AT&T's Top Anti-Net Neutrality Lobbyist In California Doesn't Register As A Lobbyist

from the funny-how-that-works dept

We've noted for years how U.S. lobbying laws and restrictions are essentially hot garbage, and are routinely laughed at by some of the country's largest corporations. The legal DC definition of a lobbyist was beefed up slightly back in 2007, when the Lobbyist Disclosure Act was notably amended by the Leadership and Open Government Act of 2007. Those changes required that if an employee spends more than 20% of their time lobbying, they have to register with the government as a lobbyist, detail their travel with lawmakers, and more fully outline their contributions to politicians and their myriad foundations.

But many lobbyists responded to those changes by just changing their title or calling their lobbying... something else. We've examined, for example, how Comcast's top lobbyist David Cohen shifted his title to "Chief Diversity Officer" in order to skirt around that 20% restriction. Cohen often can frequently be seen holding press junkets heralding Comcast's altruism because it offered some discounted broadband connections to the poor to get its NBC Universal merger approved. But the lion's share of Cohen's time is spent lobbying local lawmakers during these junkets.

Comcast, it's worth noting, gets really mad when you point this out.

State lobbying restrictions, as you might imagine, aren't much better. Another lobbying juggernaut in the telecom space, AT&T, has also found itself under fire for lobbyists who pretend not to be lobbyists. The company's top lobbyist in California, Vice President of Legislative Affairs Bill Devine, has never registered as a lobbyist under California law. Devine has spent a lot of time lately lobbying to kill efforts in California to pass net neutrality law (you know, for freedom!), without adhering to lobbying requirements:

"By not registering as a lobbyist, Devine can take advantage of political influence techniques that registered lobbyists are banned from under California laws. The Political Reform Act of 1974 requires registered lobbyists to disclose their lobbying activity expenses to the state. It also bans them from giving gifts worth more than $10 to state, legislative and agency officials. Under Proposition 34, enacted in 2000, registered lobbyists are also banned from making campaign contributions."

Devine's lobbying lambada was noticed courtesy of an anonymous complaint filed with the California Fair Political Practices Commission (FPPC):

"William H. Devine, an AT&T Vice President, unlawfully fails to register as a lobbyist, despite spending the majority of his time in the Capitol Building talking to lawmakers and staff in order to influence legislation. It is an open secret in the Capitol building that Mr. Devine is an undeclared AT&T lobbyist."

"Mr. Devine hides his lobbyist status by setting up meetings under other AT&T employee and lobbyist names,” the complaint alleges. “In particular, Mr. Devine has recently been lobbying legislators on SB 822 and SB 460. On information and belief, Mr. Devine attended numerous meetings with other AT&T lobbyists, employees and grant beneficiaries, including, but not limited to, employees of CalInnovates (paid by AT&T to work against SB 822/SB 460) and a researcher paid by CalInnovate, David Sosa. He may also have accompanied Mark Kleeman, a fellow at University of California – San Diego."

This isn't really complicated. Devine has been paid $117,000 so far this biennial legislative session by AT&T for lobbying-related activities, most notably related to AT&T's lobbying against the state's two net neutrality laws, SB 822 and SB 460. He coordinates routinely with other AT&T lobbyists, and works hand in hand with the various policy groups, think tankers and consultants AT&T uses as proxies for its messaging, including that outfit that was just busted trying to scare grandmothers away from net neutrality via misleading robocalls.

The FPPC has given Devine 14 days to respond to the complaint. But if history is any indication, it's likely no punishment will materialize. Because despite our collective, bipartisan chirping about how grotesque American lobbying and corruption is, these sort of things tend to float in one ear and out the other of the collective American consciousness. It's also kind of hard to improve state and national lobbying rules, when you've got an ocean of lobbyists consultants, think tankers, chief diversity officers, liaisons, and others lobbying courageously striving to keep that from happening.

Filed Under: bill devine, california, lobbying, politics, registration
Companies: at&t

Verizon Throttled The 'Unlimited' Data Plan Of A Fire Dept. Battling Wildfires

from the herp-derp dept

We've long discussed how Verizon (like most U.S. cellular carriers) has a terribly-difficult time understanding what the word "unlimited" means. Way back in 2007 Verizon was forced to settle with the New York Attorney General after a nine-month investigation found the company was throttling its "unlimited" mobile data plans after just 5GB of data usage, without those limits being clearly explained to the end user. Of course Verizon tried for a while to eliminate unlimited data plans completely, but a little something called competition finally forced the company to bring the idea back from the dead a few years ago.

