or share, here’s a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2023/03/30/tik-tok-tow/#good-politics-for-electoral-victories

My guess is that they’re thinking of ordering the mobile duopoly of Google and Apple to nuke the Tiktok app from their app stores. That’s how they do it in China, after all: when China wanted to ban VPNs and other privacy tools, they just ordered Apple to remove them from the App Store, and Apple rolled over:

https://pluralistic.net/2022/11/11/foreseeable-consequences/#airdropped

That’s the completely foreseeable consequence of arrogating the power to decide which software every mobile user on earth is entitled to use — as Google and Apple have done. Once you put that gun on the mantelpiece in Act I, you damn betcha that some strong-man backed by a powerful state is going to come along and shoot it by Act III.

The same goes for commercial surveillance: once you collect massive, nonconsensual dossiers on every technology user alive, you don’t get to act surprised when cops and spies show up and order your company to serve as deputies for a massive, off-the-books warrantless surveillance project.

Hell, a cynic might even say that commercial surveillance companies are betting on this. The surveillance public-private partnership is a vicious cycle: corporations let cops and spies plunder our data; then the cops and spies lobby against privacy laws that would prevent these corporations from spying on us:

https://pluralistic.net/2023/01/25/nationalize-moderna/#hun-sen

Which makes the RESTRICT Act an especially foolish project. If the Chinese state wants to procure data on Americans, it need not convince us to install Tiktok. It can simply plunk down a credit card with any of the many unregulated data-brokers who feed the American tech giants the dossiers that the NSA and local cops rely on.

Every American tech giant is at least as bad for privacy as Tiktok is — yes, even Apple. Sure, Apple lets its users block Facebook spying with a single tap — but even if you opt out of “tracking,” Apple still secretly gathers exactly the same kinds of data as Facebook, and uses it to power its own ad product:

https://pluralistic.net/2022/11/14/luxury-surveillance/#liar-liar

There is no such thing as a privacy-respecting tech giant. Long before Apple plastered our cities with lying billboards proclaiming its reverence for privacy, Microsoft positioned itself as the non-spying alternative to Google, which would be great, except Microsoft spies on hundreds of millions of people and sells the data:

https://pluralistic.net/2020/11/25/the-peoples-amazon/#clippys-revenge

Tech’s surveillance addiction means that Tiktok’s own alternative to the RESTRICT Act is also unbelievably stupid. The company has proposed to put itself under Oracle’s supervision, letting Oracle host its data and audit its code. You know, Oracle, the company that built the Great Firewall of China 1.0:

https://www.eff.org/deeplinks/2010/01/selling-china-surveillance

We should not trust Tiktok any more than we trust Apple, Facebook, Google or Microsoft. Tiktok lied about whether it was sending data to China before:

https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access

And even if it keeps its promise not to send user data to China, that promise is meaningless — it can still send the vectors and models it creates with that data to China — these being far more useful for things like disinformation campaigns and population-scale inferences than the mere logs from your Tiktok sessions.

There are so many potentially harmful ways to process commercial surveillance data that trying to enumerate all the things that a corporation is allowed to do with the data it extracts from us is a fool’s errand. Instead, we should ban companies from spying on us, whether they are Chinese or American.

Corporations are remorseless, paperclip-maximizing colony organisms that perceive us as inconvenient gut-flora, and they lack any executive function (as do their “executives”), and they cannot self-regulate. To keep corporations from harming us, we must make it illegal for them to enact harm, and punish them when they break the law:

https://doctorow.medium.com/small-government-fd5870a9462e

After all, the problem with Tiktok isn’t the delightful videos or the fact that it’s teaching a generation of children to be expert sound- and video-editors. The problem with Tiktok is that it spies on us. Just like the problem with Facebook isn’t that it lets us communicate with our friends, and the problem with Google isn’t that it operates a search engine.

Now, these companies will tell you that the two can’t be separated, that a bearded prophet came down off a mountain with two stone tablets, intoning, “Larry, Sergey, thou shalt stop rotating thine logfiles and, lo, thou wilt data-mine them for actionable market intelligence.” But it’s nonsense. Google ran for years without surveillance. Facebook billed itself as the privacy-forward alternative to Myspace and promised never to spy on us:

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362

The inevitabilist narrative that says that corporations must violate our rights in order to make the products we love is unadulterated Mr Gotcha nonsense: “Yet you participate in society. Curious. I am very intelligent”:

https://thenib.com/mister-gotcha/

Of course, corporations push this narrative all the time, which is why American Big Tech has been quietly supporting a ban on Tiktok, which (coincidentally) has managed to gain a foothold in the otherwise impregnable, decaying, enshittified oligarchy that US companies have created.

