OpenAI Is Not Training on Your Dropbox Documents — Today

OpenAI Is Not Training on Your Dropbox Documents—Today

There’s a rumor flying around the Internet that OpenAI is training foundation models on your Dropbox documents.

Here’s CNBC. Here’s Boing Boing. Some articles are more nuanced, but there’s still a lot of confusion.

It seems not to be true. Dropbox isn’t sharing all of your documents with OpenAI. But here’s the problem: we don’t trust OpenAI. We don’t trust tech corporations. And—to be fair—corporations in general. We have no reason to.

Simon Willison nails it in a tweet:

“OpenAI are training on every piece of data they see, even when they say they aren’t” is the new “Facebook are showing you ads based on overhearing everything you say through your phone’s microphone.”

Willison expands this in a blog post, which I strongly recommend reading in its entirety. His point is that these companies have lost our trust:

Trust is really important. Companies lying about what they do with your privacy is a very serious allegation.

A society where big companies tell blatant lies about how they are handling our data—and get away with it without consequences—is a very unhealthy society.

A key role of government is to prevent this from happening. If OpenAI are training on data that they said they wouldn’t train on, or if Facebook are spying on us through our phone’s microphones, they should be hauled in front of regulators and/or sued into the ground.

If we believe that they are doing this without consequence, and have been getting away with it for years, our intolerance for corporate misbehavior becomes a victim as well. We risk letting companies get away with real misconduct because we incorrectly believed in conspiracy theories.

Privacy is important, and very easily misunderstood. People both overestimate and underestimate what companies are doing, and what’s possible. This isn’t helped by the fact that AI technology means the scope of what’s possible is changing at a rate that’s hard to appreciate even if you’re deeply aware of the space.

If we want to protect our privacy, we need to understand what’s going on. More importantly, we need to be able to trust companies to honestly and clearly explain what they are doing with our data.

On a personal level we risk losing out on useful tools. How many people cancelled their Dropbox accounts in the last 48 hours? How many more turned off that AI toggle, ruling out ever evaluating if those features were useful for them or not?

And while Dropbox is not sending your data to OpenAI today, it could do so tomorrow with a simple change of its terms of service. So could your bank, or credit card company, your phone company, or any other company that owns your data. Any of the tens of thousands of data brokers could be sending your data to train AI models right now, without your knowledge or consent. (At least, in the US. Hooray for the EU and GDPR.)

Or, as Thomas Claburn wrote:

“Your info won’t be harvested for training” is the new “Your private chatter won’t be used for ads.”

These foundation models want our data. The corporations that have our data want the money. It’s only a matter of time, unless we get serious government privacy regulation.

Tags: artificial intelligence, data collection, national security policy, trust

Posted on December 19, 2023 at 7:09 AM • 81 Comments

Comments

mario • December 19, 2023 8:34 AM

the Government we don’t trust eather:
“Police Get Medical Records without a Warrant”

Morley • December 19, 2023 10:18 AM

True, but regulation still works better than most options.

TimH • December 19, 2023 10:35 AM

Just need lots of articles showing non-tech people how to set up one of the free (and transparent to use) user-end encryption systems on PC and phone so that plaintext isn’t backed up.

And explaining why they should bother.

Nico • December 19, 2023 10:38 AM

It’s hard enough to control this situation here in Europe where any data ABOUT you is automatically YOUR property. In America it’s hopeless as long as someone can own data about another person.

Personally, I do what many people here do: I don’t ever give my data to an American corporation if I don’t absolutely have to (which I mostly don’t).

Clive Robinson • December 19, 2023 11:34 AM

@ Bruce, ALL,

Re : Excuses as lies.

“And—to be fair—corporations in general. We have no reason to.”

No we don’t especially when they out right lie or use half truths to get what you would not knowingly give them for the reason they want (to sell on your privacy).

I won’t say which “cloud backup” company this came from but a lot and I do mean a lot of people fell for it.

As @TimH notes a couple above, every one should encrypt their data,

“Just need lots of articles showing non-tech people how to set up one of the free (and transparent to use) user-end encryption systems”

Almost since Pretty Good Privacy first became available, there were on-line “How-To” documents telling you how to use it. Not just to protect your communications but your files as well.

Unfortunately they were not “user friendly” back then nor decades later. As the many “Why Johnny Can’t encrypt” papers and articles detailed, people did not use encryprion for various reasons, but mostly because it lacked transparancy and was highly fragile.

One often quoted being that if you encrypt files and there is an error,

“Then nothing could be recovered[1]”

Was pushed as a reason not to do so and unfortunately mostly true in the early days when the correct ways to use encryption were barely known.

Now consider some of these online Cloud Companies do not want you using encryption because that stops them getting at your data to profit by…

Ask yourself,

“How do they force you not to encrypt, but not make it obvious why they are doing so?”

Well the first part is eaay, detecting files enceypted using standard techniques is generally not that difficult as they have sufficient structural differentiators that act as “distinguishers”. Also the number of just “random looking” files gives that “Preponderance of Evidence” metric much loved in Civil Proceadings and more recently criminal cases to find guilt by assertion rather than actual proof.

Thus the cloud service can, having got you to upload all your files reject the lot because they claim one or two are “encrypted” thus in breach of “Terms of Service”(ToS). Thus they get the benifit without the cost and under US law having collected it can keep it and ad @Nico notes above,

“In America it’s hopeless as long as someone can own data about another person.”

But how do these Cloud Services justify the “no encryprtion” without saying what they are actually upto?

Two excuses have been used,

1, They use proprietary compression algorithms.
2, They de-duplicate files across the whole of their cloud system.

Both appear reasonable excuses from a technical view point, but only if you are unaware that the end goal is what you would consider “Data Theft” if they took the files off of your computer…

[1] What is lost and what can be retrieved depends on very many things with encryption. So yes whilst in a not so good usage the whole lot could be lost, in other usage only a very small amount around the error might be lost, that is about the same or infact less than if the same error had occured when encryption had not been used.

emily’s post • December 19, 2023 11:35 AM

Should have deleted it earlier and reviewing all services and apps for same.

There was at least one movie where someone kept some data at a “random” IP address as a stab at security by obscurity. How does one go about doing this ?

Per D. Webster, “The (unlimited) power to tax is the power to destroy.” Maybe also so is the power to store, serve, protect, serve ads etc. Who is guarding your guardians ?

Erdem Memisyazici • December 19, 2023 12:08 PM

If you are going to raise awareness for privacy, make sure you don’t do it alone and that you have proper funding. I just sort of felt for my fellow citizens and started talking about Edward Snowden in the local pub, at work, amongst friends and parties 10 years ago and I got drugged and interrogated locked in a house for about an entire day. So … I hope I helped.

Good things that happened since then are, a FISA court recognized that the Snowden leaks were unconstitutional, doh. Patriot/Freedom Act curbed its enthusiasm, and that’s about it.

I’ve come to realize that this isn’t only done by the government but by private citizens as well. In fact it occurs to nobody to simply not snoop on each other past a dollar amount.

People at large simply believe that privacy just became more expensive and that now you have to make government and IT buddies also to comfortably sit naked on your chair in the living room and eat popcorn without hearing about it from the local coffee shop the next morning.

My solution to the problem is simple, that is to make it a technical nightmare to invade privacy. Things like requiring building codes to include signals blocking layers as well as soundproofing, otherwise you can’t construct a house there. Providing government financial incentives to get existing houses sound and EM proofed. Getting A.I. profiles to click on random ads and watch them, while buffering content for the house and showing it after it has been removed of all ads and undue influence.

Of course some information will still influence the person and be stolen en masse but no more than the influence national T.V. programming had in the 90s. IT doesn’t have to be a constant thing in your life or your psychology.

Here’s another quick real life story for you guys. My mother goes H.A.M. on the story of this Iranian girl beaten to death in the streets. She hopes that it will get somewhere and they will overthrow the oppressive anti-woman regime which literally has a fashion police.

I pulled my mother aside and simply explained to her that it is pointless for you to stay awake until 3AM posting on Facebook and asking your friends to sign this, donate that, and that she is missing the point. I showed her a U.N. article noting the increase in popular “uprising” national sentiment aimed at only proving how well the I.T. industry functions in that nation as well as the associated P.R. I told her about the Bell Pottinger and President Zuma scandal and how that’s the norm now with all this Hong Kong uprising, Arab Spring, Turkey Coup, (am I missing any?) is just about getting people mad enough to click things.

The point is the influence. Merely that you post something, and nobody really ever intended to change anything but rather to abuse your genuine emotions so that they can show you ads.

She didn’t get it. She thought I was being paranoid and kept on posting.

If people can get at your data they will do so, the only barrier between you and your data stolen must be a physical one as the rest tends to be lies that are simply too easy to get away with telling.

Notice how every privacy conversation is about subjective privacy and not objective privacy. The industry wants you to feel like your data is yours alone.

Clive Robinson • December 19, 2023 12:24 PM

@ emily’s post, ALL,

Re : Equating seigniorage with data in transit.

“Maybe also so is the power to store, serve, protect, serve ads etc.”

Back in the early 1990’s I was doing a bit of post-grad study. Back then most peoples view of information was little different to,

“A box full of waste paper occuping warehouse space”

However anyone who understood not just DataBases but “Data Warehousing” back half a lifetime ago realised that the notion of those boxes of “waste paper”, had infact been sprinkled with “Fairy Gold” that you could repeatedly exchange for real gold.

Thus you could equate it in part with seiniorage[1] on the money supply.

So being a “smart arse” I asked one of the lecturers who was a “reader” at the University the question,

“What is seigniorage on data in transit or other circulation?”

I think it only surprised him for about a second and a half, other people in that class room I suspect still don’t get it.

But arguably most of the US Economy that is allegadly “information based” rests on the “seigniorage of data in circulation”. So upwards of a Trillion or so USD/year.

And with seigniorage comes the power of stealth tax which gets you all sorts of other power and thus importantly control over the masses.

[1] I won’t go into the depths of seigniorage you can look it up,

https://en.m.wikipedia.org/wiki/Seigniorage

But in essence, the person who prints money gets not only the benifit of “first purchase” but also the equivalent of interest it creates whilst in peoples pockets. Economists have good reason to call it “Inflation Tax” and it’s of significant value.

emily’s post • December 19, 2023 12:25 PM

Theorem: Ad slinging money is 100% wasted.

