That's a misleading title (of the article, I know you used it verbatim).
It's more likely to be used to suppress free speech than improve security.

[removed]

[removed]

[removed]

civilian fines of 250k minimum with possible prison time of 20 years if you use a vpn to access tiktok

welcome to anericas descent into authoritarianism and censorship

Gonna be really funny when EU countries get the idea to ban Meta and Twitter and the like because, since they are based in a country (America) with terrible laws around privacy and personal data collection, they pose unacceptable risks to EU citizens/national security.

Already happening. Google Analytics is banned in Germany and Italy. Also, the US’ patchwork isn’t far off from GDPR, it’s just far less cohesive. US citizens have many of the same rights and control over their data, and have for decades in some cases.

TikTok is unquestionably a national security risk for government workers, contractors, and contracting firms.

> Google Analytics is banned in Germany and Italy.

Alas, Google violates this all the time and gets only relatively light fines as punishment. If what TikTok is supposedly doing is bad enough to get them banned in the U.S. then EU countries might decide that taking extreme measures is the way to go.

>Also, the US’ patchwork isn’t far off from GDPR, it’s just far less cohesive. US citizens have many of the same rights and control over their data, and have for decades in some cases.

Functionally, no. You don’t really have a choice when it comes to, say, the information that credit bureaus collect about you, because you can’t opt out, and they will up and sell that to anyone. They also don’t secure their databases that well.

In what way is it more of a risk than any other social media app/company?

You actually can. FCRA and FACTA provide you a ton of control and opt-out….

It’s close ties to a foreign government, it’s profiling apparatus’ in conjunction with the foreign government connections, etc.

So you have to go hunting for settings somewhere and be presented with choices that may or may not be easy to interpret in order to opt out, instead of being automatically protected? Or having the option of not letting these entities collect your data in the first place?

Also, what happens if they violate these statutes? Not enough to keep them from doing it again.

No. You don’t have to go hunting. The text:

> (a) Initial notice and opt-out requirement —

> (1) In general. You may not use eligibility information about a consumer that you receive from an affiliate to make a solicitation for marketing purposes to the consumer, unless:

> (i) It is clearly and conspicuously disclosed to the consumer in writing or, if the consumer agrees, electronically, in a concise notice that you may use eligibility information about that consumer received from an affiliate to make solicitations for marketing purposes to the consumer;

> (ii) The consumer is provided a reasonable opportunity and a reasonable and simple method to “opt out,” or prohibit you from using eligibility information to make solicitations for marketing purposes to the consumer; and

> (iii) The consumer has not opted out.

There’s more, but this comment displays a fundamental lack of familiarity with US privacy law. For example, they can’t collect data unless it’s for credit approval purposes. Meaning you must seek the service and consent to provide the info for a limited purpose. And even GDPR respects that.

In practice, none of this really helps and there is no rigorous monitoring of compliance with it or consequences to violations of it. If there were, credit bureaus would no longer be a viable business model and some kind of public agency would have to perform the function instead.

The FTC regularly fines and issues consent decrees, and has done so for literally decades…..

Any anyone working for any company in the government or a contractor’s supply chain, or anyone providing critical services for any of those companies, even the second-order ones.

Which is essentially every vaguely important company in the US.

EU countries are taking a different approach. They’re passing regulation that isn’t entirely feasible to comply with and assigning large % global revenue fines for non compliance. Their plan is to just skim revenue and benefit rather than banning.

Okay then, they can't use it on their government devices. That's already within the power of those agencies to set rules for. They don't need a new law to do that.

You keep finding new ways to tell me about how our our privacy regulations aren’t effective.

Sounds even more extreme than the censorship in China, and nobody fucking cares.

No I don’t. You seem to be deliberately ignoring the fact that privacy regulations can either deter or punish, or both. And just because some firms fuck up doesn’t mean the regulations aren’t effective. Even in the EU they don’t achieve 100% compliance all the time.

> Even in the EU they don’t achieve 100% compliance all the time.

I mentioned that earlier.

No you didn’t. You don’t understand what Google Analytics is if you think that Google is the one slapped with a violation lol.

Yes they are. Who do you think Google Analytics belongs to? It’s not like it’s a different company that happens to have a similar name.

And they keep having problems because users in EU countries where Google Analytics is banned keep finding the Google Analytics script running in their browsers anyway because Google is not err on the side of caution when it comes to what browser clients Google Analytics does and doesn’t run on.

Sigh. Let me explain:

Google Analytics is a service. A company based in the EU pays to run it on their platform. The one who gets fined isn’t Google, but the company who uses it in violation of the ban

Service providers are also supposed to make sure that their services are running with configurations appropriate to geographical/jurisdictional restrictions as dictated by statutes (or not running, as appropriate).

Except that’s not what the fine is for. The fine is for using a banned service.

EDIT: Additionally, it is not Google’s job to make sure another Company is compliant.

TFW the RESTRICT Act would apply harsher sentencing to someone using a VPN to get to tiktok ($250k / 20 years) than the charges for which the ATF initially raided the Branch Davidians (NFA violations, $250k / 10 years).

it's 1984 already? time flies.

And that's already been solved with banning it on government devices. Congress doesn't need to give all these powers to the secretary of commerce in order to mitigate that threat.

Does it matter in your mind whether these fines and consent decrees actually deter bad actors from focusing on protection of consumer data over profit?

If breaking the law earns a company $200 million p/year, not breaking the law nets it only $100 million p/year, and the penalty for getting caught breaking the law is $10 million p/year, then it's just a tax by another name. It's the feds taking a taste via a garden-variety mobster protection scheme. "You break the law, you make a lot of money, you break us off our piece and we'll sanction the behavior on an ongoing basis.

At the higher end, with the larger corporations, it's impact on behavior is likely somewhere between negligible-to-non-existent. The money is not enough to do more than subsidize on-going collection efforts.

The lesson here to private industry is to scale your criminality in order reduce the impact of real civil world consequences. Though is it even "criminality" to protect consumer data as cheaply as possible while still being able to maintain the pretense of respectability? Especially when the payment of the fine seemingly washes away past transgressions, and no criminal charges are ever filed?

It doesn't feel satisfying, as a person whose data has been ripped more than once. Make the penalty big enough to bk the company. Put some teeth in it.

Fuck and both of my state's senators sponsor it. Time for someone new

I was thinking Fahrenheit 451

No you see it’s a good thing because we hate TikTok and China so it’s just a nessecary evil /s

Meanwhile there have been thousands (and im grossly underestimating that number) of security leaks on Facebook and Twitter.

just for accessing tik tok or using a VPN at all?

this bill is extremely crazy. the people who made it and agree with it need to be voted out yesterday