Further reading:

AP: Across US, police officers abuse confidential databases

https://apnews.com/general-news-699236946e3140659fff8a2362e1...

> It's not unheard of for an officer themselves to be the stalker

This was one of the motivations for passage of the Driver's Privacy Protection Act of 1994. Nowadays, officers need a legitimate reason to run a plate - unless the patrol car is fitted with automatic cameras[1] that look up every plate of every car they drive past.

> The Virginia state police used license plate readers to track people’s attendance at political events; > The New York Police Department used license plate readers to keep track of who visited certain places of worship, and how often;

> Despite all this surveillance, ALPR technology has been repeatedly shown to be unreliable; like other police technologies, ALPRs can and do make mistakes.[2]

Generally, court decisions have held that you have zero expectation of privacy when you are in public spaces. Current license plate standards[3] aim for plates that are not cluttered and are easily read by the human eyeball, despite being wrapped with license plate frames (which usually make the state hard/impossible to read which is the most common failure mode for ANLR[4]). If the reflectivity material (traditionally called "ScotchLite"[5]) is worn out (or defaced), most states require the plate to be replaced.

Notes:

0 - https://en.wikipedia.org/wiki/Driver%27s_Privacy_Protection_... Prior to passage, a slang term for running/looking up the plate/registration of a car with a pretty woman driver was "running a date".

1 - https://sls.eff.org/technologies/automated-license-plate-rea...

2 - https://www.aclum.org/publications/what-you-need-know-about-...

3 - https://www.aamva.org/getmedia/646bcc8a-219b-47d8-b5cd-72624...

4 - https://www.aamva.org/getmedia/0063bf88-cb44-4ab9-90b6-200c8...

5 - https://www.3m.com/3M/en_US/scotchlite-reflective-material-u...

Disclaimers:

I used to work for my state's motor vehicle department and had database/developer access to driving licenses and motor vehicle registration records.

I graduated from a police academy when I was a youngster.*

> How is that achievable?

The core ill is aggregated data, because that's what allows the mass in surveillance, data mining, etc.

The collection actions are almost immaterial. Without persistence they must be re-performed for each request, which naturally provides a throughput bottleneck and makes "for everyone" untenable.

If we agree the aggregated data at rest is the problem, then addressing it would look like this:

1. Classify all data holders at scale into a regulated group

2. Apply initial regulations

   - To respond to queries for copies of personal data held
   - To update data or be liable in court for failing to do so
   - To validate counterparties apply basic security due diligence before transferring data (or the transferer also faces liability)
   - To maintain a *full* chain of custody of data (from originator through every intermediate party to holder) so that leaks / misuse can be traced
   - To file yearly update on the types, amount of data, and counterparties it was transferred to with the federal government that are made public

It's not. But the first step is classifying and documenting the problem.

Sorry, I was ambiguous in what I meant.

It is not realistic to say that no person is allowed to keep track of another person; watch where they go, when, with who, etc.

It should not be acceptable for a company to gather information on "everyone"; where they have been going, when, with who, how often, etc. And it should not be acceptable for them to sell that information (to government agencies OR private citizens).

It's a matter of scale.

- Making the first one illegal/impossible would be difficult/costly; and not doing so has a limited impact (to society, not to the single person affected).

- Making the second one illegal is much easier, and it's much easier to shut down a large company doing it than it is 1,000 individual stalkers. The impact of making it illegal is much wider and better for society as a whole.

We don't want anyone being stalked. But in a cost/benefit analysis, we can do something about one of them but not the other.

It's not achievable.

The only way is through - everybody should get into the practice of stalking and gossiping about each other in a Molochian environment, where the people who do not do so suffer from the losing side of an information asymmetry.

Expect AI, especially post-Mythos, to just enable this at even further scale. Consumer grade wireless networking gear as a whole is a very wide attack surface and is basically never updated.

If PIs can "legally" do it then it sounds like there is a law which allows them to do it. That law can be revoked (unless the power comes from Constitution which would make it effectively impossible to revoke).

Note that PIs are effectively illegal under GDPR by default. They would generally need to provide Article 13 notice, i.e. you would become aware of them unless they were just asking around without actually following you. Member states can make them legal though (via Article 23) and likely in many cases they have done so.

This is the important point. You need the right to not be discriminated when you withhold your consent, otherwise your consent is effectively meaningless, as it is forced on you by your impossible bargaining position. This is one of the central pillars of the GDPR without which it wouldn't work at all. Be advised to make asking customers for consent that doesn't directly benefit them illegal as well, lest you risk creating another wave of malicious cookie banners.

Criminals are long gone baby. Stop worshipping them.

The sign won't be "don't do mass surveillance".

It'll be "make money off mass surveillance, but don't get caught like Flock did."