Coronavirus Surveillance Is Far Too Important, And Far Too Dangerous, To Be Left Up To The Private Sector

from the who-do-you-trust dept

Months into the global pandemic, governments, think tanks, and companies have begun releasing comprehensive plans to reopen the economy, while the world will have to wait a year or longer for the universal deployment of an effective vaccine.

A big part of many of these plans are digital tools, apps, and public-health surveillance projects that could be used to contain the spread of COVID-19. But even if they’re effective, these tools must be subject to rigorous oversight and laws preventing their abuse. Corporate America is already contemplating mandatory worker testing and tracking. Digital COVID passports that could grant those with immunity or an all-clear from a COVID test the right to enter stores, malls, hotels, and other spaces may well be on the way.

We must be ready to watch the watchers and guard against civil rights violations.

Many governments and pundits are turning to tech companies that are promising digital contact tracing applications and services to augment the capacity of manual contact tracers, as they work to identify transmission chains and isolate people exposed to the virus. Yet civil society groups are already highlighting the serious privacy implications of such tools, underscoring the need for robust privacy protections.

The potential for law enforcement and corporate actors alike to abuse these tracking systems is just too great to ignore. For their part, most democratic governments have largely recognized that the principle of voluntary adoption of this technology — rather than attempts at state coercion — is more likely to encourage use of these apps.

But these applications are not useful unless significant percentages of cellphone users use them. An Oxford University study suggests that for a similar app to successfully suppress the epidemic in the United Kingdom, 80 percent of British cellphone users would have to use it, which equates to 56 percent of the overall UK population. If the numbers for a digital contact tracing program to succeed stateside were similar, that would mean activating more than 100 million users.

The level of adoption will dictate just how well these technologies prevent the spread of the virus, but no matter how widespread such voluntary adoption may be, there is still potential for coercion, abuse, and targeting of specific users and communities without their consent. Some companies and universities are already planning to develop their own contact tracing systems and require their employees or students to participate. The consulting firm PricewaterhouseCoopers is advising companies on how to create these systems, and other smaller tech firms are designing Bluetooth beacons to facilitate the tracking of workers without smartphones.

An unaccountable regime of COVID surveillance could represent a great near-term threat to civil rights and privacy. Already marginalized communities suffering most from this crisis are the most exposed to the capricious whims of corporate leaders eager to restart supply chains and keep the manufacturing and service sector operating.

Essential workers are subject to serious health risks while doing their jobs during a pandemic, and employers mandating use of these technologies without public oversight creates another risk to worker rights. This paints a particularly tragic picture for the Black community which has been disproportionately affected by the pandemic in terms of sickness, death, and unemployment.

Black and Latinx people are more likely to work as cashiers in grocery stores, in nursing homes, or in other service-industry jobs that make infection far more likely. Many such workers are already subject to pervasive and punitive workplace surveillance regimes. But now, there may be real public-health equities at play. When these workers go to work, they have to do so in close proximity to others. Employers must protect them and digital tracking tools may well be part of saving lives. But that balance ought to be struck by public-health officials and worker-safety authorities in consultation with affected employees.

This system of private-health surveillance may not just affect workers. Grocery store, retail, and restaurant owners, eager to deploy this kind of technology to regain the confidence of shoppers, may well see the logic in incentivizing widespread public deployment as well.

Those same stores could offer a financial incentive to customers who can prove they have a contact-tracing app installed on their phone, or they could integrate it into already existing customer loyalty apps. Coordinated efforts from businesses to mitigate losses due to sick workers or the threat of repeated government shutdowns could make incentivizing or demanding COVID-passports worth the investment to them. We may well find ourselves in a situation where a digitally checkpointed mall, Whole Foods, or Walmart feels like an oasis — the safest place in the world outside our homes.

Unaccountable deployment of these systems threatens to create further divides between workers and consumers, the tracked and untracked, or perilous division between those who can afford repeated testing and those who can’t.

So far, few officials have weighed these tradeoffs. As of yet, the only federal legal guidance on these questions has come from the Equal Employment Opportunity Commission, which has ruled that employers can legally institute mandatory temperature checks and other medical exams as conditions of continued employment.

Lawmakers have to do more. They must provide protections for the unauthorized use of this information and not allow access to places of public accommodation - a core civil right - to be determined by a mere app. We must seriously consider what it would mean for a free society, should businesses find it makes financial sense to invest in their own health-surveillance systems or deny people access to corner markets or grocery stores if they aren’t carrying the right pass on their person.

