Hacker News with Generative AI: Data Privacy

South Korean regulator accuses DeepSeek of sharing user data with ByteDance (bbc.com)
South Korea has accused Chinese AI startup DeepSeek of sharing user data with the owner of TikTok in China.
Coordinates of millions of smartphones feared stolen (theregister.com)
Gravy Analytics has been sued yet again for allegedly failing to safeguard its vast stores of personal data, which are now feared stolen. And by personal data we mean information including the locations of tens of millions of smartphones, coordinates of which were ultimately harvested from installed apps.
UK government reportedly demands Apple backdoor to encrypted cloud data (techcrunch.com)
Government officials in the United Kingdom have reportedly secretly ordered Apple to build a backdoor that would give its authorities access to users’ encrypted iCloud data.
Coordinates of Smartphones Feared Stolen (theregister.com)
Gravy Analytics has been sued yet again for allegedly failing to safeguard its vast stores of personal data, which are now feared stolen. And by personal data we mean information including the locations of tens of millions of smartphones, coordinates of which were ultimately harvested from installed apps.
'Meta Torrented over 81 TB of Data Through Anna's Archive, Despite Few Seeders' (torrentfreak.com)
Freshly unsealed court documents reveal that Meta downloaded significant amounts of data from shadow libraries through Anna's Archive. The company's use of BitTorrent was already known, but internal email communication reveals sources and terabytes of downloaded data, as well as a struggle with limited availability and slow download speeds due to a lack of seeders.
DeepSeek AI's Hidden Data Pipeline to China (feroot.com)
ABC Good Morning America featured an exclusive report this morning highlighting Feroot’s discovery of concerning code within DeepSeek’s AI platform.
New Outlook's security issues: Businesses should avoid switching (tuta.com)
Microsoft's "new Outlook" (introduced in 2022) has been promoted as an upgrade, but its implementation introduces severe data protection concerns - so severe that it's fair to say it's a downgrade rather than an upgrade. Regardless, Microsoft increasingly pushes personal and business Outlook users to switch to the new Outlook.
r/Duolingo Will No Longer Be Duolingo’s Unpaid Customer Support or Data Mine (reddit.com)
It brings me no joy to make this decision, but it has become necessary. For too long, Duolingo has treated this subreddit as free labor—data mining our discussions, using us as an unpaid customer support desk, and ignoring real user concerns. That ends today.
California law enforcement misused state databases more than 7k times in 2023 (eff.org)
The Los Angeles County Sheriff’s Department (LACSD) committed wholesale abuse of sensitive criminal justice databases in 2023, violating a specific rule against searching the data to run background checks for concealed carry firearm permits.
OpenAI Furious DeepSeek Might Have Stolen All the Data OpenAI Stole from Us (404media.co)
OpenAI shocked that an AI company would train on someone else's data without permission or compensation.
Experts urge caution over use of Chinese AI DeepSeek (theguardian.com)
Experts have urged caution over rapidly embracing the Chinese artificial intelligence platform DeepSeek, citing concerns about it spreading misinformation and how the Chinese state might exploit users’ data.
DeepSeek's Popular AI App Is Explicitly Sending US Data to China (wired.com)
Amid ongoing fears over TikTok, Chinese generative AI platform DeepSeek says it’s sending heaps of US user data straight to its home country, potentially setting the stage for greater scrutiny.
Texas Is Enforcing Its State Data Privacy Law. So Should Other States (eff.org)
States need to have and use data privacy laws to bring privacy violations to light and hold companies accountable for them. So, we were glad to see that the Texas Attorney General’s Office has filed its first lawsuit under Texas Data Privacy and Security Act (TDPSA) to take the Allstate Corporation to task for sharing driver location and other driving data without telling customers.
US Cloud soon illegal? Trump punches first hole in EU-US Data Deal (noyb.eu)
Since the Snowden disclosures we know that the US engages in mass surveillance of EU users by scooping up personal data from US Big Tech. The "Privacy and Civil Liberties Oversight Board" (PCLOB) is the key US oversight authority for these laws. The New York Times now reports, that Democratic Members of the (officially "independent") PCLOB, have received letters, demanding them to resign by Friday night.
LinkedIn accused of training AI on private messages (theregister.com)
LinkedIn was this week accused of giving third parties access to Premium customers' private InMail messages for AI model training.
Possible deprecation of WHOIS services after January 28, 2025 for ICANN TLDs (domaintools.com)
Registration Data Access Protocol - RDAP - is a replacement for WHOIS. WHOIS has been in use for over 40 years, and was never designed for the scale it is being used at today. While WHOIS is a text file, RDAP is machine readable JSON format. Internet management organizations like ICANN and IANA are driving adoption of RDAP as the successor to WHOIS.
GM faces ban on selling driver data that can be used to raise insurance rates (arstechnica.com)
GM sold geolocation and other driving data without adequate consent, FTC says.
FTC: Personal Data Used to Set Individualized Consumer Pricing (ftc.gov)
Is the TikTok ban a chance to rethink the whole internet? (newyorker.com)
The billionaire Frank McCourt is launching a “people’s bid” to buy the app, replace its addictive algorithm, and give users greater control of their data. Is it a publicity stunt or a sincere attempt to reform the digital age?
FTC Study Indicates Wide Range of Personal Data Used for Individualized Prices (ftc.gov)
Your Exercise Gear Reserves The Right To Track And Sell Data On How You Smell (techdirt.com)
A new Consumer Reports study unsurprisingly finds that popular exercise equipment makers collect way more data on users than is necessary, then sell access to that data to a wide variety of dodgy and largely unregulated data brokers and middle men, who in turn generally play fast and loose with it.
Texas Sues Allstate over Its Collection of Driver Data (nytimes.com)
The State of Texas sued Allstate on Monday, accusing the insurer of illegally tracking drivers by way of their phones through a subsidiary called Arity that claimed to have the “world’s largest driving behavior database.”
PostgreSQL Anonymizer (readthedocs.io)
PostgreSQL Anonymizer is an extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a Postgres database.
Ministers mull allowing private firms to make profit from NHS data in AI push (theguardian.com)
Ministers are considering allowing private companies to make profits from NHS data as part of a push to revolutionise the health service using artificial intelligence, government officials have indicated.
China: Chinese biometrics data exposed on unsecured server (medium.com)
This is a new chapter of my responsible disclosures to entities that have accidentally left unprotected data exposed in the cloud by “mistake”.
EU court fines European Commission for breaching its own data privacy laws [pdf] (europa.eu)
Tesla data helped police after Las Vegas truck explosion (apnews.com)
Your car is spying on you.
Is there such a thing as "private, interactive databases" for SaaS's (ycombinator.com)
So i've been building a product and my clients really hate the idea that their code is stored on my database (unencrypted). The problem is that I need to process the data in the background often and thus I cannot store it end-to-end encrypted. Is there any service that allows you to deploy some sort of database that only the client accesses and at the same time allows me to process it somehow maybe via apis?
VW Group Collects Vehicle Movement Data (twitter.com)
38c3 Talk: Volkswagen, we know where you parked your car [German] (events.ccc.de)
Bewegungsdaten von 800.000 E-Autos sowie Kontaktinformationen zu den Besitzern standen ungeschützt im Netz. Sichtbar war, wer wann zu Hause parkt, beim BND oder vor dem Bordell.