But the company's new "unlimited" data plans still suffer from all manner of fine print, limits, and caveats. That includes throttling all video by default (something you can avoid if you're willing to pay significantly more), restrictions on tethering and usage of your phone as a hotspot or modem, and a 25 GB cap that results in said "unlimited" plans suddenly being throttled back to last-generation speeds as slow as 128 kbps. In short, Verizon still pretty clearly has no damn idea what the word unlimited actually means, nor does it much care if this entire mess confuses you.

The latest case in point: one fire department in Santa Clara County, California had subscribed to what it thought was an unlimited Verizon wireless data plan for its mobile command and control center (OES 5262) vehicle. The vehicle is used to manage department resources during wildfires and other emergencies. But a brief (pdf) filed this week by net neutrality supporters pushing for restoration of net neutrality rules (first spotted by Ars Technica) highlights how the fire department suddenly found the vehicle (and all connected systems) largely unusable because Verizon had throttled its cellular data connection after 25 GB of usage:

"Santa Clara Fire paid Verizon for "unlimited" data but suffered from heavy throttling until the department paid Verizon more, according to Bowden's declaration and emails between the fire department and Verizon that were submitted as evidence.

"In the midst of our response to the Mendocino Complex Fire, County Fire discovered the data connection for OES 5262 was being throttled by Verizon, and data rates had been reduced to 1/200, or less, than the previous speeds," Bowden wrote. "These reduced speeds severely interfered with the OES 5262's ability to function effectively. My Information Technology staff communicated directly with Verizon via email about the throttling, requesting it be immediately lifted for public safety purposes."

This being the telecom industry, Verizon's support response to the problem wasn't what you'd call top shelf. Instead of quickly understanding the dire nature of the complaint and restoring the connection to full speeds, the fire department says Verizon informed them that the fire department needed to upgrade to a new data plan at more than twice the cost. At one point, a Verizon account rep advised that the fire department should pony up for Verizon's per gigabyte rate (which has varied at prices ranging up to a whopping $15 per gigabyte).

If you're playing along at home, this is nothing new. Cellular carriers often impose all manner of confusing limits and caveats as part of an intentional effort to upsell you to more expensive tiers of service you may not actually need. Historically, the FCC's now-discarded net neutrality rules allowed for this kind of throttling in cases of congestion and "reasonable network management" (though this term has long been abused). But the fire department says its connection was being throttled at all times, not just during periods of congestion.

And, lo and behold, the department technically couldn't formally complain to the FCC because Verizon had, as we're all well aware, just got done spending millions of dollars and countless lobbying hours to dismantle net neutrality protections, notes Ars:

"Santa Clara could have complained to the FCC under the now-removed net neutrality system, which allowed Internet users to file complaints about any unjust or unreasonable prices and practices. FCC Chairman Ajit Pai's decision to deregulate the broadband industry eliminated that complaint option and also limited consumers' rights to sue Internet providers over unjust or unreasonable behavior."

Lovely. Verizon subsequently admitted that the company shouldn't have throttled first responders anyway, as that was a violation of the company's own policies. But this being the telecom industry, customer service gaffes are a feature, not a bug.

Granted, this is the same company that has fought for more than a decade to crush net neutrality while not only actively denying that's what it was doing, but insisting that net neutrality needed to be dismantled to help protect public safety. As such, there's nothing about this story that's remotely surprising. Verizon has worked tirelessly to ensure it doesn't have to be particularly transparent, whether we're talking about net neutrality or privacy, and the end result has been on proud display for decades.

Filed Under: ajit pai, california, fcc, fire department, fire fighting, fires, net neutrality, santa clara fire department, throttled, unlimited, wildfires
Companies: verizon

New Bill Aims To Pierce The Darkness Surrounding California Police Officers' Disciplinary Records

from the long-awaited-correction-to-the-[permanent]-record dept

Cops in California have literally unbelievable protections. To ensure the "privacy" of government employees sworn to serve the public, the Cali legislature has kowtowed to state police unions to make disciplinary records all but impossible to obtain… by anyone.

