The FBI is buying Americans’ location data

In a hearing before the Senate Intelligence Committee, the FBI director admitted that the agency is turning to data brokers to get around warrant requirements.

The Verge
@evacide @mastodonmigration Along with the insurance industry and pretty much everything else that has become an "industry" rather than a service.

@heafnerj @evacide @mastodonmigration

IaaS? industry as a service, or SaaI?

@evacide Kash, no need to buy my location data: this whole time I’ve been at your mom’s house.
@evacide Nobody voluntarily shares their precise location history with the FBI when they download a flashlight app. The consent buried in a 47-page terms of service that nobody reads isn't consent in any meaningful sense of the word. It's legal infrastructure designed to manufacture the appearance of consent while eliminating its substance.
@bayo @evacide I know I probably haven't actually downloaded a flashlight app in over a decade, but I don't actually recall even needing to agree to a ToS that a lot of these apps could bury their "consent" in. I just tapped the "install" button.
@bayo @evacide "legal infrastructure designed to manufacture the appearance of consent while eliminating its substance."
Thanks, I've been looking for a concise phrase to capture the difference between self-governance and government, and I think this really gets to the heart of it.
These data brokers have been building on top of layer upon layer of consent-stripping infrastructure put in place by corporations and governments, all of it designed to simultaneously remove our ability to protect ourselves from it

@bayo @evacide @YellowReadis
Spot on.

A Hobson’s choice means we need to be covered by a higher tier of law than a contract. Fortunately, a contract is at the bottom but what it means is that your law makers are letting this be so.

If the law doesn’t override it as a bad term, it means your lawmakers have constructed a system where they want this. Ironically they plead ignorance as their defence. So yes. The system is engineered to facilitate overreach.

https://en.wikipedia.org/wiki/Hobson's_choice

Hobson's choice - Wikipedia

@bayo @evacide

In this German/French documentary, a French newspaper discovers location data from its own news app in the location dataset of a data broker. They couldn’t explain how this could have happened, since they don’t collect this data themselves.

The Film also shows that not only intelligence agencies can use such data, but also stalkers and other equally “charming” individuals.

https://www.arte.tv/de/videos/123951-000-A/gefaehrliche-apps-im-netz-der-datenhaendler/

Gefährliche Apps - Im Netz der Datenhändler - Die ganze Doku | ARTE

Apps sammeln detaillierte Standortdaten. Die Informationen landen in einem weltweiten Netzwerk aus Datenhändlern und Werbefirmen. Sie verraten Wohnorte und Arbeitsplätze – bis hin zu Bordellbesuchen oder Klinikaufenthalten. Die Dokumentation zeigt, wie leicht Nutzer ins Visier von Stalkern, Kriminellen oder Geheimdiensten geraten können.

ARTE

@bayo @evacide

The documentary is also available on YouTube, in case the first link is geo-restricted.

https://www.youtube.com/watch?v=8O3HJhXdZYQ

Gefährliche Apps - Im Netz der Datenhändler | Doku HD | ARTE

YouTube

@bayo @evacide

Dunno, but having to explicitly approve "Allow Flashlight to access this device's location" doesn't seem like legalistic shenanigans to me.

@bayo @evacide

All are reminders that consent matters everywhere -- inside & outside of bedrooms.

Teach kids consent early & often.

@evacide as long as people are blindly and happily using the services hoarding the data, data brokers will be around.

only the society can kill them, but society is lazy and not interested.

@utf_7 @evacide >> as long as people are blindly and happily using the services hoarding the data, data brokers will be around.

I can’t opt out of having my data collected and then sold to data brokers by credit bureaus and if you’re American, you can’t either.

And that’s just the example I can think of off the top of my head.

@MisuseCase @utf_7 @evacide there are plenty of little ways to add friction to the system. Everything helps. E.g. the Duckduckgo Android app comes with a tracking blocker. I've not used any of these apps recently!

@JSAMcFarlane @utf_7 @evacide I do stuff like that and also pay a service that removes me from most data broker lists.