Note: This extends earlier work that 50% of ad slinging money is wasted.

Proof (by reductio ad venumdere)

We assume an adequate information environment (AIE).

Ads are slung because the someone wants someone to buy something. However, no normal person needs to be told what to buy and under AIE, can conclude an exchange. Therefore etc. QED.

Informally, you promise not to sling ads, I promise not to buy anything. This is fair in terms of the ad sling frame. You then can eliminate 100% of your ad-sling budget. If I now do buy something, you have achieved your aim at no expense and are miles ahead.

So, the resolution of ad-sling is to ensure an AIE.

Clive Robinson • December 19, 2023 12:44 PM

@ emily’s post,

“Proof (by reductio ad venumdere)”

Hmm comparing “Marketing” (ie selling/vending) with “Absurdity”…

I think that earns you a “+1” 😉

jones • December 19, 2023 12:46 PM

A lot of these large language models (LLMs) are under-trained, and while there has been a race to make larger and larger models, their performance scales more predictable with the size of the training data, rather than the parameter count

https://download.arxiv.org/pdf/2203.15556.pdf

Corporations with access to large, proprietary collections of human-generated text will be increasingly incentivized to tap into this “human resource.”

A lot of these systems suffer from “unintentional memorization.” We don’t really know how or why they sometimes memorize things rather than generalize, but using personal information to train LLMs could potentially expose a lot of people to potential harm

https://www.usenix.org/system/files/sec19-carlini.pdf

I can foresee a future grey market for the ability to coax proprietary information out of these models.

lurker • December 19, 2023 2:38 PM

@emily’s post
“eliminate 100% of your ad-sling budget”

In times gone by this would have thrown into the dole queue countless copy-artists, printers, mail-clerks, &c. But now that those jobs don’t exist, shouldn’t the ad-sling budget already be much smaller? My small brain sees a paradox where IT has vastly reduced the cost of slinging ads, yet the industry of slinging ads has grown to a bloated monster.

emily’s post • December 19, 2023 2:58 PM

@ Clive Robinson

seigniorage on data in transit

Diving in where the wise fear to tread, does this have something to do with Tier 1 networks ?

Clive Robinson • December 19, 2023 5:21 PM

@ ,

Re : Distance cost metric.

“does this have something to do with Tier 1 networks ?”

Not in the way you are thinking.

The short answer to what you are thinking is,

“Information objects have no effective mass so unlike physical objects which do have sometimes quite considerable mass, the cost of transportating information is effectively to small to charge for.”

Thus the top tier networks (T1) of which there are sixteen have a peering agreement where they pay for their own infrastructure but unlike the POTS lines of old they don’t charge each other to carry data through.

The longer answer to what you are thinking is,

In basic economics there is a hidden assumption that goods cost more the further they are from their point of production.

Whilst that might sort of be true for physical goods the “Penny Post” of the Victorian era first put the boot in on the “Distance costs metric”. The Internet which carries information unlike the old telephone network does not care about distance just volume.

This Distance Costs Metric is important because it underlys a very basic economic assumption,

The cost of producing a physical good generally decreeses nonlinearly with volume produced. Thus any new market entrant is at a disadvantage at the same local as an existing producer all other things being equal. However at a suitable distance the new entrant does not have to cover the costs of transportation that the existing distant producer does and so the two producers costs are equal thus simple market conditions such as supply and demand become dominant (it’s a hidden assumption that underlies the faux “free market” idea).

So having got that out of the way 😉

What I am talking about is,

“Information when used has value” that is it is like “capital at work” effectively producing value or if you like “interest” to a lender.

Now “cash in your pocket” is not doing work and inflation is constantly devaluing it’s purchase power. In places where there is “Hyper-Inflation” shop keepers tend not to price goods as the price goes up during the day (which has other effects such as shops not offering customers choice).

Simplistically, money in a bank is loosing the bank value, you take cash out and those losses fall on you for the time the money is in your pocket. When you purchase something those losses transfer to the person you buy from untill either they purchase something with the cash or put the cash back in the bank at which point the losses fall back on the bank.

In such a system, for every loss there is a gain by lack of loss, or a gain by charging interest. Banks try to fiddle it by not paying customers interest for deposits where they can get away with it or by paying interest at well below the “banking rate”. They also charge exorbitant rates of interest for credit well above the banking rate.

Now using this model you can replace cash with information and use the same ideas for credit / deposits / withdrawals. That is information becomes Intellectual Property and can effectively be treated as money is.

Thus information in transit is like cash in your pocket it is devaluing against the clock.

Nobody realy cared about this back last century because the value was so small…

However two things that most are aware of changed all of that,

1, High Frequency Trading.
2, High Value Crypro-Currency.

Where nano-seconds that light travelled at the rate of one foot diatance could be worth tens of dollars.

So it you are in New York and make a trade in London the distance costs metric of the information at 1cent/nS would be at a minimum 0.01USD x 5280ft/mile x 3461.33miles or $182,759… Which is why HFT traders use high power(~20kW) “High Frequency”(HF) short wave communications with computed “skip distance reduction” and all sorts of “pre-trade” tricks with specialised time mininising communications.

Lets just say I could see all this nonsense heading my way well before even those who now spend multiple millions on it were even aware the problem was going to smack them between the eyes like a well swung lead pipe… How do I know, well lets just say about half of them sitting in the same lecture came from the City of London and their jobs were about ICT in trading floors… What they did not know was that I’d been involved with developing “Trading Platforms” for banks and Investment houses since the early 1980’s (the company I worked for designed them as well as high end body scanners and other very high resolution –for back then– display systems such as military training simulators).

Clive Robinson • December 19, 2023 5:24 PM

@ emily’s post,

Opps my above was in reply to you.

JonKnowsNothing • December 19, 2023 6:19 PM

@Clive, @emily’s post, All

re: the top tier networks have a peering agreement where they pay for their own infrastructure but they don’t charge each other to carry data through.

In the USA part of this deal is called Net Neutrality. (1)

There are some ripples but essential internet connections, provided there are any in your area, come with a basic rate price. The providers do a lot of up-selling to get people to pay for add-on services plus tie-ins from preferred app vendors. It is not the same price across the USA but there is a basic tier pricing provided you dig for it and skip all the frill-add-ons.

There is a huge problem though with this model in the USA and on regular basis this concept of all-packets-are-equal gets challenged by some-companies-use-more-than-others pricing.

Streaming services with on demand movies use more packets than a pull-push new email inbox check

In this other version, streaming services and constant-on services would pay a higher tariff. Google, Microsoft would pay more because they drive more packets overall by the number of people using their services and search engines.

However, there is a huge regulatory gap that needs to be crossed by the FCC to shift the playing field and it isn’t going to be an easy fix.

Old History

In the beginning there was plain old telephony POTS. It was millions of dead trees plunked across the USA with wires that eventually landed at an access point in your house. Electricity was delivered the same way. The only prices were the ones AT&T (2) set and approved by the FCC.

Then came Cable Systems

Cable Networks argued that they were not telephony services and successfully got a new different tier definition from the FCC. They shifted data not voice. So many of the telephony taxes did not apply to them.

The key is Data vs Voice, one on each side of the regulatory definition.

Modern telephony is mostly VOIP – Voice over IP, and since they successfully argued that they transported Data Packets they got lumped into the Cable tier. They did not have to pay the extensive tariffs assigned to Voice providers.

So, the problem is how to connect the 2 tiers, which today are functionally 1 system but still defined as 2. If data transport is now taxed at a higher tariff because of volume of data, there needs to be a bridge between Data & Voice definitions for the FCC to do that.

It’s in the works and while it’s been defined separately for a long time, the FCC might just end up doing a New Def to combine all the services under one controlling tariff structure.

There is a lot of money on both sides of the gap.

One doesn’t want to pay a bigger load of tariffs.
The other would get huge refunds from historically over-applied tariffs.

===

1)
ht tps://en.wiki pedia .org/wiki/Net_neutrality

Network neutrality, often referred to as net neutrality, is the principle that Internet service providers (ISPs) must treat all Internet communications equally, offering users and online content providers consistent rates irrespective of content, website, platform, application, type of equipment, source address, destination address, or method of communication (i.e., without price discrimination).

2) AT&T has been through bankruptcy, acquisition and name harvesting. Today’s AT&T is not really the Old Ma Bell, but a corporation that bought the name to enhance their consumer recognition.

vas pup • December 19, 2023 6:55 PM

Putin speaks to AI version of himself in news conference
https://www.bbc.com/news/world-europe-67718139

2 min video with English caption

What about our POTUS:)))))))))?

Clive Robinson • December 19, 2023 7:56 PM

@ JonKnowsNothing,

Re : Snow White and the seven dwarfs

“Today’s AT&T is not really the Old Ma Bel…”

I remember this rather well… Judge H. Harold Green made his Modified Final Judgement in 1982 and it was not popular. But January 1st 1984 AT&T became a long-distance company, while seven regional Bell Operating Companies (RBOCs) took control of various parts of the business by geography and function.

So Ma Bell became Snow White and the RBOCs / Baby Bells the Seven Dwarfs.

What few had realised was that in effect it was a paper shuffling excercise as none of them were in competition with each other, nor was their any inhibition on them being sold and remerged etc.

The result was a massive “shell game” that resulted in the US public amoungst others getting “asset stripped” and given a truely terrible system in return at vastly over priced rates.

I worked in one of the RBOCs that was “international” called “Pacific Telesis”. The part I worked in was virtually opposite “Chelsea Town Hall” where celebrities got married. But it only existed because of what another RBOC had done. Back the “Telex” was still a vital legal service and any international company had to use it. In the US it was about three to ten times as expensive as it was in the UK to send a Telex depending on where it went.

Pacific Telesis had virtually significant spare capaciry data lines across from the US-UK outside of normal US business hours. But even in US and UK business hours it was still cheaper most of the time to send telex messages from the UK by quite an amount.

