Schneier on Security

Clive Robinson • January 21, 2020 12:35 PM

@ Phaete,

And yes, you will get on a list of people that requested their data to be removed (in case they try to add it again…)

And thereby you reveal two potential attacks against the system.

That is how much information is required?

Take my name it’s far from unique, I’ve actually met a couple of people with the same name as me at conferences and exhibitions. One was because somebody paged me, and two of us turned up at the Information desk, much to the confusion of other people.

Thus the attacks,

The more people that register the longer and slower the search and the more checks the company has to do. Which means they either go illegal or they pay the price which makes their “product” not cost effective to keep.

The second is to register with the absolute minimum data possible thereby causing two “force multiplier effects”. If there are say five “Clive Robinsons” on the register the company has a choice to make when they get a “clive Robinson” come up. They can just assume on a minimal match the exclusion is valid, or search through all the Clive Robinsons on the list to check they all don’t match before keeping the data. But the less data held on that exclusion list the less possible it makes it to be certain they are not a match…

Thus the more data the companies have to ask you for. Which will absolutly annoy the heck out of most people these days, thus they will be less inclined to hand over details.

But there is a subtal way for list keepers to make lots more money which would please the Government Entity types. That is they charge by individual search, but deliberately limit the number of terms you can search for on each search. Which makes the search to check more expensive for those that want to keep user data.

Because the only way to stop privacy invasion is to make it to expensive up front to do. And for those that get caught mandatory tarrifs on time and fine per failing and remove the “director/officer limit on liability” so if they do cheat they can not get out of it by using the likes of bankruptcy or shell companies.

But even then there will always be some with psychopathic tendencies who will “risk it” but those are supposadly “1 in 5” of business leaders –depending on who’s study you use– should be somewhat easier to catch due to lesser numbers.

Oh and “means testing” on such fines should be based not just on “found wealth” but “assumed wealth” from the likes of “lifestyle indicators”. Which might sound unfair, but if you think about it, if your lifestyle is above the norm for what you earn etc, then you are probably a crook anyway. Some jurisdictions do have laws in place like this supposadly to catch “serious crime” bosses and the like, so the idea is not new as such, it’s more the perception issue of company directors/officers are honest people, when the figures tends to suggest they are less honest than the general population who are not directors or officers of companies of any size.

Clive Robinson • January 21, 2020 6:00 PM

@ Phaete,

So if one were to setup an automated template to roll out several hundred information requests/deletions for the top 250 offending companies, then hosted that publicly.
If you get enough people to do it, it would cost those companies a lot of money.

If I remember correctly, some years ago the home address of the self styled “Spam King” became known and “public minded activists”[1] signed him up for anything and everything, and the resulting mail was turning up by the truck load. Giving him the problem of soeting through it to find his actual important mail.

A friend goes about doing things in a slightly different manner but it involves obtaining the home address of the directors and officers of the company concerned, verifying they actually live at the address by various “credit databases” etc. And in effect sending them a contract promising certain actions in response to theirs.

[1] Activist is a nicer word than “disobedience” as it does not imply an negitivity or potentialy non obayance of authority in the action.

Clive Robinson • January 22, 2020 3:34 AM

@ Lurker,

…could this put a heavy boot into selfies?

You would think so but…

The UK’s Met Police, have found social media to be a very good way to gather evidence about criminals.

Apparently criminals frequently post “selfies” of themselves and their friends either in the “criminal act” or “with the proceads”…

Back a decade or two ago criminals used to “big it up” down the pub not on social media by “flapping their gums” and some snitch / grass / confidential informant or under cover cop would pass it back to detectives. So much so that something like 80% of “solved crimes” were due to this route, not what we would consider “investigative measures” (forensics and enquirers to find witnesses etc). In fact the Met police were so dependent on this method, that a number of serious crimes never got investigated by the correct investigative measures at the time, so the wrong people got prosecuted and cleared and / or the cases went dead cold.

The fact that some criminals are still “bigging it up” but now by the clear and near impossible to deny “Social Media” kind of says something about their “group think” issues…

Oh the other way criminals often get caught is that they don’t plan properly. That is they get fixated on the crime and get away and don’t consider / plan what to do next. Thus they get caught trying to monetize the proceads.

One clasic example was the “alledged” IRA theft of millions of pounds in bank notes from a security distribution center. Because the notes were new and the serial number ranges were known and put out by the authorities, the money more or less became waste papet. Thus the money started showing up in strange places such as “wheelie bins” –more usually used for rubbish– at the bottom of peoples gardens hidden in bushes. Presumably the criminals were waiting for things to die down sufficiently that they could start putting it into circulation… But the IRA had a reputation for hiding weapons and explosives, and it was not in “wheelie bins at the bottom of the garden”. Which prompted some to observe that maybe people were being set up and scores were being settled.

One of the reasons we have “organised crime” is that some criminals realised you should not go around flapping your gums or having / displaying conspicuous wealth without reason. So they set themselves up a “society” that provides monetization of proceads and money laundering services as standard along with legal services etc advice and “specialists”.

The point being if you can not make it in business without going bankrupt, then you are not going to make it as an unconvicted –thus successful– career criminal.