Post by @suzannealdrich@hachyderm.io

2026-03-03 20:40 UTC

@paul_ipv6 So where’s the national privacy legislation, guys? Has there been any good draft policy written already that we can retitle and relaunch? Can we get all the big privacy orgs to back it? Publicize it maybe? Memeable? I’m tired of constantly being a victim and nobody ever fighting back for our right to not be snooped on and surveilled, and then to have our snooped-on data stolen. I’m in so many dark web dumps I don’t even look anymore. It just never seems to end and I don’t see how we are going to stand up to the lobbyists without seriously organizing on the privacy agenda. It’s just like microplastics. It’s toxic and everyone agrees that we need to get it out of our environment but nobody is talking about eliminating the problem at the source. @briankrebs @SteveBellovin

Replies (2)

@SteveBellovin@infosec.exchange 2026-03-03 20:55

@suzannealdrich @paul_ipv6 @briankrebs There are several good state laws to copy, such as California's and Colorado's, and of course there's the GDPR. There was a decent Federal bill a few years ago but Pelosi killed it, because it preempted stronger state laws like California's. Industry, of course, doesn't want any of this. "Data is the new oil!" No (and I wish I'd thought up this line, and I don't know who did), it's the new plutonium—small amounts are very toxic, and too much concentrated in one place can have very bad consequences. But if there are going to be privacy laws, they want one law in the US, not 50. In the meantime, they're pushing (and drafting) weak state privacy laws, some of which have been enacted. Of course, I'll believe that things like the GDPR actually work when Facebook et al. have to pull out of the EU. I do, though, suspect that we're thinking about privacy regulation incorrectly. The paradigm of notice and consent is >50 years old and it doesn't work. My thoughts on that are at https://gwjolt.org/files/volume_1/GW_JOLT_1_1_Bellovin.pdf.

Open ##1597554
@karlauerbach@sfba.social 2026-03-03 21:43

@suzannealdrich @paul_ipv6 @briankrebs @SteveBellovin My wife took a small step in fighting back - she has a set of false names, dates, and places that she uses. A few years back the WSJ did a front page article on her doing this. I have a copy of the 1974 HEW report on computers/privacy. It's concerns about data linking have come true - and have even exceeded what was imagined. (And there was no lack of imagination - for instance Lance Hoffman's article from that era about pulling personally identifiable information from seemingly anonymous databases.)

Open ##1597555