But my point is that you can’t stay out of data brokers’ databases by not using Instagram, or using VPNs, or whatever. Maybe you can stay off their lists by living off the grid in the woods and not even having a bank account. But maybe not even then.

@MisuseCase @JSAMcFarlane @evacide

how do they get your data then when not using their services?

@utf_7 @MisuseCase @evacide I presume they're running in the background. I don't generally go out of my way to grant permissions to apps, but they're under pressure to assist the brokers in collecting data from us all the time.

Try installing DuckDuckGo just to turn on the service. It's basically a firewall (and a leaky one at that). You'll be shocked how much data all your apps are giving up about you!

@JSAMcFarlane @MisuseCase @evacide

i have e/os with an integrated blocker

@utf_7 @JSAMcFarlane @evacide If you have a bank account, lines of credit, a mortgage, or pretty much anything where you interact with the financial system, the credit bureaus have your data.

Many other countries have their central banks or a government agency track creditworthiness. In the U.S. we have what amounts to a sanctioned cartel of private companies doing it.

@evacide I'd love to see more folx poisoning data.
@alice @evacide i feel like i have a decent enough homelab set up where i could get into it but i dont know where to start. 😅
@miclgael @alice @evacide Same! I would love to know, even a handful of steps.

@garyseven @alice @evacide

i know alice has some cool repos with tools for this - is that enough? 😆

edit: see utm_defiler, paraminator

https://codeberg.org/alicewatson

Alice Watson

Interested in 🌈#LGBTQIA+🌈 topics, #cute things 🐾, #tech, #data #privacy, #osint 🕵, #infosec, #Linux, #OpenSource and a host of other things!

Codeberg.org

@miclgael that was a proof of concept, and needs a lot of work. I'd love to see AdNauseam or uBlock Origin pick the idea up and roll it into their plugins.

@garyseven @evacide

@alice @garyseven @evacide

feeling inspired to maybe pivot my own silly poc extension toward this goal. https://codeberg.org/miclgael/firefox-no-shit-shirlock

firefox-no-shit-shirlock

Filter out AI slop and social media spam from YouTube and DuckDuckGo search results

Codeberg.org
@miclgael Yes! Thank you so much. On it!
🅰🅻🅸🅲🅴 (🌈🦄) (@[email protected])

@[email protected] anywhere. The goal is to make corporate data less profitable. Even stuff as simple as setting your birthdate to 1970-01-01 everywhere, adding [TEST] or [DELETED] as your name or account notes anywhere you don't need them to know your name. Using plugins like AdNauseam to poison ad trackers (and cost them marketing dollars). Using VPNs set to different locations. Signing into data broker sites to "correct" outdated info (they'll often let you do that with little-to-no proof of identity, but will require your passport or state ID in order to delete your info). Bonus points if you correct it to someone else's info on their site that's similar to yours. Only fill in required fields when you sign up for anything, but only provide correct info if it matters for you to use the service, otherwise provide plausible, but incorrect, data. If you use LLMs anywhere, use the free tier and always vote thumbs up for bad answers and down for good ones. It wastes their resources and drives up their costs while making their training data worse. @[email protected]

LGBTQIA.Space

@miclgael anywhere. The goal is to make corporate data less profitable.

Even stuff as simple as setting your birthdate to 1970-01-01 everywhere, adding [TEST] or [DELETED] as your name or account notes anywhere you don't need them to know your name.

Using plugins like AdNauseam to poison ad trackers (and cost them marketing dollars).

Using VPNs set to different locations.

Signing into data broker sites to "correct" outdated info (they'll often let you do that with little-to-no proof of identity, but will require your passport or state ID in order to delete your info). Bonus points if you correct it to someone else's info on their site that's similar to yours.

Only fill in required fields when you sign up for anything, but only provide correct info if it matters for you to use the service, otherwise provide plausible, but incorrect, data.

If you use LLMs anywhere, use the free tier and always vote thumbs up for bad answers and down for good ones. It wastes their resources and drives up their costs while making their training data worse.

@evacide

@alice @miclgael @evacide
I have already been entering random dates for my Date of Birth because I just assumed that was part of the authentication info—like a poor man's 2FA. I'm always surprised when I unexpectedly get happy birthday wishes from some automated system.