This has led to the expected results. Professional liars in cop uniforms offer unimpeached testimony filled with more lies as defense lawyers stand helplessly by, screwed out of offering effective counsel by state law. The law is so restrictive prosecutors are often unable to obtain these files. In the unlikely event a cop is being prosecuted, past misdeeds are hidden under a heavy layer of legislated opacity, hindering effectiveness on the other side.

Sure, if you're the victim of police violence, your past is an open book. The cops will dump everything they have on you, from the shoplifting citation two decades ago to every charge ever brought (but ultimately dropped or dismissed) against you in your lifetime to smear your reputation and burnish their own. But if the court would be better served knowing the witness on the stand is an inveterate liar with a history of misconduct, justice will not only go blind but underserved under state law.

This bill aims to change that.

There is currently a bill before the California Legislature that would ease the burden for the prosecutors and the public to know whether the officers in their communities are trustworthy. SB1421 would require police departments to release information about, inter alia, sustained findings of dishonesty in the course of criminal cases and other instances of police misconduct. This bill would also require police departments to release information about serious uses of force, including officer-involved shootings, to increase transparency.

As the article notes, cops -- especially the good ones -- should welcome this move towards transparency.

[C]urrent California law protects the worst officers by hiding their identities from the public and makes them indistinguishable from the bulk of the officers who do their jobs faithfully in accordance with the Constitution.

But they won't. Or, at the very least, their support will be overridden by all the other cops: the mediocre, the bad, the repugnant, and the morally and criminally corrupt. These are officers and former officers currently holding prominent positions in the state's unions, and police unions are universally opposed to transparency, accountability, or minor policy changes that might make policing better.

This bill could change things but it faces the same opposition that managed to talk the legislature into turning police officers into an extremely protected class. It's a welcome effort, but has little chance of survival. Maybe the tide has turned. Maybe this time police unions will be told to stop standing in the way of rebuilding California communities' trust in the officers and agencies policing their neighborhoods.

Filed Under: california, disciplinary records, police, transparency

On Speech And Subpoenas, New York Giveth And Taketh (First, The Good News On Platform Jurisdiction)

from the I-love-New-York-decisions-like-this dept

There are a few recent cases to note out of New York that address speech and subpoenas on third parties. This first post is about a good one, and soon we'll have another... less good one. In Amelius v. Grand Imperial LLC a court in New York has recently reaffirmed that a New York-issued subpoena is only enforceable on an Internet platform if the New York courts have jurisdiction over the platform. Furthermore, relying on a 2014 US Supreme Court ruling, Daimler AG v. Bauman, the court in Amelius concluded that having merely registered to do business as an out-of-state company is not enough to give New York jurisdiction over platform companies with no other connection to the state than that, nor is their having information that might be relevant to a New York case. Instead the platform would either need to be incorporated or headquartered in New York for its courts to have jurisdiction over them.

Which does not mean that out-of-state platforms like Yelp (the platform at issue in this case) cannot be subpoenaed to supply information relevant to a New York case. What it does mean, however, is that the New York subpoena would need to be "domesticated" in the platform's home jurisdiction so that its own local courts would be able to enforce it. It is not necessarily hard to do this: for instance, in California, pretty much all that needs to happen is for a California court clerk, or even just a licensed California attorney, to add a California subpoena form to the out-of-state subpoena for it to become an enforceable California subpoena.

But what's good about this arrangement is that platforms can have some control over what laws will govern the subpoenas propounded against them and anticipate which courts will be able to compel them to act. In fact, they can choose to base themselves in states that offer the best laws and procedural rules most protective to them and their users' speech, because not all states do so equivalently. For instance, the test for whether a subpoena can be allowed to unmask an anonymous speaker in California is the Krisnky test (which requires the pleading to make a prima facie case against the speaker), but in other states the test is either the Dendrite test, the Cahill test, the "good faith" test (as was the case in the Virginia Hadeed Carpet case, which raised similar jurisdictional issues as this one), or no test at all (thus rendering all the subpoenas potentially enforceable, no matter what the effect on speech). These tests obviously vary greatly in the protection they afford to anonymous speakers.