We do not have to be resigned to the deployment of a permanent state surveillance apparatus or the capriciousness of the private sector. If our post-9/11 experience is a guide, then we know that unaccountable surveillance infrastructure implemented during a crisis is wildly difficult to dismantle.

We must not construct a recovery that casts a needless decades-long shadow over our society, entrenches the power of large corporations, and further exacerbates class and racial divides. Governments must proactively decide the permissible uses and limits of this technology and the data it collects, and they must demand that these surveillance systems, private or otherwise, be dismantled at the end of the crisis.

Gaurav Laroia is the Senior Policy Counsel at consumer Group Free Press, working alongside the policy team on topics ranging from internet-freedom issues like Net Neutrality and media ownership to consumer privacy and government surveillance.

Filed Under: contact tracing, covid-19, privacy, private sector, public sector, surveillance

Many Think Internet Privacy Is Lost, But That's Because You Can't Sue Anyone Who Violates It

from the trust,-privacy,-and-liability dept

Over 90% of Americans feel like they have no control over their online privacy. It is not hard to understand why so many of us feel so powerless when it comes to using the Internet, nor is the solution to such a pervasive feeling all that complicated.

It just boils down to rules and liability—or, in other words, making sure if a company violates your privacy per the law that there is an inescapable penalty. The clearer and more direct the path to holding a company accountable for violating your privacy—much like your physical health, property rights, emotional wellbeing, or other things held in legally enforceable trusts—the more confidence will return to the Internet marketplace.

But we don't have these clear enforceable rights in today's American consumer privacy legal system for a vast majority of Internet privacy related activity. In fact, when the next Google or Facebook scandal rolls around in terms of user privacy, think back to the last one—likely just a few months old—and ask how much in damages the company paid and whether the company had to compensate individual people for the violation.

In many cases, that answer is going to be no penalty, which then feeds into users' sense of powerlessness. But the fact that companies often have to pay no penalty, and the fact that we do not have laws in place to remedy these privacy harms, is a choice we have made. It is not the natural order of things, and it is not inevitable.

We have, as a society, made decisions under our intellectual property laws where absolutely no liability is allowed to promote another profitless value, namely our freedom of expression. For example, the practice of criticizing a film on YouTube while playing portions of it in the background is considered a fair use. This means, despite copyright holders having the exclusive rights over the public performance of their work, we have decided to extinguish liability when it involves the expression of criticism.

In the absence of fair use, the critic using the film, as well as YouTube, would be directly liable for a lot of money for playing portions of it. However, we counterbalance and limit the economic right of the filmmaker in order to promote free speech values through fair use. In essence, we keep a liability-free zone for criticism and that is generally seen as a net positive for users. It also promotes the creation of open platforms, allowing those speakers to discover audiences and build engagement.

But in consumer privacy we have not seen nearly the same benefit yielded back to consumers in exchange for the mostly liability-free zone. There is no race to the top in guarding consumer’s personal information, because the profit maximizing effort isn’t about augmenting our privacy, it is about tearing it down as much as possible for profit. This is why we keep getting these privacy scandals. There is no need to apply morality to the analysis as often happens when people observe corporate behavior, but rather the simple question of how profit maximization (which corporations have to pursue under the law) is being countered by law to reflect our expectations.

When we look at the problem of consumer privacy from this angle, it becomes fairly clear that private rights of action for consumer personal privacy would be transformative. No longer would a corporation view experiments with handling personal information as a generally risk free profit making proposition if financial damages and a loss of profit were involved.

Industry wants a Consumer Privacy Law—Just so Long As You Can’t Sue Them

The long road of industry opposition—and the extreme hypocrisy of now pretending to endorse passage of a comprehensive consumer privacy law—is worth reflecting on in order to understand why in fact we have no law today.

If we go back a little over a decade to a privacy scandal that launched a series of congressional hearings, we find a little company called NebuAd that specialized in deep packet inspection.

NebuAd’s premise was scary in that it proposed to allow your ISP to record everything you do online and then monetize it with advertisers. I was a staffer on Capitol Hill when NebuAd came to Congress to explain their product, and still remember the general shock at the idea being proposed. In fact, the idea was so offensive it garnered bi-partisan opposition from House leaders and ultimately led to the demise of NebuAd.

The legislative hearings that followed the growing understanding of “deep packet inspection” led to discussions of a comprehensive privacy bill in 2009. But despite widespread concern with developing industry practices as the technology was evolving, we never got anywhere out of concern for the freemium model of Internet products. It is hard to remember this time, but back then the Internet industry was still a fairly new thing to the public and Congress.

