Privacy

[bzar]

Sorry, then it appears I alluded to a distinction you didn't make.  I don't quite follow what your comment has to do with people putting private data out there for stalkers of one sort of another to pick up on.  if you assume some people won't behave appropriately, doesn't it make sense to reduce the data loss if they didn't?  That doesn't mean I won't be disappointed if they do take a copy of it, especially if they're a government backed agency, but to do less seems naive to me.

It's still about the same. We shouldn't allow snooping to become the new norm, thus blaming the victims for putting themselves at risk. The blame is always at the wrongdoing party, never the victim. We should expect others to behave, but be aware that some disappointing instances will sometimes fail to live up to those standards. When you expect everyone to behave, you never blame the one being misbehaved at no matter how easy they make it. Never fall to a cynical "well, it's the government/police/corporation/fifa/whatever, what did you expect?". Expect better.

 

[WizardStan]

You shouldn't expect people to act poorly. You should expect people to respect your privacy. You should expect everyone to act responsibly and when they don't they have failed to meet your expectations.


It's back to a matter of culpability and how people react to expectations. Like, suppose you're at a coffee shop, you step away for a minute, and when you turn back your laptop is gone, and people tell you "you should have expected someone to take it and been more careful": the implied statement is "it's your fault your laptop was stolen". No, it is not your fault, it is the fault of the the person who took it. If you expect people to behave then there's no implicit fault on your part, it is the person who did the thing that unambiguously failed to meet expectations.


See what I'm saying?

 

[levi]

I suspect we're just arguing semantic minutiae now, because I agree that I'm disappointed in the criminals when they copy personally identifiable data from computers, but people are blaming the likes of Talktalk for not securing their systems properly, to take a recent example, and there is a suggestion that they are at fault, and should have known better.


I agree leaving your laptop unsecured in a private premise momentarily, and it being stolen is less of a culpable act, though the loss of a laptop is normally a simple monetary loss, replaced by insurance.  With the stalker angle here, consider that perhaps you're a doctor and it had patient records on it.  Should you then not have taken more opportunity to lock the device down when out of your sight?


Edit: Clarification; people aren't suggesting it's Talktalk's fault, but that they were at fault in allowing it.  Changed wording.

 

[_jr_]

Doesn't pretty much every EULA one has to agree to to use any random internet service requires you to give up some/most privacy? The thieving example doesn't work, because there is generally nothing illegal on part of the service providers. It is more like: if a steam user doesn't get a job interview, because it's easy to determine from his profile that he doesn't like work, only the steam user is to blame for that.

 

[levi]

Do the Steam T&Cs require you to give a real name when you sign up?  You'll need to for any credit card payments you do through the service, but that information should remain confidential to Valve, unless they're hacked.

 

[WizardStan]

I suspect we're just arguing semantic minutiae now, because I agree that I'm disappointed in the criminals when they copy personally identifiable data from computers, but people are blaming the likes of Talktalk for not securing their systems properly,

I'm not talking about disappointment in people vs not or whatever. The Talktalk thing is precisely what I mean: people are blaming them, however you want to word it. I don't, period, at all. The people that hacked into the system and stole private information are at fault, they made that choice.


Because like I said before, deciding that one person is at least partially at fault for another's actions in one situation where they are not at all responsible in a different situation draws an arbitrary line, one which different people draw in different places. I refuse to draw that line, it's much easier morally and philosophically. This isn't semantics, I mean it when I say I put no blame at all on anyone for the actions of another.

 

[levi]

That seems a bit too easy to break.  Say a tree fell on a blind corner, and the council or whoever was in charge failed to clear it even after the first car had crashed into it, would they be blameless?


I say no, they're paid to sort out things like that.  Failure to act is potentially as big a failure as acting to fail.  As a customer of Talktalk, I expect them to secure their systems, in the same way I expound effort to secure my own systems - it's part of what I pay them for.

 

[WizardStan]

Say a tree fell on a blind corner, and the council or whoever was in charge failed to clear it even after the first car had crashed into it, would they be blameless?

The tree didn't decide to fall, it simply did.  If the council isn't aware and the tree is hidden such that drivers can't see it until it's too late then it's just an accident, no decisions have been made so no one is to blame.


It's the councils job to look out for the citizens, vis a vis removing the tree.  If they were aware of the tree and chose to wait then that is a decision and they are responsible for their actions and the consequences of those actions.