California also includes mandatory fee-shifting to help deter abusive subpoenas and to compensate those who have had to fight them off. Like the anti-SLAPP statute does for unmeritorious litigation Section 1987.2 of the Code of Civil Procedure allows for mandatory recovery of fees for unmeritorious unmasking subpoenas that courts quash. Unfortunately, like robust anti-SLAPP laws, not all states have such a provision, which is another reason why it's important that platforms not be exposed to these other jurisdictions simply because they may have completed the purely ministerial task of registering with the Secretary of State or having some users there and not any more substantive connection. Platforms are in the business of facilitating speech, and they should be able to choose which laws to expose themselves to that will give them the best ability to do it.

Filed Under: california, free speech, jurisdiction, new york, platforms, subpoenas
Companies: amelius, grand imperial, yelp

Yes, Privacy Is Important, But California's New Privacy Bill Is An Unmitigated Disaster In The Making

from the not-how-to-do-it dept

We've talked a little about the rush job to pass a California privacy bill -- the California Consumer Privacy Act of 2018 (CCPA) -- and a little about how California's silly ballot initiatives effort forced this mad dash. But a few people have asked us about the law itself and whether or not it's any good. Indeed, some people have assumed that so many lobbyists freaking out about the bill is actually a good sign. But, that is not the case. The bill is a disaster, and it's unclear if the fixes that are expected over the next year and a half will be able to do much to improve it.

First, let's state the obvious: protecting our privacy is important. But that does not mean that any random "privacy regulation" will be good. In a future post, I'll discuss why "regulating privacy" is a difficult task to tackle without massive negative consequences. Hell, over in the EU, they spent years debating the GDPR, and it's still been a disaster that will have a huge negative impact for years to come. But in California they rushed through a massive bill in seven days. A big part of the problem is that people don't really know what "privacy" is. What exactly do we need to keep private? Some stuff may be obvious, but much of it actually depends quite heavily on context.

But the CCPA takes an insanely broad view of what "personal info" is covered. Section 1798.140(o)(1) defines "personal information" to mean... almost anything:

“Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
(B) Any categories of personal information described in subdivision (e) of Section 1798.80.
(C) Characteristics of protected classifications under California or federal law.
(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E) Biometric information.
(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
(G) Geolocation data.
(H) Audio, electronic, visual, thermal, olfactory, or similar information.
(I) Professional or employment-related information.
(J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).
(K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

So, first off, note that it's not just associated with any individual, but also a "household." And, again, in the list above, there are lots of items and situations where it totally makes sense that that information should be considered "private." But... there are other cases where that might not be so obvious. Let's take "information regarding a consumer's interaction with an internet web site." Okay. Yes, you can see that there are reasonable privacy concerns around a company tracking everything you do on a website. But... that's also generally useful information for any website to have just to improve the user experience -- and basically every website has tended do some form of user tracking. It's not privacy violating -- it's just understanding how people use your website. So if I'm tracking how many people flow from the front page to an article page... now suddenly that's information impacted by this law. Perhaps the law is intended to mean tracking people on other websites through beacons and such... but the law appears to make no distinction between tracking people on your own website (a feature that's built into basically every webserver) and tracking people elsewhere.

Similarly, "preferences" is private information? Sure, on some sites and for some reasons that makes sense. But, I mean, we do things like let users set in their preferences whether or not they want to see ads on our site at all (in case you don't know, you can turn off ads on this site in the preferences, no questions asked). But... in order to make sure we don't show you ads, we kinda have to keep track of those preferences. Now, I think many of you will recognize that in removing ads, we're actually helping you protect your privacy. But under this law, we're now incentivized not to keep such preferences because doing so is now its own legal liability.

And that leads into the "costs" vs. the "benefits" of such a law. Again, lets be clear: many internet companies have been ridiculously lax in how they treat user data. That's a real problem that we don't, in any way, mean to diminish. But, the costs of this law seem very, very, very likely to outweigh a fairly minimal set of benefits. On the benefits side: yes, a few companies who have abused your data will face some pretty hefty fines for continuing to do so. That's potentially good. But the costs are going to be massive. For this part, I'll borrow from Eric Goldman's analysis of the bill, which is well worth reading. It's long, but he outlines just some of the likely "costs":

How Much Will This Cost? (part 1) Regulated companies–i.e., virtually every business in California–will need to spend money on compliance, including building new processes to deal with the various consumer requests/demands. Adding up all of the expenditures across the California economy, how much will this cost our society? It’s not like these expenditures come from some magic pot of money; the costs will be indirectly passed to consumers. Are consumers getting a good deal for these required expenditures?