The result we developed a “Telex Pump” system. Companies from all over the world sent messages as data to have it sent out from the UK. It got to the point that we could cut the telex network out all together with some customers…

Well whilst working there, there was a “Special Occasion” and we all got “tie pins” of various quality with the “splat” logo on them. Due to a cock-up mine was solid gold not plated like my coworkers or boss, but it did not have the small ruby at the center my bosses boss got. I still have it in my cufflinks box but have never realy had reason to wear it, except once…

Years later I was working for another company designing FMCE to be manufactured in South Korea… It was announced that there would be a customer visit from the seniors of a new potential customer… Realising who they were I unusually wore a “good suit and tie” with the tie pin. Nobody in the company I worked for spotted the pins significance. However on arrival the seniors who were all once Pacific Telesis employees immediately recognised it as a level 3 (mid managment) pin and got very cosy. My immediate boss did not have a clue what was going on and his boss the Chairman who I got on well with picked up on the fact that I was obviously a plus point so went with it. The contract came through and I got effectively a liason position, much to the surprise of the QA manager…

It got even wierder as part of Pacific Telesis got spun of mid 1990’s to become “AirTouch Communications” which as a mobile phone company… They later linked up and became part of Vodafone, another company I’d worked for in an earlier existance as Racal down in the old manor by the A3 in Raynes Park SW London… All a bit odd but that’s how it goes sometimes.

WeepingClown • December 20, 2023 5:39 AM

Are companies and governments worth trusting?

In the past, many would have said yes; now we’re not so sure. Yet, in some countries life goes on with near complete lack of trust by the person on the street of police, government, corporations…and so on. In some places I’ve lived, even family members don’t trust each other to tell the truth when it counts, but I digress. The point is that many of us have lived in a sector of a world where we felt we could trust others. As that changes, how can we learn from those who have not taken trust to be as free and common as we do?

How do we negotiate life in this new reality we find ourselves in?

Mr. Peed Off • December 20, 2023 3:06 PM

The Stanford Internet Observatory found more than 3,200 images of suspected child sexual abuse in the giant AI database LAION, an index of online images and captions that’s been used to train leading AI image-makers such as Stable Diffusion. The watchdog group based at Stanford University worked with the Canadian Centre for Child Protection and other anti-abuse charities to identify the illegal material and report the original photo links to law enforcement. More than 1,000 of the suspected images were confirmed as child sexual abuse material.

“We find that having possession of a LAION‐5B dataset populated even in late 2023 implies the possession of thousands of illegal images,” researchers wrote.

Much of LAION’s data comes from another source, Common Crawl, a repository of data constantly trawled from the open internet, but Common Crawl’s executive director, Rich Skrenta, said it was “incumbent on” LAION to scan and filter what it took before making use of it.

https://www.theguardian.com/technology/2023/dec/20/ai-image-generators-child-sexual-abuse

One should ponder why the “authorities” have failed to search Common Crawl and have the illegal material removed and prosecute the sources if possible. Another concern is the large number of false positives for CSAM.

Zoolander • December 20, 2023 3:08 PM

Ok, how is this different to, for example, Google having access to all of your email content in order to do targeted advertising, something that has been going on for decades?

Mr. Peed Off • December 20, 2023 4:48 PM

@ Mr. Peed Off

More info:
https://arstechnica.com/tech-policy/2023/12/child-sex-abuse-images-found-in-dataset-training-image-generators-report-says/

https://stacks.stanford.edu/file/druid:kh752sm9123/ml_training_data_csam_report-2023-12-20.pdf

It appears most if not all the offending images were cartoons or drawings. Also some debate about whether nudity regardless of context is csam.

vas pup • December 20, 2023 5:29 PM

@Clive https://www.schneier.com/blog/archives/2023/12/openai-is-not-training-on-your-dropbox-documents-today.html/#comment-430085

AT&T like iron man in ‘Terminator’ came to life even as more sinister: now they exclusively control land line phone service and cost is gradually rising due to absence of competition. On the other hand wireless service have many other competitors and cost is actually going down.
Looks like they immune from FTC and Congress anti trust inquiry probably due to contribution to election funds of both major parties and for sure powerful lobby in Washington DC.

vas pup • December 20, 2023 5:38 PM

@ALL

AI cannot patent inventions, UK Supreme Court confirms
https://www.bbc.com/news/technology-67772177

“The UK Supreme Court has upheld earlier decisions in rejecting a bid to allow an artificial intelligence to be named as an inventor in a patent application.

Technologist Dr Stephen Thaler had sought to have his AI, called Dabus, recognised as the inventor of a food container and a flashing light beacon.

But in 2019, the intellectual property office (IPO) rejected this, saying only a person could be named as an inventor.

The IPO has argued, and courts have supported the view, that only “persons” can have patent rights, not AIs.

Now five Supreme Court judges have dismissed a bid to reverse those decisions, concluding that “an inventor must be a person”, and that an AI cannot be named as an inventor to secure patent rights.

The judgement does not deal with the issue of whether Dabus did in fact invent the food container and light.

Dr Thaler, who believes that Dabus is a “conscious and sentient form of machine
intelligence”, told the BBC “Naturally, I feel disappointed by this decision,
highlighting the ongoing clash between human and machine intelligence.”

The IPO told the BBC it welcomed the judgment and the clarification it provided.

But it added that “the government will nevertheless keep this area of law under
review to ensure that the UK patent system supports AI innovation and the use of AI in the UK”.

!!!Rajvinder Jagdev, of specialist intellectual property litigation firm Powell Gilbert, said: “The judgment does not preclude a person using an AI to devise an invention – in such a scenario, it would be possible to apply for a patent, provided that person is identified as the inventor. The judgment alludes that had this been the scenario it had been asked to consider, the outcome may have
been different.”

Dr Thaler also argued that he was entitled to patents for Dabus inventions as the AI’s owner, but this was rejected.

A different decision could have caused “headaches for companies using [AI]
software to innovate as they may not be the owner of the patent”, Diego Black, from European intellectual property firm Withers and Rogers, told the BBC.

Simon Barker, of law firm Freeths, said the judgement raised “interesting policy questions” about how governments might look to change laws in the future as AI advances.

!!!”There are similar debates in other areas of intellectual property rights too. Copyright in AI-generated works, for example. Is the programmer of the AI the creator, or the user who is responsible for prompting the machine? And what if it really is just the machine itself, like Dr Thaler claimed of Dabus?”

=>But Professor Ryan Abbott of the University of Surrey who represented Dr
Thaler in the case said the decision implied that “AI, at best, can be a ‘highly sophisticated tool’ that can be used by people who invent.

=>”This affects the meaning of an “inventor” under UK patent law, and to be an inventor, one need not make the creative leap behind the invention, as had been previously assumed. Accordingly, companies who use AI to develop products will have to say they or their employees are the inventors, even when the humans involved do little else but switch on the computer.”

Clive Robinson • December 20, 2023 6:01 PM

@ Mr. Peed Off,

Re : If CSAM or not.

“Also some debate about whether nudity regardless of context is csam.”

It’s both “is” and “is not” depending on how the legislation in your juresdiction is worded.

But it’s all to easy to be guilt…

Since “C19 Lockdown” Doctors don’t do fave to face consultations any where as much as they used to.

What they do ask you to do is send phoros to a web portal supplied by some web-company…

In the UK there is no “legal defence” written into the CSAM legislation…

So if say your child has nasty nappy rash and you send the Dr a photo of the rash with your smart device or web-cam and send the image to that web-portal, you are automatically guilty… Worse most UK medical practicies do not even do this,

https://www.grovemedicalpractice-stives.nhs.uk/services/sending-photos-images-to-your-gp/

Note how even this skates around the issue…

The New York Times has indicated that people have been sanctioned already, and it’s been further investigated by the tech press,

https://www.theverge.com/2022/8/21/23315513/google-photos-csam-scanning-account-deletion-investigation

From which you can see that ikewise if you take a photo of say your family sitting picnicking at the beach and in your photo there is a child running around naked even if it’s well in the background then again you are automatically guilty…

There are medical and other books that are now illegal to have in your posession or even in teaching libraries.

Before MP’s in the UK voted on the legislation they were repeatedly warned about the fact the legislation was dangerous… However supposadly “public pressure” of certain near rapid individuals caused the legislation to be passed.

Has the legislation had any significant effect on actual CSAM in the UK?

Apparently not, not even an insignificant effect that can be quantified has been made public (and politicos being politicos you can be reasonably certain they would be crowing it from the roof tops if there were).

lirker • December 20, 2023 6:51 PM

@Mr.Peed Off

If Common Crawl can find stuff lying round the open ‘net, one has to wonder why those who claim to be in charge can’t do the same …

Clive Robinson • December 20, 2023 8:01 PM

@ lurker, Mr.Peed Off, ALL,

Re : Not seeing the obvious.

“… one has to wonder why those who claim to be in charge can’t …”

There are a couple of English sayings,

“Theres nowt s’blind as them wot choses not to see.”

“Turn a blind eye to it.”

The first apparently comes from Yorkshire, the second is a logical follow on of vice Admiral Horatio Nelson’s alleged “I see no ships” statment as a deliberate disregard of signal orders to disengage at the 1801 Battle of Copenhagen. Whilst it is known he did not make the statment, it is true that the day before he and others had sumptiously feasted on the Elephant on April Fools day…

Apparently Nelson claimed two things, the first that as he had no sight in his right eye he was alowed “to sometimes be blind”, before putting a telescope to the blind eye and saying “I see no signal”…

Apparently his behaviour was not unexpected by those he commanded, nor by Admiral Parker who commanded him.

Technically the battle was an unprovoked attack against the Danes who were at that time neutral and whilst a relatively short battle of four hours cost over three thousand lives and the loss of many vessels.

Mr. Peed Off • December 20, 2023 8:16 PM

https://www.404media.co/laion-datasets-removed-stanford-csam-child-abuse/

“LAION is a non-profit organization that provides datasets, tools and models for the advancement of machine learning research. We are committed to open public education and the environmentally safe use of resources through the reuse of existing datasets and models. LAION datasets (more than 5.85 billion entries) are sourced from the freely available Common Crawl web index and offer only links to content on the public web, with no images.

Should I as an AI experimenter trust that statement?
If I seem very concerned….I am.

Spreading CSAM is a federal crime, and the US laws about it are extremely strict. It is of course illegal to possess or transmit files, but “undeveloped film, undeveloped videotape, and electronically stored data that can be converted into a visual image of child pornography” are also illegal under federal law. It’s not clear where URLs that link to child exploitation images would land under current laws, or at what point anyone using these datasets could potentially be in legal jeopardy.