They have conspicuously failed to call for any kind of working solution, like a federal privacy law that would ban commercial surveillance, and extend a “private right of action,” so people could sue tech giants and data-brokers who violated the law, without having to convince a regulator, DA or Attorney General to bestir themselves:

https://www.eff.org/deeplinks/2019/01/you-should-have-right-sue-companies-violate-your-privacy

Instead, the tech giants have the incredible gall to characterize themselves as the defenders of our privacy — at least, so long as the Chinese government is the adversary, and so long as its privacy violations come via an app, and not buy handing a credit card to the data-brokers that are the soil bacteria that keeps Big Tech’s ecosystem circulating. In the upside-down land of Big Tech lobbying, privacy is a benefit of monopoly — not something we have to smash monopolies to attain:

https://www.eff.org/wp/interoperability-and-privacy

Not everyone in Congress is onboard with the RESTRICT Act. AOC has come out for a federal privacy law that applies to all companies, rather than a ban on an app that tens of millions of young Americans love:

https://www.businessinsider.com/aoc-first-tiktok-congress-ban-without-being-clued-in-2023-3

You know who agrees with AOC? Rand Paul. Yes, that absolute piece of shit. Paul told his caucusmates in the GOP that banning an app that millions of young American voters love is bad electoral politics. This fact is so obvious that even Rand fucking Paul can understand it:

https://gizmodo.com/rand-paul-opposes-tiktok-ban-warns-republicans-1850278167

Paul is absolutely right to call a Tiktok ban a “national strategy to permanently lose elections for a generation.” The Democrats should listen to him, because the GOP won’t. As between the two parties, the GOP is far more in thrall to the Chamber of Commerce and the rest of the business lobby. They are never going to back a policy that’s as good for the people and as bad for big business as a federal privacy law.

The Democrats have the opportunity to position themselves as “the party that wants to keep Tiktok but force it to stop being creepy, along with all the other tech companies,” while the GOP positions itself as “the party of angry technophobes who want to make sure that any fun you have is closely monitored by Mark Zuckerberg, Sundar Pinchai and Tim Cook and their pale imitations of the things you love about Tiktok.”

That’s not just good electoral politics — it’s good policy. Young voters aren’t going to turn out to the polls for performative Cold War 2.0 nonsense, but they will be pissed as hell at whoever takes away their Tiktok.

And if you do care about Cold War 2.0, then you should be banning surveillance, not Tiktok; the Chinese government has plenty of US dollars at its disposal to spend in America’s freewheeling, unregulated data markets — as do criminals, petty and organized, and every other nation-state adversary of the USA.

The RESTRICT Act is a garbage law straight out of the Clinton era, a kind of King Canute decree that goes so far as to potentially prohibit the use of VPNs to circumvent its provisions. America doesn’t need a Great Firewall to keep itself safe from tech spying — it needs a privacy law.

Have you ever wanted to say thank you for these posts? Here’s how you can: I’m kickstarting the audiobook for my next novel, a post-cyberpunk anti-finance finance thriller about Silicon Valley scams called Red Team Blues. Amazon’s Audible refuses to carry my audiobooks because they’re DRM free, but crowdfunding makes them possible.

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

[Image ID: A modified vintage editorial cartoon. Uncle Sam peeks out over a 'frowning battlement' whose cannon-slots are filled with telescopes from which peer the red glaring eyes of HAL 9000 from '2001: A Space Odyssey.' Topping the battlements in a row are Uncle Sam and three business-suited figures with dollar-sign-bags for heads. The three dollar-bag men have corporate logos on their breasts: Facebook, Google, Apple. Standing on the strand below the battlements, peering up, is a forlorn figure with a Tiktok logo for a head. The fortress wall bears the words 'RESTRICT Act.']