How Much Will This Cost? (part 2) Lengthy statutes seem like they are detailed enough to eliminate ambiguity, but it actually works in reverse. The longer the statutes, the more words for litigators to fight over. This law would give us 10,000 different bases for lawsuits. One of the current tussles between the initiative and the bill is whether there is a private right of action. Right now, the bill attempts to limit the private causes of action to certain data breaches. If the private right of action expands beyond that, SEND YOUR KIDS TO LAW SCHOOL.

How Much Will This Cost? (part 3) The bill would create a new “Consumer Privacy Fund,” funded by a 20% take on data breach enforcement awards, to offset enforcement costs and judiciary costs. Yay for the bill drafters recognizing the government administration costs of a major new law like this. Usually, bill drafters assume a new law’s enforcement costs can be buried in existing budgets, but here, the bill drafters are (likely correctly) gearing up for litigation fiestas. But exactly how much will these administration costs be, and will this new fund be sufficient or have we written a blank check from the government coffers to fund enforcement? Most likely, I expect the Consumer Privacy Fund will spur enforcement, i.e., enforcement actions will be brought to replenish the fund to ensure it has enough money to pay the enforcers’ salaries–a perpetual motion machine.

Let's dig into that first part, because it's important. It's important to remind people that this bill is not an "internet" privacy bill. It's an everyone privacy bill. Any business that does business in California more or less is impacted (there are some limitations, but for a variety of reasons -- including vague terms in drafting -- those limitations may be effectively non-existent). So now, in order to comply, any company, including (for example!) a small blog like ours, will have to go through a fairly onerous process to even attempt to be in compliance (though, as point two in Eric's list above shows, even then we'll likely have no idea if we really are).

An analysis by Lothar Determann breaks out some of what we'd need to do to comply, including setting up entirely new processes to handle data access requests, including a system to verify identity and authorization of individuals, and ways of tracking requests and blocking the chance that anyone who opts out of certain practices is offered a chance to opt-back in. So... to use the example above, if someone sets a preference on our site not to see ads, but then makes a data privacy request that we not track that data, we then would likely need to first verify the person and that they are the one making the request, and then we'd need to set up a system to (get this!) make sure we somehow track them well enough so that they... um... can't "opt-in" to request that we no longer show them ads again.

Think about that. In order to stop letting someone opt out of ads on our site "for privacy purposes" we'd have to set up a system to track them to make sure that they aren't even offered the possibility of opting out of ads again. It's mind boggling. Also, this:

Consider alternative business models and web/mobile presences, including California-only sites and offerings, as suggested in Cal. Civ. Code §1798.135(b) and charges for formerly free services to address the complex and seemingly self-contradictory restrictions set forth in Cal. Civ. Code §1798.125 on a company's ability to impose service charges on California residents who object to alternate forms of data monetization.

Okay, so I'm all for businesses exploring alternative business models. It's what we talk about here all the time. But... requiring that by law? And, even requiring that we offer a special "California-only" site that we charge for?

I'm having difficulty seeing how that helps anyone's privacy. Instead, it seems like it's going to cost a ton. And... for limited to negative benefit in many cases. Just trying to figure out what this would cost us would mean we'd probably have to let go of multiple writers and spend that money on lawyers instead.

And that leaves out the cost to innovation in general. Again, this is not to slight the fact that abusive data practices are a real problem. But, under this law, it looks like internet sites that want to do any customization for users at all -- especially data-driven customization -- are going to be in trouble. And sure, some customization is annoying or creepy. But an awful lot of it is actually pretty damn useful.

An even larger fear: this could completely cut off more interesting services and business models coming down the road that actually would serve to give end users more control over their own data.