The iPhone had just launched two years earlier, and the public was still in the process of transitioning from flip phones to smartphones. Only three years prior had Facebook become available to the general public. Google had only a small handful of vertical products, the newest being Google Voice—which allowed people to text for free at a time when each text you sent cost a fee.

All of these things were seen as net positive to users, yet all hinged on the monetization of personal information being relatively liability free. So for years policymakers, including an all out effort by the White House in 2012, searched for a means to balance privacy with innovation. Companies generally known as “big tech” today were still very sympathetic entities in that the innovations they continued to produce were seen as both novel and useful to people. Therefore, their involvement was actively solicited by the White House in trying to jointly draft a means to promote privacy while allowing the industry to flourish.

Ultimately, it was a wasted effort because what industry actually wanted was the liability free zone to be baked into law with little regard to increasing degradation of user privacy. It used to be that most of the Internet companies still had competitors with each other forcing them to try to be more attractive to users with greater privacy settings. Even Google Search was facing a direct assault by Microsoft with their fairly new Bing product.

As efforts to figure out a privacy regime for Internet applications and services were being stalled by the Internet companies, progress was being made with the substantially more mature and the already regulated Internet Service Provider (ISP) industry.

Congress had already passed a set of privacy laws for communications companies under Section 222 of the Communications Act, so a great many ISPs, being former telephone companies, had a comprehensive set of privacy laws applicable to them (including private rights of action). But their transition into broadband companies began to muddy the waters, particularly as the Federal Communications Commission started to say in 2005 that broadband was magically different and therefore should be quasi-regulated.

Having learned nothing from the fiasco of NebuAd and potentially having “deep packet inspection” banned for ISPs, other privacy invasive ideas kept getting rolled out by the broadband industry. Things such as “search hijacking”—where your search queries were monitored and rerouted—became a thing. AT&T began forcibly injecting ads into WiFi hotpots at airports, wireless ISPs preinstalled “Carrier IQ” on phones to track everything you did (which ended when people sued them directly under a class action lawsuit), and Verizon invented the “super-cookie,” prompting a privacy enforcement response from the FCC in 2014.

Even after the FCC stopped treating broadband as uniquely different from other communications access technology in 2015, the industry continued to push the line. In that same year telecom carriers partnered with SAP Consumer Insight 365[9] to “ingest” data from 20 to 25 million mobile subscribers close to 300 times every day (we do not know which mobile telephone companies participate in this practice, as that information is kept a secret). That data is used to inform retailers about customer browsing, geolocation, and demographic data.

So unsurprisingly, the FCC came out with strong, clear ISP privacy rules in 2016 that continued the long tradition of privacy protections for our communication networks.

However, the heavily captured Congress, which had never taken a major pro-privacy vote on Internet policy in close to a decade, quickly took action to repeal the widely supported FCC privacy rules on behalf of AT&T and Comcast. Ironically, the creation of ISP privacy rules by the FCC only happened because Congress created a series of privacy laws, including private rights of action, for various aspects of our communication industry more than a decade prior.

While many of the leaders of the ISP privacy repeal effort claim to be foes of big tech, they have done literally next to nothing to move a consumer privacy law. In fact, all they did was solidify the capture of Congress by giving AT&T and Comcast a reason to team up with Google and Facebook in opposing real privacy reform.

EFF witnessed this joint industry opposition first hand as we attempted to rectify the damage Congress did to broadband privacy with a state law in California. In fact, between ISPs and big tech we had absolutely no new privacy laws passed in the states in 2017 in response to Congress repealing ISP privacy rules.

Despite the arrogant belief they could sustain perpetual capture at the legislative level, along came an individual named Alastair McTaggert who personally financed a ballot initiative on personal privacy that later became the California Consumer Privacy Act (CCPA).

While they could “convince” a legislator of the righteousness of their cause with political contributions, they had no real means to convince the individual that the status quo was good. After Cambridge Analytica and wireless carriers selling geolocation to a black market for bounty hunters, virtually no one thinks this industry should be unregulated on privacy.

So rather than continue to publicly oppose real privacy protections, the industry has opted to pretend it supports a law just so long as it gets rid of state laws (including state private rights of action), putting all our eggs into the basket of a captured regulator. In other words, they only will support a federal privacy law if it further erodes our personal privacy rather than enhance it.

This opening offer from industry is a wild departure from other privacy statutes that have all included an individual right to sue such as wiretaps, stored electronic communications, video rentals, driver’s licenses, credit reporting, and cable subscriptions. Not to miss their marching orders, industry-friendly legislators were quick to put together a legislative hearing on consumer privacy that literally had no one representing consumers.