Has the EFF, ACLU, Brookings, or other credible orgs offered any opinion on this?

emily’s post • December 20, 2023 8:24 PM

@ Clive Robinson @ lurker

Re: they put you in a sling

And (or should I say Ad) the beat goes on –

https://arstechnica.com/gadgets/2023/12/upcoming-wireless-tvs-sell-users-on-screen-products-when-they-raise-their-hand/

Clive Robinson • December 20, 2023 8:54 PM

@ vas pup,

“AI cannot patent inventions, UK Supreme Court confirms”

I’m actually not at all surprised.

The law not just in the UK but much of the world does not alow even creatures that clearly have consciousness and can communicate intent etc coherantly –by sign language– to be “property owning” because they are “owned property”.

Whilst this stems from a rather idiotic self promotion by humans via religion to near deity status –God’s domain and human domain over nature– it’s currently reasonable to say that man made machines no matter how complex are not concious entities capable of “free existance”.

If that will ever change is somewhat open debate and has been for some time. From the 1950’s ScFi author Issac Asimov in bicentennial man raised the point that “robots” did not die.

It’s an important point because nearly all “Intellectual Property”(IP) law is based on the fact people die and at some point there after any rights they may have held or assigned would cease.

If a machine can not definately expire within a reasonable time frame then IP Law becomes a mockery (though I’m sure Disney Corp would love perpetual rights).

Clive Robinson • December 20, 2023 9:20 PM

@ emily’s post, lurker, ALL,

Re : they put you in a sling.

“And (or should I say Ad) the beat goes on”

I don’t know if you’ve read the works of the late Douglas Adams?

But in one of his latter Hitchhikers books, he has Slartibartfast show an ancient marketing video on the 2000 year long “Krikket wars” to Arthur Dent, and cautions him not to nod as that would be used as a sign of acceptance to the purchase of a replic of the “Wikkit Gate”.

So once again Douglas Adams saw a future that nobody in their right mind would want, but would be forced on us by the Marketing Mega Corps and the like… That is now unfortunately going to happen in real life ={

lurker • December 21, 2023 12:52 AM

@emily’s post

My not having or watching TV is I suppose some form of malfeasance …

Winter • December 21, 2023 2:34 AM

@emily’s post, lurker, Clive

Re : they put you in a sling.

“And (or should I say Ad) the beat goes on”

Do you have a right to return online purchases? Over here (EU), we have a legal right to return any online purchases within 14 days after delivery and get our money back.

Such legal rights would make such schemes much less profitable.

Clive Robinson • December 21, 2023 5:19 AM

@ lurker,

“My not having or watching TV is I suppose some form of malfeasance …”

Or even “treason” to the XXX way…

After all how can you be indoctronated into the XXX way without thirty hours a week of Reality TV to make you one of the mindless masses?

The next sign of such “unXXX behaviour” demanding the “hang them up by their thumbs” re-education process is growing your own food… As it prevents you injesting the hormones and other drugs and chemicals that are in fast food that make you sterile, block your arteries, damage your kidneys, give you type II diabetes etc, if not actually the Big C [1] by thirty as well.

But of course the true mark of a traitor / agent of insurection is having curtains… After all if you have nothing to hide…

Yup and have a very merry winter solstice for you[2], and remember, that it is,

https://m.youtube.com/watch?v=1JsnzhP0eX4

By order of the Corporate over-lords, remember,

“It’s “excess and bankruptcy,
as the XXX way,
or tis off down the highway,
both lead they say,
to purgatory so dreary.”

It is what they demand of you…

[1] No I’m not a UK “Daily Mail” reader but you now get such stories via the News International / Sky Rupert “the bare faced lier” Murdoch empire. And lets be honest have you seen him recently? Rumour has it he’s going to play Davros in the BBC Xmas “Dr Who” special, without the need for time in makeup. Along with Jeff Bezos playing Count Dracula for the Amazon Prime Video “Xmas panto” 😉

[2] A better but less well known Bob Rivers feastive song and more attune with the “off grid ideal” is the “Not quite suitable for work”,

“Chipmunks roasting on an open fire”

https://m.youtube.com/watch?v=H_4xnCSXTfQ

emily’s post • December 21, 2023 1:02 PM

@ lurker @ Clice Robinson

Re: infinite number of monkeys non carborundum

https://arstechnica.com/gadgets/2023/12/report-google-ads-restructure-could-replace-some-sales-jobs-with-ai/

Changing ads on the fly with immediate click-through-rate validation and A/B testing is a task that no person would have the time to do. Also, no one would want to pay a human to do this much work, so having an AI monitor your ad performance sounds like a smart solution. The report also notes another benefit of making AI do this work: “Because these tools don’t require much employee attention, they carry relatively few expenses, so the ad revenue carries a high-profit margin.”

lurker • December 21, 2023 6:12 PM

@emily’s post

So, an AI sells ads to G’s clients, an AI fills the ads with content from the client’s website, an AI serves the ads to me based on my browser history, but if I use an AI to respond to these ads it’s called click-fraud.

More to the point, I can achieve the equivalent of step 2 above without any involvement by G.

vas pup • December 21, 2023 6:44 PM

AI Uses Brain Chemistry for Precision Neuroscience
https://www.psychologytoday.com/us/blog/the-future-brain/202312/ai-uses-brain-chemistry-for-precision-neuroscience

” BrainSpec’s AI software uses MRS data to analyze brain chemistry.
This could mean virtual biopsies without surgery.
BrainSpec analyzes key neurometabolites like glutamate and GABA.
Measuring metabolites provides information for diagnosing brain disorders like schizophrenia and epilepsy.

Virtual brain biopsies by clinicians may become possible with the application of artificial intelligence (AI) machine learning combined with noninvasive brain scans. BrainSpec’s AI software has achieved a new milestone in digital healthcare, !!! which uses data from noninvasive magnetic resonance spectroscopy (MRS) scans to provide measurements of brain chemicals.

Magnetic resonance spectroscopy (MRS) is a noninvasive tool that may provide valuable information for diagnosing and observing brain diseases and disorders by measuring chemical compounds and the intermediate products of cellular metabolism called metabolites. MRS uses the same equipment as magnetic resonance imaging (MRI).

!!!The difference is that MRS measures the concentration of chemicals, whereas an MRI measures blood flow.

BrainSpec says it’s to be the first AI software platform that uses brain chemistry data to be awarded clearance from the US Food and Drug Administration (FDA).

“Much of the AI applications in brain imaging have focused on structural changes in neurological disorders however the virtual biopsy offered by BrainSpec measures the chemistry of the brain which offers much greater insight into the underlying pathophysiological changes that occur with neurological
disorders. This is not to say it is competitive technology to existing AI and digital healthcare but is in fact highly complementary, providing a more in depth understanding of neurological disorders.”

Clive Robinson • December 21, 2023 8:33 PM

@ lurker, emily’s post,

Re : Fraud or not…

“but if I use an AI to respond to these ads it’s called click-fraud.”

What some corporate toe-rag may call it does not make it of necessity true.

In most jurisdictions Fraud has two hurdles,

1, Intent to deceive
2, Intent to gain an illegal advantage (from the deception).

Thus an actor or film star may have a “stage name”, “hold a bank account in that name” and “carry out transactions in that name” as –it’s assumed– there is no intent to deceive, or intent to gain an illegal advantage.

Thus mostly the prosecution burden is to prove beyond doubt the “intent”.

An AI used to dismiss an advert or similar is not “a person legal or natural” and “has no intent other than that given by it’s designer or user”.

Hence it would appear to fall to the “Directing Mind”… But common law is traditionally held to,

“actus reus non facit reum nisi mens sit rea”

That is it requires proof both of “mens rea”(guilty mind) and “actus reus”(guilty act) before any defendant can usually be found guilty.

Which raises a problem with AI… It can act –in theory– beyond the direct instruction of the designer or user. In the case of LLMs by introducing a stochastic bias to output selection and aditionally in ML systems by building in a bias to it’s data set.

Thus,

“Where is the ‘mens rea’?”

Look at it this way, if an engineer designs an engine and gives specifications for materials and tolerances, can they be held liable if an engine is constructed outside of those requirments and malfunctions thus causing a consequent harm?

Most would say no…

So is the designer or user of an AI guilty if the AI uses an out of specification input set?

As they used to say,

“A bit of a posser…”

But that is only the “mens rae” half of the issue there is still “actus reus” to demonstrate. With the AI standing in as a “middle man with random ability” that may be a bit of an issue…

But there is also the question of “rights” lurking in the background.

Untill Tony Blair and his flat mate Charlie Falconer destroyed more than a thousand years of established judicial proceadure in England and other parts of the UK, there was an interesting quirk in the judicial process.

If you were detained and gave a name, and was subsequently arrested under that name… Then that was the name you were prosecuted under and if found guilty also the name you would be imprisoned under.

One of the rights you had befor Tony and Charlie mucked around with things, was the right to silence, without guilt being construed by it (nolonger true as the caution indirectly indicates with “may harm you defence…”).

Thus originally if asked after arrest if the name you had given was your birth/legal name you could just be silent or reply in a noncommittal way without further issue.

If you think about it the old way makes reasonable sense.

Because as the first female Director of MI5 Stella Rimington pointed out, there is no way you can actually prove you are who you say you are[1]…

Also the logical inverse of which is others can not prove who you are either holds as well…

It’s this foundational failing that makes all “National ID Schemes” a failure from the get go. Because the entity that controls the central records, controls the ID(s) a person is tagged with.

So if you can change the central records then you can be “The Magical Mystery Fairy Godmother” if you so chose[2].

But what of an AI, it has no physicallity in that it’s a “bag of bits” that can run on one or more hardware instances. So where is the unique “body”?

It’s an issue we will hear more of with these “self driving vehicles” that,

“Leave road kill in their wake or tyre treads”

What part is guilty, the bag of bits or the machinery?

[1] There are two parts to a “natural person”, their “physical” body/being, and the “informational” tag/name by which people identify them. There is no way to actually reliably and beyond reasonable doubt link the two. DNA like all bio-metrics only links to the physical attributes of the body or some part there of. Where as all others only link to the informational attributes of the name or assigned number on the birth certificate (if there is one).