Also, as with the GDPR, there are serious First Amendment questions related to CCPA. A number of people have pointed out that the Supreme Court's ruling in Sorrell v. IMS Health certainly suggests some pretty serious constitutional defects with the CCPA. In Sorrell, the Supreme Court struck down a Vermont law that banned reporting on certain prescription practices of doctors as violating the First Amendment. It's possible that CCPA faces very similar problems. In an analysis by professor Jeff Kosseff, he explains how CCPA may run afoul of the Sorrell ruling:

CCPA is more expansive than the Vermont law in Sorrell, covering personal information across industries. Among its many requirements, CCPA requires companies to notify consumers of the sale of their personal information to third parties, and to opt out of the sale. However, CCPA exempts “third parties” from coverage if they agree in a contract to process the personal information only for the purposes specified by the company and do not sell the information. Although CCPA restricts a wider range of third-party activities than the Vermont statute, it still leaves the door open for some third parties to be excluded from the disclosure restrictions, provided that their contracts with companies are broadly written and they do not sell the data. For instance, imagine a contract that allows a data recipient to conduct a wide range of “analytics.” Because the recipient is not selling the data, the company might be able to disclose personal information to that recipient without honoring an opt-out request.

Under Sorrell, such distinctions might lead a court to conclude that CCPA imposes a content-based restriction on speech. Moreover, the findings and declarations section of the bill cites the revelations about Cambridge Analytica’s use of Facebook user data, and states “[a]s a result, our desire for privacy controls and transparency in data practices is heightened.” This could cause a court to conclude that the legislature was targeting a particular type of business arrangement when it passed CCPA.

I highly recommend reading the rest of Kosseff's analysis as well. He notes that he's generally in favor of many internet regulations -- and has been advocating for cybersecurity regulations and didn't think amending CDA 230 would be that bad (I think he's wrong on that... but...). And his analysis is that CCPA is so bad it cannot become law:

[M]y initial reaction was that nothing this unclear, burdensome, and constitutionally problematic could ever become law.

He then goes on to detail 10 separate serious issues under the law -- and notes that those are just his top 10 concerns.

While it's nice to see lots of people suddenly interested in privacy issues these days, the mad dash to "deal" with privacy through poorly thought out legislation where the target and intent is unclear other than "OHMYGOD INTERNET COMPANIES ARE DOING BAD STUFF!!!" isn't going to do any good at all. There is little in here that suggests real protection of privacy -- but plenty of costs that could significantly change the internet many of you know and love, in large part by making it nearly impossible for small businesses to operate online. And, frankly, ceding the internet to the largest providers who can deal with this doesn't exactly seem like a way to encourage smaller operations who actually are concerned about your privacy.

Filed Under: california, ccpa, free speech, gdpr, privacy, regulations

What Soda Taxes And Lead Paint Have To Do With Internet Regulation

from the public-policy-on-sale-now! dept

They say that laws are like sausages, and you should never watch either be made if you don't want to be sick. But some manufacturing processes are more disgusting than others, and if we don't want to suffer ill-effects, we need to keep an eye on the worst of them.

As others have discussed, the new California Consumer Privacy Act (CCPA) is at best a law with troubling aspects, if not completely chilling for future Internet businesses and even non-commercial online expression. True, there may be the opportunity to amend it before it goes into effect to dull the worst of it, but how we find ourselves in this position where we are stuck with a ticking time bomb of a law that we now need to fix is a story worth telling, because if it could happen once it could happen again. And already has.

Which is why I'm going to tell the story about how California just banned soda taxes (in fact, not coincidentally, right around the same time that it passed the CCPA).

To understand what happened, one first needs to understand a bit about the California Constitution. In addition to setting up the typical branches of government (legislative, executive, judicial), it also allows for a form of direct democracy through ballot initiatives. Ballot initiatives generally only need a simple majority to pass, but once passed, they can be very difficult, if not impossible, to un-pass or modify them without another ballot measure. Even when ballot measures only amend statutory code, and not the Constitution itself, the legislature can be prevented from making any modifications to that new language, no matter how necessary those changes may be, unless the ballot initiative allows the legislature to act. And even if the initiative does permit it, it may require a much more difficult to attain super-majority of the legislature to make any changes, rather than the simple majority typically required to pass legislation.

The upshot is that an awful lot of California law and policy can depend on the initiative process -- and thus a whole lot can depend on who is able to use it to push forth the policy they prefer. In one sense, it's hard to get a new initiative on the ballot: it requires hundreds of thousands of signatures to qualify. But it turns out that for people who have a lot of money, it's not all that hard. Some estimate that it may take only $3-4 million to acquire enough signatures to get any initiative on the ballot.