@bornach the reason to use 1970-01-01 is because it's Unix epoch time, and usually means something is formatted as a date, but has invalid data. In my years in marketing, it's often discarded when using birthdate to determine age demographics for campaigns, because it's *more likely* to be an error than a real birthdate, and it's easier to discard anything that whiffs of bad data, because sending marketing materials costs money.

@miclgael @evacide

@alice @bornach @miclgael @evacide or use Feb 29th on a non leap year if it lets you. Programmers love this.

@alice @bornach @miclgael @evacide I've tended to use April 1, (randomish year) but your argument for 1970-01-01 is enticing.

Wonder what I'll get if I enter @0 into a few date fields.

@alice @miclgael @evacide If you want to really ruin the day of developers, throw random broken unicode characters and html entities into strings to make it look like the encoding failed

@ellesaurus @alice @miclgael @evacide

I see you have chosen violence, Elle. Time will tell if that was the optimal path for you.

@ellesaurus @alice @miclgael @evacide

"All user input is evil."

@Enema_Cowboy All user inputs are evil, but some user inputs are more evil than others

@ellesaurus @alice @miclgael @evacide

Why, hello random site! My name is
�€ý and I'm [object Object] years old.

(Yes, please don't point at the irony of me using my real name on here)

@alice @evacide Just saying, I chuckle every time receiving email with greeting: Dear Chujcie. As my name is given as Chujcie Toobchodzi. Which is a very rude way to say "you don't need to know it". 😊
@evacide it does, but not only because it harms americans, it harms humanity, and there's also something very wrong about the USA Government, which is as guilty of this harm, likely more guilty.

@evacide

I say this often, and with fervor!

@evacide Plus, government bodies are funded by taxpayer dollars, so we're paying for our own surveillance.

@evacide

Patel is a scourge on the civil liberties of Americans. He serves an autocrat. The only positive news of his appointment is that he is dumb. .

If the government has access to and the power to buy such data, they will always choose to buy it
@evacide

Not that the databroker industry mustn't be destroyed, but what
really needs to happen (with respect to law-enforcement and intelligence, specifically) is that purchasing as a 4A-circumvention should be treated exactly the same as a direct 4A-violation.

When it comes to data-aggregators, they should be forced to operate under the same kinds of data-protection frameworks as other data-collectors:

• Created a medical profile from direct and indirect indicators? Congratulations, your database is now subject to HIPAA and related protection- and disemmination-frameworks.

• Created a financial profile? Congratulations, you need to be PCI/DSS compliant and need to operate under the same explicit permissions strictures the government does (you have to explicitly consent to all sharing and the consent can't be a dense, "wall-of text, click here to pretend you read and understand it" vehicle)

• Etc.

Basically, allow them to exist, but make the expense of maintaining those products so high as to basically be not worth doing.
@evacide It's absolutely true that modern information brokers are evil, but haven't federal and local agencies been buying this data for decades already?
@evacide I know not everyone can, but using something like @kagihq helps a lot with privacy (they have added anonymity options like Tor service, pay in crypto and a privacy pass)
I truly believe that search is actually not free, you are just not paying up front
@evacide And, when they have enough data, they will begin to arrest DJT's political enemies.

@evacide I do not understand how this has ever been legal. I have been around so many people discussing how creepy China's surveillance state is (and it is) but who don't have any particular problem with the data broker industry in the US. Many people see it as maybe creepy, but not a real problem. We just outsourced the work.

"They have cameras everywhere" Lady, you have a Ring doorbell on your porch.

@evacide Do you have several billions a year to lobby congress? Those selling the data do.

@dascandy If I thought that activism couldn't achieve victories against a better-funded opponent, I would have gone into a different line of work.

In California, for example, we have the DELETE Act, which is a big step in the right direction: https://privacy.ca.gov/drop/about-drop-and-the-delete-act/

@evacide Well thank god we don't have chinese ev's

@evacide

And data centers must be destroyed.

@evacide You need to start that statement with “ceterum censeo.” 😉