#rand paul is right actually ugh ugh ugh #politics #oracle #restrict act #privacy #privacy without monopoly #tiktok #commercial surveillance #trade war #bytedance #apple #google #facebook #meta #usausausa #generational warfare #electoral strategy #pluralistic #aoc

116 notes · View notes

mostlysignssomeportents · 10 months

Text

A "secure" system can be the most dangerous of all

Two decades ago, my life changed forever: hearing Bruce Schneier explain that “security” doesn’t exist in the abstract. You can only be secure from some threat. A fire alarm won’t protect you from burglaries. A condom won’t protect you from mass shootings. It seems obvious, but how often do we hear about “security” without any mention of who is being made secure, and from which threat?

Take the US welfare system. It is very “secure” in that it is hedged in by a thicket of red-tape, audits, inspections and onerous procedures. To get food stamps, housing vouchers, or cash aid, you must navigate a Soviet-grade bureaucratic system of Kafkaesque proportions. Indeed, one of the great ironies of the post-Cold War world is that the USA has become a “Utopia Of Rules” (as David Graeber put it), subjecting everyday people to the state-run bureacracies that the USAUSAUSA set endlessly ridiculed the USSR for:

https://memex.craphound.com/2015/02/02/david-graebers-the-utopia-of-rules-on-technology-stupidity-and-the-secret-joys-of-bureaucracy/

(The right says it wants to “shrink the US government until fits in a bathtub — and then drown it” — but not the whole government. They want unlimited government bloat for that part of the state that is dedicated to tormenting benefits claimants, especially if its functions are managed by a Beltway Bandit profiteer who bills Uncle Sucker up the wazoo for rubber-stamping “DENIED” on every claim.)

The US benefits system has a sophisticated, expensive, fully staffed anti-fraud system — but it’s a highly selective form of anti-fraud. The system is oriented solely to prevent fraud against itself, with no thought to protecting benefits recipients themselves from fraud.

And those recipients — by definition the poorest and most vulnerable among us — are easy pickings for continuous, ghastly, eye-watering acts of fraud. These benefits are distributed via prepaid debit cards — EBT Cards — that lack the basic security measures that every other kind of card has had for years. These are simple magstripe cards, lacking basic chip-and-pin defenses, to say nothing of contactless countermeasures.

That means that fraudsters can — and do — install skimmers in the point-of-sale terminals used by benefits recipients to withdraw their cash benefits, pay for food using SNAP (AKA Food Stamps), and receive other benefits.

It’s impossible to overstate how widespread these skimmers are, and how much money criminals make by stealing from poor people. Writing for Businessweek, Jessica Fu describes the mad scramble benefits recipients go through every month, standing by ATMs at midnight on the night of the first of every month in hopes of withdrawing the cash they use to pay for their rent and utility bills before it is stolen by a crook who captured their card number with a skimmer:

https://www.bloomberg.com/news/features/2023-06-28/ebt-theft-takes-millions-of-dollars-from-the-neediest-americans

One of Fu’s sources, Lexisnexis Risk Solutions’s Haywood Talcove, describes these EBT cards as having the security of a “glorified hotel room key.” He recounts how US police departments saw a massive explosion in EBT skimming: from 300 complaints in January 2022 to 18,000 in January 2023.

The skimmer rings are extremely well organized. The people who install the skimmers — working in pairs, with one person to distract the cashier while the other quickly installs the skimmer — don’t know who they work for. Neither do the people who use cards cloned from skimmer data to cash out benefits recipients’ accounts. When they are arrested, they refuse to turn on their immediate recruiters, fearing reprisals against their families.

These low-level crooks stroll up to ATMs and feed a succession of cloned cards into them, emptying account after account. Or they swipe cards at grocery checkouts, buying cases of Red Bull and other easily sold grocery products with some victim’s entire SNAP balance.

Some police agencies are pursuing these criminal gangs and trying figure out who’s running them, but the authorities who issue SNAP cards are doing little to nothing to stop the pipeline at their end. Simply upgrading SNAP terminals to chip-and-pin would exponentially raise the cost and complexity that thieves incur.

Indeed, that’s why every other kind of payment card uses these systems. How is it that these systems were upgraded, while SNAP cards remain in mired in 20th century “glorified hotel room key” territory? Well, as our friends on the right never cease to remind us: “incentives matter.”

When your credit card gets cloned, it’s your banks and credit card company that pays for the losses, not you. So the banks demanded (and funded) the upgrade to new anti-fraud measures. By contrast, most states have no system for refunding stolen benefits to skimmers’ victims.