[2] Actually within reason any one can be who they want to be by either simple deed or in England and similar a legal process by “Deed Poll”.

Lars • December 23, 2023 1:33 PM

This was mentioned on Danish trade news a few days ago: https://nypost.com/2023/12/20/tech/ai-death-calculator-predicts-when-youll-die-its-extremely-accurate/

This guy used data from 6 million individuals. That’s the entire Danish population, and then some. You think he had consent from everyone? The GDPR is worthless if someone decides your data serves a higher purpose.

Winter • December 23, 2023 6:32 PM

@Lars

From the linked article:

life2vec almost perfectly predicted who had died by 2020 more than three-quarters of the time.

What does it mean to perfectly predict more than three quarters of the time? Isn’t that not just guessing correctly 75% of the time? In other words, what is perfect about being wrong 25% of the time.

Beside the language of that NY Post, the research is nice. We roughly know what predicts an earlier demise, but it is nice to get a better grip on the details.

Clive Robinson • December 24, 2023 12:33 AM

@ Winter, Lars, ALL,

My comment got the held treatment…

Part 1,

“What does it mean to perfectly predict more than three quarters of the time?”

I think you are misunderstanding the point Lars is making.

He’s not commenting on how good or bad this particular LLM is –and yes it’s not unsurprisingly bad– but the where and how the 6 million peoples medical / life records were obtained.

Clive Robinson • December 24, 2023 12:37 AM

@ Winter, Lars, ALL,

Part 2,

A concern I share bearing the UK Government effectively gave away the entire UK populations detailed medical records to an organisation called Palantir who’s owners intent is to build the worlds largest surveillance database, and sell the product in a way that will destroy the jobs and careers of police detectives and inteligence analysts. And build up, by the same business models illicit substance dealers use, a dependency relationship with the police departments and intelligence agencies, which would no doubt involve the,

“Get them dependent keep doubling up the price over time.”

Thus siphon-off[1] vast amounts of tax payer money and even more Private and Personal Information to create new dependents with.

Clive Robinson • December 24, 2023 12:40 AM

@ Winter, Lars, ALL,

Part 3,

Which brings me back to your comment about the lack of quality of the model. All Palantir’s models will have easily as crapy results if they use the same “LLM Transformer” model. It’s to be expected by the way the “stochastic parrot” system works.

As I’ve indicated in the past it is in effect a “Digital Signal Processing”(DSP) model that,

“Tries to pull very noisy signals out of even more noisy back grounds and present an approximation by average as an output”.

The averaging process only reducess background noise when the input signals are effectively alined and identical at the sample points. Otherwise the output is just random noise fed through a low pass filter.

Clive Robinson • December 24, 2023 12:43 AM

@ Winter, Lars, ALL,

Part 4,

Which is basically what we are seeing with this LLM model.

The input from millions of people has been averaged in various ways to build statistical models to be used as “matched filters”. Then use those matched filter models against an individuals data set to see if they ring any of statistical matched filter models how much and importantly why. If they do, they then put the matches into another weighted model and see where the individuals signal falls on the output of the weighted bell curves when summed and compare that to the population distribution obtained from the mortality figures[2].

Insurance companies have been doing “curve fit approximation” from populations to individuals for a couple of hundred years now it’s where the “Body Mass Index”(BMI) figure comes from…

It’s what life asurance actuaries do, which is look for “sweet spots” in the dead population information to make more profit from the current living population. The acturies are playing against “the dead population average” so will win if they covince the living population they are paying on a flat model or worse[2].

Clive Robinson • December 24, 2023 12:46 AM

@ Winter, Lars, ALL,

Part 5,

But those noisy signal models that are further in a noisy background are not predictors for individuals who are subject to other models that are not predicted or currently can not be modeled out.

Funnily enough, it’s the same reason why I say “economics is not science” and why Nobel did not originally give out prizes to economists[3].

[1] In the UK the term “Siphon-Off” has significant overtones equivalent to “criminal activity” rather more than “financial impropriety” does. As the Cambridge Online Dictionary makes quite clear by saying first and foremost,

“Learn the meaning of siphon off, a phrasal verb that means to dishonestly take money or goods from an organization or other supply, and use them for a purpose for which they were not intended.”

Clive Robinson • December 24, 2023 12:48 AM

@ Winter, Lars, ALL,

Part 6,

[2] The way it works is to find things that others have not realised. For instance the day in the year you were born statisticaly effects your life expectancy, in different ways in different jurisdictions. Because legislation sets arbitary points in the calander when things happen, so two individuals born just a day apart can have a year of difference effect them. One such is your birthday and how much state provided education you receive and from how earlier a point in your life, as well as total days of education. Because extra education effects your lifetime socioeconomic ability, and that in turn effects you physical and mental health which in turn effects your life expectancy. Which is good news for those looking to profit from life insurance and bad news for those providing pensions and health care insurance.

Part of the reason is explained in,

https://theconversation.com/nobel-economics-prize-winners-showed-economists-how-to-turn-the-real-world-into-their-laboratory-169697

By the way I object to the “Nobel Economics Prize” term for good reason, because it’s a falsehood come con-job of what you might correctly call “influenced faux-news by undesirable parties”[3].

[3] The so called “Nobel in economics” is not an actual Nobel Prize. It’s a “con-job” by the “Sveriges Riksbank” that started back in 1968. What Sveriges Riksbank did was set up a “memorial to Nobel prize” and give the money to the Nobel Foundation to dole out under a not open or visable influence guidence… It’s realy upset one of Nobel’s decendants who think quite rightly it’s abusing the name and memory of Nobel (which it is). Worse it shows significant bias to the discredited Chicago School… Hence the argument that it is faux-award to faux-academics who panda to capitalist profiteers who have “bought and payed for their supportive opinions” a credible argumentive base…

JonKnowsNothing • December 24, 2023 2:23 AM

@Clive, @ Winter, Lars, All

re:

The input from millions of people has been averaged in various ways to build statistical models to be used as “matched filters”. Then use those matched filter models against an individuals data set to see if they ring any of statistical matched filter models how much and importantly why. If they do, they then put the matches into another weighted model and see where the individuals signal falls on the output of the weighted bell curves when summed and compare that to the population distribution obtained from the mortality figures

There are a number of research databases that are using this “trawling” method for science “research”. Kaiser Research has all the health data for every member including their DNA since dirt was invented (or nearly so).

At first, the database was highly restricted and the data sources had to grant permission for their medical history to be used. Typically the first invitees where people that had “unique” health conditions (1).

The second phase that opened was to solicit family, spouses, in laws and children to have their data added to the database. The purpose was to see how family traits and conditions were passed along genetically (Mendelian Ratios) but also to track the impact of social situations. It was Opt-In.

The current phase is Opt-Out and by default all the data goes into the Kaiser Research Data Bank. It is not a violation of HIPPA because the data is held by Kaiser in a secure access branch.

However, with the advent of Big Bucks and the vast amounts of SARS-CoV-2 pandemic history, genomes, analysis, some of the “official news” indicates that the “secure access” is available to anyone with funds to buy it.

Researchers do not need a hypothesis of any sort. They do not have to be looking for a specific condition or interaction. They are looking

to find things that others have not

It doesn’t matter what things, anything will do. However, there is a huge spanner in the “anything will do” part.

Big Pharma, Big Medicine are only interested in Big Bucks. There are hundreds, maybe thousands, of “orphan conditions” where the ROI is not large enough to make treating that condition, making drugs for it or even curing the condition profitable. (2)

So the part of “to find things that others have not ” tack on is

to find things that others have not that is PROFITABLE

===

1) Moi

2) Actuarial profits are gambles. Bets on particular outcomes. They make money when you bet against the house.

Winter • December 24, 2023 4:23 AM

@JonKnowsNothing, Clive, Winter, Lars, All

Re: He’s not commenting on how good or bad this particular LLM is –and yes it’s not unsurprisingly bad– but the where and how the 6 million peoples medical / life records were obtained.

The ethics paragraph is pretty clear and not really worrying:

‘https://arxiv.org/pdf/2306.03009.pdf

The data analysis was conducted at Statistics Denmark, the Danish National Statistical Institution. The data analysis was conducted under the Danish Data Protection Act and the General Data Protection Regulation (GDPR) [79]. In this context, since the data was used for scientific/statistical purposes, the usage is partially exempt from the GDPR [79] (e.g. from the right to be forgotten). Danish-based academic researchers, government agencies, NGOs, and private companies can be given access to Statistics Denmark data, but access is only granted under strict information security and data confidentiality policies1 that ensure that data on individual entities are not leaked or used for purposes other than scientific/statistical. This focus on safekeeping data is shared with most other National Statistical Institutions that provide similar services. Using scientific/statistical ‘products’ such as
life2vec for automated individual decision-making, profiling, or accessing individual-level data that may be memorized by the model is strictly disallowed. Aggregate statistics, including those coming from model predictions, may be used for research and to inform policy development.

lurker • December 24, 2023 12:24 PM

@Winter, JKN, All
“the data was used for scientific/statistical purposes”

iow just looking thanks. If they find something and make a profit don’t expect a backhander for the rape of your database. If they find nothing, then nobody loses, do they?

Clive Robinson • December 24, 2023 1:35 PM

@ lurker, JonKnowsNothing, Winter, ALL,

Re : Private Medical records.

“If they find nothing, then nobody loses, do they?”

Sadly not true…

Remember Prof Ross j. Anderson’s group in the UK Cambridge Computer labs, demonstrated and provided sufficient proof to show that to sufficiently anonymize a data base renders ir effectively usless.

Or to put it the other way, for the data to be of use for research, then it’s only vaguely obscured and finding out who one data record belongs to is fairly trivial. Thus anonymity is not happening.

It’s why people in the UK are so shocked about the cavalier attirude of the UK government.

Then it gets revieled there are atleast two levels of records… The ordinary people who’s privacy is not in the slightest protected, and the special people like MP’s and senior Government officials who’s records are treated all together differently as in way more securely. So one eule for them and another rule for the rest of us.

Worse the company they were given to is Palantir which is US based… There the act of deanonymizing makes “a new work” made on US territory thus under US jurisdiction… So no privacy protection what so ever…

Winter • December 24, 2023 2:14 PM

@lurker

If they find something and make a profit don’t expect a backhander for the rape of your database.