If the tree is laying in the road such that it's pretty obvious and driver would have to be completely oblivious (and shouldn't be driving) or willfully ignorant (still shouldn't be driving) then that's a decision that they've made and are responsible for the consequences of those actions.


Seems pretty straightforwards and consistent to me.

 

[WizardStan]

As a customer of Talktalk, I expect them to secure their systems, in the same way I expound effort to secure my own systems - it's part of what I pay them for.

(sorry, forgot the rest of the post, couldn't get the quotes right again)


These are entirely different situations.  The tree cannot make a decision.  No one is responsible for the tree being in the way, only what comes after it.


A person who hacks into your system is not a tree, they are a human being who made that choice. It doesn't matter if you've got the weakest security in the world, it is the person doing the hacking that is making the decision to do so, you are not responsible for their actions.

 

[levi]

So I have no right to expect companies who I pay to keep my data safe (amongst other things) to do enough should someone decide to hack them?  If only that was actually an explicit part of the contract I signed with them, it would legally be a straightforward breach of contract, I think - you disagree with that law?

 

[WizardStan]

No, I definitely didn't say that.

 

[levi]

Then I think again we're arguing the semantic difference between blaming someone and whatever you call what you do when someone doesn't meet your expectations.  Disapproving, perhaps?

 

[WizardStan]

No semantics, different philosophies.


You pay someone to protect your data and you feel they are to blame when someone hacks in because it indicates that they didn't do enough.  I don't.  No one else is responsible for your actions, ever, period.


If you paid someone to protect your data and you can prove that they didn't do enough, that they willfully neglected things that they should have done then that is what they are responsible for, they are responsible only for the failures in security and are not in any way responsible for the breach itself: the only person who is responsible for the hacking is the hackers.  By failing to do everything they could they would have been in breach of contract regardless of whether the hacking occurred or not, the hacking simply made it obvious that they were slacking off.


If you have a security guard to protect your museum, and every night they are supposed to lock the door, but one night, for whatever reason, they forget and someone steals a painting, the guard is at fault for not locking the door only, they are not the party responsible for stealing the painting: only the thief is responsible for stealing the painting.  Punish the guard for not locking the door if you must but if you actually believe it was his fault that someone else made a concious decision to take advantage of the open door and walk away with a painting then we disagree.


The security company isn't responsible for the actions of the thief; the consumer isn't responsible for the actions of the government; the woman isn't responsible for the actions of the rapist.  No one is ever responsible for the actions of another.

 

[levi]

Okay, thanks for explaining.  I don't think we're actually all that different mind you; as you say, I don't blame Talktalk for the hack, but I am disappointed in them for not securing the data, which was exposed by the hack and therefore somewhat confused with it in my mind.


I'm not sure how it stands legally for Talk-talk - I'd expect if they are found to have been lax then they'll face a fine from the Information Commissioner's Office only - while the hackers if found should face a criminal sentence, if their guilt is proven.

 

[Grench]

Wizardstan has it right.  Each party is responsible for their own actions - good or bad.


Bad people is why there is law enforcement.


Accidents (and recovering from bad people's actions) is why there is insurance.


Protecting yourself and your systems/items/etc is a good thing to do.  Not doing so does not make you responsible for the malicious actions of another.  However, you may still get stuck with the cleanup or the repair bill (directly or through your insurance carrier).


The rest of society is not responsible for compensating an individual due to their failure to protect or insure themselves properly.


Making oneself an easy or more likely target by accident or ignorance does not grant culpability to the victim.


Intentionally making oneself an easy or more likely target, though, could be a sign of mental illness, treatment of which is an entirely different topic.

 

[levi]

I use noscript as well, although only because I don't believe that third parties should have the rights to run random code on my computer unless it's necessary and beneficial to myself.  Since then, I've become aware of the amount of tracking and hacking that goes on thanks to the use of script loaded cookies, malicious scripts and the likes.


I'm not really aware of any 'better' equivalent for my needs.  I know of the advertising targetted plugins, but I don't object to limited advertising - it's just a side effect that judicious use of ns leads to much less advertising, as it seems most advertisers didn't bother implementing accessible rollback so they fall back to a static jpg or animated gif.  Shame for them.

 

[Klumpen]

The law forces UK internet providers to store browsing histories -- including domains visited -- for one year, in case of police investigations.

 

[ible]

that is worrisome.

 

[comradekingu]

The UK does not deal openly with its problems. Instead it covertly tries to snoop its way, and also trying to get people to conform to fear of such action. Worked out great for the GDR didn't it!