In other words, all of the anti-fraud in the benefits system is devoted to catching benefits cheating — a phenomenon that is so rare as to be almost nonexistent (1.54%), notwithstanding right wingers’ fevered, Reagan-era folktales about “welfare queens”:

https://blog.gitnux.com/food-stamp-fraud-statistics/

Meanwhile, the most widespread and costly form of fraud in the benefits system — fraud perpetrated against benefits recipients — is blithely ignored.

Really, it’s worse than that. In deciding to protect the welfare system rather than welfare recipients, we’ve made it vastly harder for benefits claimants who’ve been victimized by fraudsters to remain fed and sheltered. After all, if we made it simple and straightforward for benefits recipients to re-claim money that was stolen from them, we’d make it that much easier to defraud the system.

“Security” is always and forever a matter of securing some specific thing, against some specific risk. In other words, security reflects values — it reveals whose risk matters, and whose doesn’t. For the American benefits system, risks to the system matter. Risks to people don’t.

It’s not just the welfare system that prioritizes its own risks against the people it exists to serve. Think of the systems used to fight drug abuse in clinical settings.

Medical facilities that use or dispense powerful pain-killers have exquisitely tuned, sophisticated, frequently audited security systems to prevent patients from tricking their doctors or pharmacists into administering extra drugs (especially opioids). “Extra” in this case means “more drugs than are strictly necessary to manage pain.”

The rationale for this is only incidentally medical. Someone who gets a little too much painkiller during a medical procedure or an acute pain episode is not at any particular risk of enduring harm — the risks are minor and easily managed (say, by keeping a patient in bed a little longer while they recover from sedation).

The real agenda here is preventing addiction and abuse by addicted people. There’s a genuine problem with opioid abuse, and that problem does have its origins in overprescription. But — crucially — that overprescription wasn’t the result of wimpy patients insisting on endless painkillers until they enslaved themselves to their pills.

Rather, the opioid epidemic has its origins in the billionaire Sackler crime family, whose Purdue Pharma used scientific fraud, cash incentives, and other deceptive practices to trick, coerce, or bribe doctors into systematically overprescribing their Oxycontin cash cow, even as they laundered their reputation with showy charitable donations:

https://pluralistic.net/2021/07/12/monopolist-solidarity/#sacklers-billions

The Sacklers got to keep their billions — and people undergoing painful medical procedures or living with chronic pain are left holding the bag, subject to tight pain-med controls that forces them to prove — through increasingly stringent systems — that they truly deserve their medicine.

In other words, the beneficiary of the opioid control system is the system itself — not the patients who need opioids.

There’s an extremely disturbing — even nightmarish — example of this in the news: the Yale Fertility Clinic, where hundreds of women endured unimaginably painful egg harvesting procedures with no anaesthesia at all.

These women had complained for years about the pain they suffered, and many had ended up needing emergency care after the fact because of traumatic injuries caused by undergoing the procedure without pain control. But the doctors and nurses at the Yale clinic ignored their screams of pain and their post-operative complaints.

It turned out that an opioid-addicted nurse had been swapping the fentanyl in the drug cabinet for saline, and taking the fentanyl home for her own use.

This made national headlines at the time, and it is the subject of “The Retrievals,” a new New York Times documentary series podcast:

https://www.nytimes.com/2023/06/22/podcasts/serial-the-retrievals-yale-fertility-clinic.html

If the pain medication management system was designed to manage pain, then these thefts would have been discovered early on. If the system was designed so that anyone who experienced pain was treated until the pain was under control, the deception would have been uncovered almost immediately.

As Stafford Beer said, “the purpose of any system is what it does.” The pain medication management system was designed to manage pain medication, not pain itself.

The system was designed to be secure from opioid-seeking addicted patients. It was not designed to make patients secure from pain. Its values — our values, as a society — were revealed through its workings.

If you’d like an essay-formatted version of this thread to read or share, here’s a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2023/07/13/whose-security/#for-me-not-thee

[Image ID: A down-the-barrel view of a massive, battleship-gray artillery piece protruding from the brick battlement of a fortress. From the black depths of the barrel shines a red neon 'EBT' sign.]

Image: Bjarne Henning Kvaale (modified) https://commons.wikimedia.org/wiki/File:Oscarsborg_28cm_Krupp_cannon_4_-_panoramio.jpg

CC BY-SA 3.0 https://creativecommons.org/licenses/by-sa/3.0/deed.en

214 notes · View notes