The database is collected for this exact purpose. And before you jump to conclusions, you should read the relevant documents about this database.

JonKnowsNothing • December 24, 2023 3:24 PM

@Winter, @lurker, @Clive, All

re: The database is collected for this exact purpose …

There is a difference between Science and Profit.

The Kaiser Research database was created for SCIENCE.
The NHS did not collect any data for research. What has been sold are the personal medical histories of everyone in the UK or used the NHS while visiting the UK, that have been accumulated ex post facto.

There were no indications of profit, profitizing, monetizing or using the data for any type of revenue generation.

The NHS data and the Kaiser data is being used for Profiteering, not science. There is science involved, just enough to find a profitable treatment or drug.

This was not the purpose of either database. It is the purpose to which the databases have been twisted. A few sentences changed in the consent form, which are in fact declarations and not subject to actual consent, makes it possible.

For another RL example of data purpose shift review the recent OpenAI board blood bath.

The org chart for the previous incarnation of OpenAI stressed Non Profit, to be funded by a Capped Profit division. The Capped Profit division got the investments from M$ and others. Once the VCs determined that the Capped Profit tax treatment was no longer desirable, they wanted to shift OpenAI to a Full Profit structure.

All they had to do was jettison 2 board members to drop the Non Profit facade.

It is the same data base, the same data entities, the same sources. Only the stated purpose changed.

It is the common problem with Opt-Out data. Organ harvesting databases went through the same shift; just a few words and a new default setting.

In California, when organ transplants became possible, you could Opt-In to donate your organs (at death) at the time you got your car license. A small pink dot sticker was added to your license+ID.

Because not enough people did Opt-In, California changed the organ donation selection to Default In. Everyone who gets a drivers license or ID card is IN the organ donation databases across the entire USA.

* These databases and organ transplants maybe Non-Profit, Capped Profit, Full Profit, Market Rate Profit

If you ask to Opt-Out on renewal, they will remove the pink dot on the ID but they do not remove your name from any of the many many organ harvesting databases, run by major hospitals and specialty procurement & insurance programs.

Once IN, you are a universal donor for any organ they want to harvest. You cannot refuse, because… well… you are dead and any rights you had ended at death.

When you actually ARE dead is another technical and legal hurdle for organ harvesting.

Winter • December 24, 2023 3:40 PM

@JonKnowsNothing
re: The database is collected for this exact purpose …

No

The Danish database.

JonKnowsNothing • December 24, 2023 4:27 PM

@Clive, @lurker, @Winter, ALL

re: Remember Prof Ross j. Anderson’s group in the UK Cambridge Computer labs, demonstrated and provided sufficient proof to show that to sufficiently anonymize a data base renders it effectively useless.

iirc(badly) It doesn’t take much to ID each record. One tranche of NHS data uploaded, used only the high-order postal zone digits for the UK. Google(?) might have been the one parsing the data. The entire dataset was decoded before the upload finished.

One person that was IDed, showed how easy it is.

They lived in a small village, more remote than urban, had a specific illness, and medications delivered. Bob’s Your Uncle.

It doesn’t matter what “please think of the [fill in the blank]” reasons given, they are all the same as General Hayden’s One Question. They use the same logic traps, grammar traps and presumptions to get The One Answer.

A perfect example is the “Danish Database Ethics Clause”. Uses a few more sentences than Hayden’s One Question to add seasoning or maybe Danish needs more words to express an idea.

Christmas Hippopotamus • December 24, 2023 7:21 PM

I don’t know how this works in other countries, but in the U.S. it goes like this –

A friendly healthcare worker will ask you to provide a signature on a 3-5 page document while stating something along the lines of “this is to confirm you understand your rights as a patient under HIPAA”

If you spend a few minutes reading the form, you might realize that you are actually signing away said rights.

Obviously, people who need treatment now might not be in the mindset to understand what is being asked of them.

🤷‍♂️🎄🦛⛄

Winter • December 24, 2023 9:33 PM

@JonKnowsNothing

A perfect example is the “Danish Database Ethics Clause”.

Sorry, but I think you misunderstood the whole Danish case. Denmark is not the US.

A important difference, there is law that makes it a crime to even store the PII of the persons in the database, any related information, without a legal reason. Actually, two laws, the GDPR and the CTR as this is medical data. Furthermore, as the ethics clause states, the analysis is done inside the hosting institute. No information is to leave the premises. This includes any type of model or statistics that can leak PII. Only aggregate statistics can be used outside of the hosting institute.

The researchers signed to this. If they re-identify any participant in the database they, and their employer, get dragged into court.

To give an idea of the teeth of the GDPR, Meta got fined 1.2B euros in just a single case, Amazon 750M euros.

JonKnowsNothing • December 24, 2023 11:50 PM

@Winter, All

re: medical data or any data set converted to [fill in the blank] use

I get the “protections” offered as “incentive” to agree.

I think you do not get “General Hayden’s The One Question” or you might realize that all of that verbiage is camouflage for what is really happening.

If you understood what The One Question is about, you would recognize all the parts subtly inserted into the sample paragraph, purporting to protect people’s information.

What is there:

a wholesale sell off of personal information to the benefit of [fill in the blank], done with a higher purpose of [fill in the blank] to benefit of [fill in the blank].

The profit is not always direct monetary income. The researchers, company, university and [fill in the blank] groups get access, get thousands of records for which they PAID NOTHING TO ACCRUE, virtually free to use for their own purposes.

The source of the data is The Public: each individual in Denmark or [fill in the blank] country. These individuals paid for every single scrap of that data, which suddenly becomes the property of the highest bidder.

Winter • December 25, 2023 4:02 AM

@JonKnowsNothing

The profit is not always direct monetary income. The researchers, company, university and [fill in the blank] groups get access, get thousands of records for which they PAID NOTHING TO ACCRUE, virtually free to use for their own purposes.

I see what happens with people who cannot rely on the rule of law. It must be difficult to live in a low trust society.

The data analysis was conducted at Statistics Denmark, the Danish National Statistical Institution.

Statistics Denmark is the central authority on Danish statistics. Our mission is to collect, compile and publish statistics on the Danish society.

So, these statistics are collected by the state for the benefit of the people of Denmark.

The rules seem simple enough:

Using scientific/statistical ‘products’ such as life2vec for automated individual decision-making, profiling, or accessing individual-level data that may be memorized by the model is strictly disallowed.

What is so difficult? Note that users have to be based in Denmark.

Winter • December 25, 2023 5:06 AM

@JonKnowsNothing

The source of the data is The Public: each individual in Denmark or [fill in the blank] country. These individuals paid for every single scrap of that data, which suddenly becomes the property of the highest bidder.

Under the GDPR PII never becomes the property of a private entity.

Clive Robinson • December 25, 2023 5:44 AM

@ Winter,

Re : Trust is based on what you can brutally enforce.

“It must be difficult to live in a low trust society.”

Remember the UK health data given to both Google and Palantir?

That was protected under the EU data protection and UK data protection.

The likes of Jeremy Hunt saw the data as a quick way to gain a benifit.

So despite peoples written notification they did not want their data diseminated or used for research the UK Gov took the view they owned the data so could do what they damn well liked.

The thing is medical data unlike other personal data is in a very special group of personal information, that you have to share with others for it to be of use to you. Such information is a “personal genie” when alowed out of it’s bottle it can not be put back in.

In the UK it used to be so protected that even patients were not alowed to see it nor other professionals.

Now this century the likes of Google lobbying has in effect stolen it away, beyond my and others express wishes,

Why?

Because I am not alowed to brutaly enforce my rights over it…

In the past English law allowed as punishments for offending the common or specific morals “gelding”, “gouging”, “drawing” and even “boiling alive” to individuals who had offended trust.

Now those offenders hide their plans and ill intent to others –and that is what it is– behind corporate walls and the like. As they see it safe from others retribution.

So it is only a matter of time, with politician and civil servant positions attracting certain types before everyones “Personal genies” are let out of the bottle never to return.

You are I know aware of the danger of “Think of the children” well there is another phrase I’ve warned about befor which is “for the common good”.

Basically it’s been used to turn the sanctity of a persons body and death into a very profitable “Organ Harvesting” operation in various parts of the world…

In effect people who can not defend themselves are being sentenced to a very unnatural death even against their express and written wishes.

If a state by claim of “for the common good” gives it’s self the right to execute innocent people and steal their bodies in part or whole, do you honestly think anything lesser will not given a little time and influance become up for grabs for theft for others profit?

JonKnowsNothing • December 25, 2023 6:12 AM

@Winter, All

re: The rules seem simple enough: What is so difficult?

Governments collect all sorts of data about their citizens, slaves, travelers, vendors, transients, economics and other aspects that impact any ruler’s ability to field a military force in sufficient numbers on demand. That is the underlying question for all governments. There is little or nothing anyone can do about that.

The aspect that is difficult is when government accumulated data or agency accumulated data is handed over to “others”, generally stated to be for some [noble purpose], but the underlying aspect is how to monetize the information.

So there are at least 2 aspects that are difficult

Source Issues

The source of data is some interaction set off by humans (via computers or direct) that is traced from A-Z.

A person goes to the MD over their life time. When young they are healthy. As they age they get diabetes, heart disease. The effects of a lifetime usage of alcohol and binge drinking causes liver disease. Then they die from cascading organ failure in Hospice.

This sequence is being sold, but that person has no meaningful way of saying: No.

However, it is not just that specific instance that is being sold.

It is a unique trace back to the beginning, back to the primordial ooze. Back farther to the beginnings of the planet that set up the primordial ooze, back farther to the beginning of the cosmos, all the way back to the beginning of time and the big bang.

That is what is on sale.

Not just that the person got diabetes at 35. The entire history of that person’s lineage, survival of wars, famines, ice ages, deprivations, migration. An entire cosmos of history.

And they do not get to have any say at all about it.

The examples of Meta and Google transgressing the contract shows the data was NOT protected. The fines are trivial in face of the enormous revenues generated.

Was Meta and Google required to remove ALL data from Everyone in their possession for the transgression?
Were they required to produce proofs of the scrub of all data, similar to the proof required by the GCHQ for The Guardian’s copy of the Snowden Database?

Likely not. They kept the data, they archived it, they have backups and backups of the data and no one is the wiser.