Of course, whether such an initiative would pass is a separate question, but there are a few factors that make the odds pretty good. One is that it's very difficult for the electorate to make informed choices, and I don't say that as any sort of insult to the average California voter. In the most recent election this past June I timed how long it took to figure out who and what to vote for and clocked it at a whole hour. And that's with me, a lawyer practiced in reading and evaluating law and policy, living in an unincorporated area of California, meaning that I was spared having to wade through any city candidate or ballot measure choices. I just had to vote on candidates for all county, state, and federal offices, and on all county and state ballot measures. And this was in June, where there were fewer choices all around than there will be in November, yet it still took an hour to make any sort of responsible decisions before I was prepared to head to the polls. Of course, not everyone has that hour, and for many it will likely take longer, which means that the electorate tends to be dependent on campaign advertising to help them make those choices. But if someone has a few million dollars to spend to get an initiative on the ballot, they may easily have a few more, or a lot more, to spend on that advertising, and their opponents, no matter how principled in their opposition, just as easily may not.

The reality is that anyone who can spend a few million dollars to get an initiative on the ballot can use that money to put an electoral gun to the head of policymakers and force them to legislate for their desired policy in exchange for withdrawing the initiative from the upcoming election. Because at least if the policy gets implemented via the legislature's hand, rather than through the initiative process, the legislature might be able to temper some of its language. Also, by being an ordinary bill, it would theoretically be more changeable in the future, subject only to ordinary legislative majorities and not dependent on someone funding a new initiative that could successfully override it.

As this article in the Sacramento Bee describes, the soda tax ban is a case study of this dynamic. A business group wrote a proposal that would have created some significant limitations in the state's ability to raise revenue. It then shopped around the proposed initiative until it found someone willing to underwrite the signature-gathering necessary to get it on the ballot. That someone turned out to be the beverage industry, which generally hates soda taxes.

The relative merits of soda taxes are beyond the scope of this post. Suffice it to say, certain California communities like them, often as a way of raising revenue for public health programs and deterring the over-consumption of unhealthy drinks. Several of these communities have already passed a few such taxes.

But after the beverage industry underwrote the effort to get enough signatures to qualify the tax-limiting initiative for the ballot, an initiative that did more than just ban soda taxes but instead affected the state's taxation ability more broadly, the legislature found itself having to play electoral roulette: perhaps the ballot measure might fail and everything would be fine, but if it passed, it risked messing up the fiscal health of the state and all the policies and programs the legislature wanted to fund. So it capitulated and did a deal with the initiative's sponsor to bar any other California communities from passing their own soda taxes for the next 12 years in exchange for having the ballot initiative withdrawn.

In fact, June was a busy month for legislative capitulation, because right around the same time that the legislature did that deal it also did a deal with the sponsors of the "Consumer Right to Privacy Act of 2018" initiative that had also qualified for the November ballot.* Because that initiative, if it passed, would definitely cripple the Internet, the legislature instead agreed to pass the CCPA, which will only probably cripple it, but at least has the potential for improvement.

And that's what this post is really about, this extortionate ability for basically anyone with $4 million to spend to blackmail the legislature to set aside its own legislative judgment and build into California law whatever terrible policy the person with the money wants. Sure, for any policy that is so awful or unpopular there's always the chance that it might lose at the polls come Election Day, and from time to time ballot initiatives do get shot down. But it's very easy for garbage to get through, and wealthy minority voices count on that possibility when they try to ram through all sorts of policies that aren't necessarily good ones for Californians or its businesses – including on matters of tech policy.

On our best days these tech policy challenges require careful, nuanced treatment. We should look to the legislature, and legislators, to give it that careful, nuanced treatment before imposing drastic changes in the law that will affect them. But they can't give these regulatory proposals that sort of necessary attention they deserve if for a mere $4 million or so people can force them to rush through law that has been drafted without any of the care or necessary transparency sound regulation requires.

And when they are forced to pass a law like that, as they were just now with the CCPA, it is unlikely to be something we should cheer.

* Also, per the Los Angeles Times article linked above, "A third proposal, asking taxpayers to subsidize lead paint cleanup projects, was withdrawn by paint companies in exchange for lawmakers scrapping a slate of bills designed to impose new rules on the industry."

Filed Under: ballot measures, california, democracy, intermediary liability, lead paint, moral panic, privacy, regulations, soda tax