Yet the person who was wronged gets no say in the matter at all.

The protection is vapor, fog, mist. It does not exist.

Accrue Issues

This is a bit more thorny and Big Tech, Big Pharma, Big Science, Big Business, Governments certainly hope no one is paying attention.

The mantra is:

It’s just data. Just immaterial data points that we have anyway and can use for [a noble purpose].

Clearly, Meta and Google were not abiding by the rules so by definition they were not doing [a noble purpose] with the information. So they got to buy off the issue with a fine but get to keep the [not noble purpose] uses.

These immaterial data points, do not fall out of the sky, they come from complex, interactions over decades and lifetimes. Consider the mechanism to collect this information.

The collection for medical data:

Hospitals have clinics, operating rooms, MDs, RNs, staff, janitors, pharmacies, supplies. They are built over time in cities, towns, villages. They are upgraded and replaced (except the NHS buildings are collapsing). They have parking lots, electricity, laboratories, testing gear, MRIs, CAT scans and Xray. There are offsite clinics, staffed with MDs, RNs, MAs, and all the people with medical degrees and support staff, down to the person collecting the volumes of medical waste generated. There are roads and transportation access and helicopter landing pads.

There is an entire infrastructure created to collect the blood profile ordered by the MD tracking the progression of liver disease.

This entire global system is funded by taxes, insurance premiums or paid by the person with the liver disease who also may get a bill from for that blood test. Even when there is a functioning NHS, where the individual does not pay directly, they pay indirectly through other taxation, fees, levies. It’s not free. The buildings have to be paid for. The salaries have to be paid for.

And that person with diabetes paid for it all. They paid over their lifetime. The citizens of the city paid. The people of the country paid. Even Big Hospital Corporations paid for the infrastructure.

Google, Meta paid NOT ONE CENT for the infrastructure.

To continue to get a grasp of the magnitude, consider all the infrastructure you have experienced in your own life time of change, over multiple lifetimes, over the entire span of the life of the city, village, country all the way back to the beginning where that person’s DNA was set that contained the genes that millennia later trigger diabetes.

Google, Meta paid NOT ONE CENT for all of that.

You did. You family, relations, friends, neighbors and strangers. YOU PAID for it.

Consider:

In countries that have a historical view of colonial resource theft, the view is:

If I see it I can take it. It is mine because [god, laws, police] say so.

When such people see a forest they think: THAT forest is MINE. I can cut all the trees and sell the wood to build houses and villages and towns and MacMansions. Then I can put cattle on the clear cut area and sell the meat. I can plow the better parts and grow grains and sell them to the highest bidder. I can do this because THERE IS NOTHING THERE.

Except there is something there. There are already people in that forest, animals in that forest, there are nomads and reindeer in that forest. But these do not count by [god, law, police].

In USA, Atlanta Georgia there is a public fight over the city taking hundreds of acres of city public lands to convert to a closed wall stockade for police military-style urban warfare training center to be used by FBI, LEAs, 3Ls.

This is the equivalent of conquistador colonials landing on foreign lands, planting a flag and claiming all the land for the King and Queen of Spain. Entire continent’s inhabitants disenfranchised by a flag.

Australia continues this disenfranchis-ement.

Anytime we take what is not ours and sell it to another, that is called theft.

This is both theft and disenfranchis-ement on a global scale.

The Tech-Conquistadors pay nothing to reaping the whole world’s data and enslave both the population and the mechanisms that create that data. New data must be created, and the enslavement of the system is entrenched.

Winter • December 25, 2023 9:18 AM

@Clive

Remember the UK health data given to both Google and Palantir?

Any evidence this is even considered in Denmark? Have they done anything like this in the past?

What do you suggest as a solution? Not keeping medical records?

@JonKnowsNothing

The aspect that is difficult is when government accumulated data or agency accumulated data is handed over to “others”,

What others? Handed over? How is this relevant here?

Winter • December 25, 2023 11:06 AM

@Clive, JonKnowsNothing

That was protected under the EU data protection and UK data protection.

I think the basic difference is that you expect your governments to break the law as they see fit. The Danes expect their governments to honor the rule of law.

I assume your experiences confirm your expectations, and those of the Danes confirm theirs.

I was told when I was young that a people get the government they deserve.[1] In the case of the Danes, they vote for politicians that follow their expectations. I have always wondered why Americans and Brits vote for people like Cruz or Johnson.

[1] I regularly ask myself what I have done to deserve my different governments. But I do see that I have been part of the problem.

Clive Robinson • December 25, 2023 11:13 AM

@ Winter, JonKnowsNothing, ALL,

“Any evidence this is even considered in Denmark? Have they done anything like this in the past?”

As I’ve pointed out on this blog before,

“You are not a murder untill you are convicted of committing the crime.”

Thus as they say in financial adverts,

“Past performance is no indicator of future performance.”

Add in mathmatically as time progresses the likelihood of an act occuring for the first time increases.

So whilst this may not hqve been formally “considered in Denmark” yet, it is almost a certainty it has been thought of informally. Thus with the way US High Tech Corporate lobbying works it just becomes a matter of time before discussions are held. Thus,

“Not if, but when?”

To think otherwise would be shall we say “just a little bit quaint”…

JonKnowsNothing • December 25, 2023 12:57 PM

@Winter, @Clive, All

re: I think the basic difference is that you expect your governments to break the law as they see fit. The Danes expect their governments to honor the rule of law.

It is not so much the government it is the corporations that break the laws.

Governments changes laws to suit themselves, so they do not break laws, they modify them as needed. Individuals within a government or agency can break the law, because individuals do not create laws, unless they have been granted specific powers to do so.

The CIA as a US Government Agency, breaks laws all the time, both domestic and foreign but nothing happens to any of the people involved except in the rare case where things go Burp Badly. They have been given specific powers by the USA to break any laws for any purpose, reason or situation.

Corporations break laws and only on rare occasions is it revealed. Corporations lobby governments to change laws with proposed alterations that are beneficial to them and detrimental to others.

Google, Meta broke the EU laws on privacy. Someone decided a fine was sufficient punishment. Did they break it again or are they better at obscuring a shifting boundary?

One might trust a government but to trust a corporation?

Trusting a science group might not be a good idea either, there have been more malfeasance from science groups than many others. Malfeasance doesn’t mean to break laws, because often it is done under the auspices of a law or government. The world is surrounded by bad actors in science, medicine and technology. The graveyards are full of the results.

Expecting status quo in human interactions as a protection, ignores the historical fact that humans do not reside in a status quo situation for very long. Long is relative: days, weeks, years, centuries.

Denmark center of mutual struggles for control of the Baltic Sea with Sweden, Germany
Denmark retained control of the old Norwegian colonies
The Danish people were among those known as Vikings
Danish wars of religion, Wars with Norway & Netherlands

A quick view of the history of Denmark shows that the Status Quo does not remain Quo for long.

As @Clive pointed out: history has a habit of changing.

lurker • December 25, 2023 2:37 PM

@Winter

The data analysis was conducted at Statistics Denmark, the Danish National Statistical Institution.

I hope the Danes have not suffered the same “reform and opening up” that we have, where govt dept headcounts are reduced and work contracted out in the name of “efficiency”. The effect on Statistics NZ has been to render the results of the last two censuses of doubtful value.

Under the GDPR PII never becomes the property of a private entity.

That might be what the law says, and recent fines on major US corporations might appear to give credence, but what has happened to the data involved in those cases?

Winter • December 25, 2023 3:10 PM

@JonKnowsNothing

Governments changes laws to suit themselves, so they do not break laws, they modify them as needed.

Parliament changes law. If voters are OK with that, they indeed get the government they deserve.

@lurker

That might be what the law says, and recent fines on major US corporations might appear to give credence, but what has happened to the data involved in those cases?

The major US corporations pay huge fines, upto 1B euros for Meta and 750M euros for Amazon. They might even be banned.

JonKnowsNothing • December 25, 2023 9:09 PM

@Winter, @Clive, All

re: US corporations pay huge fines, up to 1B euros

Clearly one of the areas where definition fails is the definition of “protection”.

A fine is not “protection”. A fine means the “protection failed”

US Corporations are breaking EU laws and all they get is a fine? F.I.N.E (1)

Europe did NOT protect the data. Europe got a lot of money for pretending to protect the data.

It’s like the question about a tree falling in the forest. (2)

“If a tree falls in a forest and no one is around to hear it, does it make a sound?”

The sound is not important, neither is the size of the fine.

What is important is that the tree fell, and that the protection failed.

===

1)
F.I.N.E. == “F uc ked up, In sec ure, Ne uro tic and E mot ional”

2)
ht tps://en.wikipedia. org/wiki/If_a_tree_falls_in_a_forest

is a philosophical thought experiment that raises questions regarding observation and perception.
“If a tree falls in a forest and no one is around to hear it, does it make a sound?”
Zen: “If a tree falls in the forest, and no one is around to hear it … what color is the tree?”
‘Do you really believe that the moon only exists if you look at it?”

ht tps://en.wikipedia . org/wiki/K%C5%8Dan

A kōan is a story, dialogue, question, or statement that is used in Zen practice to provoke the “great doubt” and initial insight of Zen-students.
The popular western understanding sees kōan as referring to an unanswerable question or a meaningless or absurd statement. However, in Zen practice, a kōan is not meaningless, and not a riddle or a puzzle. Teachers do expect students to present an appropriate response when asked about a kōan.

h ttps://en.wiki pedi a.or g/wiki/Satori

Satori is a Japanese Buddhist term for awakening, “comprehension; understanding”
In the Zen Buddhist tradition, satori refers to a deep experience of kenshō, “seeing into one’s true nature”. Ken means “seeing,” shō means “nature” or “essence”.
Satori and kenshō are commonly translated as enlightenment.

lurker • December 25, 2023 9:18 PM

@Winter
“The major US corporations pay huge fines”

aka cost of doing business, or they may consider that a fair price for the data. Is there any EU insitution with the right to inspect their servers stateside to be sure they “deleted” the data?

“They might even be banned”

The methods to achieve a ban would be truly Byzantine. eg. a single account at Amazon can purchase items from amazon[dot]com, amazon[dot]uk, amazon[dot]au, and probably more. Chopping the cables would sustain a ban, but who wants that?

Clive Robinson • December 25, 2023 10:58 PM

@ lurker, JonKnowsNothing, Winter, ALL,

Re : To stop a horse you don’t need a stable door or paddock gate just a hobble on the legs.

“The methods to achieve a ban would be truly Byzantine.”

Because what you are suggesting will not applying preasure at a viable choke point.

Consider, such Corps only exist to gain value for their shareholders.

The way to ban them is to stop their income stream that gives them value.

Most Corps are uterly reliant on,

1, The EVM credit card system.
2, The Swift interbank system.

Make it illegal for them to transfer money and these Corps would stop over night and their shareholders flee in the days to follow.

The point @JonKnowsNothing was making with,

“Europe did NOT protect the data. Europe got a lot of money for pretending to protect the data.”

Is a point most have failed to grasp. The EU sees a tremendous amount of wealth leave the EU to US Corps that pay no tax etc on their activities in Europe. Thus the fines are not actually “Preventative actions” but “Revenue Raising actions”.

It’s a point I’ve been making for some years now. Tax authorities are seeing declining revenues due to “off shore” activities that “virtual organisations” easily achive via communications.

The Government tax authorities can not raise taxes because it “kills businesses” and makes individuals very angry thus vote against those who even hint at raising taxes.

Thus the only two ways left are,

1, Reduce outgoings.
2, Increase penalty fines.

The first can be seen by the “War on the poor and disadvantaged” that gives rise eventually to the fraud of Robo-Debt and the like.

The second can be seen with the level of fines for what is increasingly “invented offences” such as putting a used tea bag in the wrong bin.

So because the EU can not tax Google, Amazon, Meta and Co they are going to find ways of fining them to a similar amount. Whilst it won’t “kill the Corps” it will either get revenue from them, or cause them to nolonger trade in Europe which opens the market to those the EU can tax, fine, or both.

JonKnowsNothing • December 25, 2023 11:11 PM

@Winter, @Clive, lurker, All

re: Bans but who wants that?

A cautionary story, here at what soon maybe end of the fossil fuel era, about bans and some unexpected reactions to them.

Long ago, a scholar explained about Oil and The Economy: US and Global but primarily the US.

* Oil is what runs the World, and the USA runs Oil

* Sure other countries have deposits of oil but like deposits of diamonds, oil falls into the control of the USA, the same way diamonds fall into the control of De Beers.

* There is one thing, above all things, that the USA will not tolerate: A threat to oil.

It takes a bit of perspective to track this and some scholarly curiosity to connect the dots, but many a war or conflict is about oil. Either oil comes under the control of the US or there will be deaths, regime change, pillage and catastrophe until it does.

Consider very carefully whether a “ban” on US companies like Palantir (CIA), would actually have the desired results getting “US Corporations to behave themselves” or an unanticipated backlash the type of which no one wants – ever.

Data is the called the New Oil, for a reason. EU, UK and others, will either give the data to the US or we will take it, any way we can.

Winter • December 26, 2023 7:33 AM

@JonKnowsNothing

US Corporations are breaking EU laws and all they get is a fine? F.I.N.E (1)

4% of global turnover per infraction does not sound fine. A billion here, a billion there, and before you know you are talking serious money.

Also, this means exclusion from government contracts.

JonKnowsNothing • December 26, 2023 8:39 AM

@Winter, @Clive, @lurker, All

re: 4% of global turnover per infraction does not sound fine.

What a preposterous assumption…

In the USA, the first thing a kid learns here is: DO NOT GET CAUGHT. Maybe other countries have that lesson too.

Zho…..

How many “infractions” do you know about?
How many incidents of infractions do you know about?
Are you sure you have found every infraction?

This is the stuff that we discuss all the time here. How to not get caught and how to obscure activities. I would not be at all surprised if the 3Ls of Europe do not use and know of such “infractions”. (1)

It’s a small price to pay for a public mea culpa penance.

FWIW: Google doesn’t pay a penny. It’s the customers of Google that pay the fine. You are not going to make a dent in any of the TechBro Oligarch wealth.

===

1) The 3Ls of Europe. iirc(badly) During the revelations of the Snowden Files, one of the Nordic countries pronounced themselves SHOCKED SHOCKED that the NSA+Co was spying in Europe and assured their country and EU that “we do not do such things”.

You can guess how much crow they ate when a few weeks later, it was “proved” they did and they did it with the 5EY and they did it against their neighbors: all of them.

The price of crow feathers when up after that as each country in the EU fell, one after another, under the Sunlight of Snowden.

It simply shows how many infractions can go unaccounted for over a long period of time.

Winter • December 26, 2023 9:04 AM

@JonKnowsNothing

Europe did NOT protect the data. Europe got a lot of money for pretending to protect the data.

Criminal Law always intervenesafter the fact, it never protects the victims. But the GDPR requires protective measures. Not having these is already punishable.

What you all seem to miss is that under the GDPR the mere possession of the data is a crime. Anyone who obtained data from Meta is liable for punishment.

So because the EU can not tax Google, Amazon, Meta and Co they are going to find ways of fining them to a similar amount.

The EU can tax them, all have precense in the EU. Data centers, cables, commercial activities. I know Americans are won’t to call punishments for crimes a “tax”. But criminal punishments are not a tax. And Meta clearly committed crimes against people and they were warned before, and fined, and did not relent.

I know it is difficult for Americans to understand, but they too have to obey the law. If you don’t want to do the time, don’t do the crime.

JonKnowsNothing • December 26, 2023 11:24 AM

@Winter, @Clive, @lurker, All

re: under the GDPR the mere possession of the data is a crime / sharing it is a crime

I do not see anyone in Europe arresting the entirety of the GCHQ, NSA and associated 3Ls. They are right there under your nose in Europe and UK.

When in doubt:

in UK wait at the exit for them to turn on to the wrong side of the road
in Europe, wait at the gate at Ramstein Air Base near the town of Ramstein-Miesenbach, in southwestern Germany, and look for the folks in civilian dress exiting the base.

You don’t even have to guess if they have verboten data.

However, at least you have acknowledged that the “protections” are not “protections”.

[law] never protects the victims.

At least that’s a start a blowing the covers off…

So far, at best, you might manage to have a show trial for data sharing. We do the same in the USA with a lot of hoopla.

I can hardly wait for the GDPR to arrest ChatGPT for data sharing. (1)

===

1)
ht tps://www.theguardian. com/technology/2023/dec/26/ai-artifical-intelligence-secrets-chatbots-chatgpt–mike-wooldridge

sharing private information or having heart-to-hearts with a chatbot would be “extremely unwise” as anything revealed helps train future versions.

Winter • December 26, 2023 12:40 PM

@JonKnowsNothing

In the USA, the first thing a kid learns here is: DO NOT GET CAUGHT.

So, we should treat American companies as criminal organizations? I can see your point, but I know some actually try to keep within the confines of the law.

Winter • December 26, 2023 1:14 PM

@JonKnowsNothing

I do not see anyone in Europe arresting the entirety of the GCHQ, NSA and associated 3Ls.

Spying is already illegal. The fact humanity cannot stop spies is no reason to abandon all law enforcement.

Clive Robinson • December 26, 2023 2:04 PM

@ Winter, JonKnowsNothing, lurket, ALL,

“Spying is already illegal.”

Says who?

Whilst there are restrictions on some of the guard labour in a given nation subjecting that nations citizens to both spying, surveillance, and other forms of espionage… As a general rule,

1, There are exceptions for “National security”.
2, There is no restrictive legislation for citizens of other nations and the citizens they contact.

Further any limitation only applies to activities inside the juresdictional boundries.

Thus any trafic,

1, “routed out” and back is fair game.
2, Intercepted abroad and sent back by another nations guard labour is fair game.

We know both of these are actively in use not just by SigInt agencies, but the Law Enforcment Agencies.

Take a look at the games behind the various fake “Secure Mobile Phone” companies run by Law Enforcment Agencies for other Law Enforcment agencies.

In short any restrictive legislation is totally ineffective, and was designed to be that way.

Pretending that “The Rule of Law” has some actual prevention of such tactics is a sad sad notion…

A few years back UK MP’s were horrified to be told that most if not all their communications was monitored legaly by GCHQ.

For years MPs had been incorrectly under the impression they were peotected under the Harold Wilson Doctrine,

https://www.theguardian.com/world/2015/oct/14/wilson-doctrine-spying-house-of-commons-surveillance

(note the date of the article nearly a decade old. It can be safely assumed that there has been no improvment, in fact we know the opposite is true and survailance on MPs has been significantly increased because of the use of “cloud” products that the “Sargent at Arms” of the “House of Commons” personally approved…).

Winter • December 26, 2023 2:56 PM

@Clive

Says who?

Spying is often illegal all by itself [1]. If a spy collects and transfers protected data, it is always illegal.

So, what is your point.

Also, we were talking about Danish medical data that was protected by law. Any non-Danish TLA who accessed the data would do so in breach of the law.

It is true criminals can obtain the data, or burn your house down. Those who do this might not be caught. That would not mean there was no crime

[1] https://en.wikipedia.org/wiki/Espionage

lurker • December 26, 2023 10:50 PM

@Winter

Any non-Danish TLA who accessed the data would do so in breach of the [Danish] law.

My insertion. There may be some jurisdiction where the TLA’s action could be lawful.

One has to be careful about whose law applies to whom. A Danish citizen may “buy” software from a British company and find himself subject to the laws of California. The rule of law has some ways to go when the dominant hegemon in the western hemisphere refuses to acknowledge the ICJ at Den Haag.

Winter • December 27, 2023 5:27 AM

@lurker

A Danish citizen may “buy” software from a British company and find himself subject to the laws of California.

The GDPR holds for any entity that touches PII of EU citizens. You can imagine yourself that a California’s company is not affected by this. However, if that company has any business or presence in the EU, it can be hit by the GDPR. If it has no such connection, it still can by way of other countries, like any other criminal.

Meta’s fines already total a $2.5B.

What non-Europeans, ie, Americans, do not seem to get is that in the EU, a person’s data are their inalienable personal possession. And like organs, they cannot be sold or taken from them. No tricks like shifting jurisdictions can I undo this.

Schneier on Security

OpenAI Is Not Training on Your Dropbox Documents—Today

Comments

Leave a comment Cancel reply