But this game by industry, where so long as they can hold and finance enough legislators to prevent any real law from passing, will only last so long. Afterall, their effort to ban states from passing privacy laws is effectively dead once the Speaker of the House from California made it clear she would not undermine her own state’s law on behalf of industry.

Furthermore, Senator Cantwell, a leader on the Senate Commerce Committee, has introduced comprehensive legislation that includes a private right of action and more than a dozen Senators led by Senator Schatz have endorsed the concept supported by EFF of creating an information fiduciary. As more and more legislators make publicly clear the parameters of what they consider a good law, it becomes harder for industry to sustain the behind the scenes opposition. But we are still far away from the end, which means more has to be done in the states until enough of Congress can break free of the industry shell game.

If We Do Not Restore Trust in Internet Products, People Will Make Less Use of the Internet and That Comes with Serious Consequences

As we wrestle with containing COVID-19, a solution being proposed by Apple and Google in the form of contact tracing is facing a serious hurdle. A majority of Americans do not want to use health data applications and services from these companies because they do not trust what they will do with their information. Since they can’t directly punish these companies for abusing their personal health data, they are exercising the only real choice they have left: not to use them at all.

Numerous federal studies from federal agencies such as the Department of Commerce, the Federal Trade Commission, and the FCC all point to the same end result if we do not have real privacy protections in place for Internet activity. People will simply refrain from using applications and services that involve sensitive uses such as healthcare or finances. In fact, lack of trust in how our personal information is handled has a detrimental impact on broadband adoption in general. Meaning a growing number of people will just not use the Internet at all in order to keep their personal information to themselves.

Given the systemic powerlessness users feel about their personal information when they use the Internet, the dampening effect it has on fully utilizing the Internet, and the loss of broadband adoption, it is fairly conclusive that the near liability free zone is an overall net negative as a public policy. Congress should be working to actively give users back their control, instead of letting the companies with the worst privacy track records dictate users’ legal rights. Any new federal data privacy law must not preempt stronger state data privacy rules and contain a private right of action.

While special tailoring has to be done for startups and new entrants with limited finances to ensure they can enter the market under the same conditions Google and Facebook launched, this is not true for big tech.

Establishing clear lines of liability and rules for major corporate entities, efforts to launch the next privacy invasive tech will be scrutinized by corporate counsel eager to shield the company from legal trouble. That ultimately is the point of having a private right of action in law. It is not to flood companies with lawsuits, but rather for them to operate in a manner that avoids lawsuits.

As users begin to understand that they have an inalienable legal right to privacy when they use the Internet, they will begin to trust the products with greater and more sensitive uses that will benefit them. This will open new lines of commerce as a growing number of users willingly engage in deeply personal interactions with next generation applications and services. For all the complaints industry has about consumer privacy laws, the one thing they never take into account is the importance of trust. Without it we start to lose the full potential of what the 21st century Internet can bring.

Ernesto Falcon is Senior Legislative Counsel at the Electronic Frontier Foundation with a primary focus on intellectual property, open Internet issues, broadband access, and competition policy.

Filed Under: greenhouse, internet, liability, privacy, trust

Giving People Property Rights In Data Will Not Solve Privacy, But...

from the property-rights-and-privacy dept

Online privacy can’t be solved by giving people new property rights in personal data. That idea is based on a raft of conceptual errors. But consumers are already exercising property rights, using them to negotiate the trade-offs involved in using online commercial products.

People mean a lot of different things when they say “privacy.” Let’s stipulate that the subject here is control of personal information. There are equal or more salient interests and concerns sometimes lumped in with privacy. These include the fairness and accuracy of big institutions’ algorithmic decision-making, concerns with commodification or commercialization of online life, and personal and financial security.

Consumers’ use of online services will always have privacy costs and risks. That tension is a competitive dimension of consumer Internet services that should never be “solved.” Why should it be? Some consumers are entirely rational to recognize the commercial and social benefits they get from sharing information. Many others don’t want their information out there. The costs and risks are too great in their personal calculi. Services will change over time, of course, and consumers’ interests will, too. Long live the privacy tension.

Online privacy is not an all-or-nothing proposition. People adjust their use of social media and online services based on perceived risks. They select among options, use services pseudonymously, and curtail and shade what they share. So, to the extent online media and services appear unsafe or irresponsible, they lose business and thus revenue. There is no market failure, in the sense used in economics.

Of course, there are failures of the common sort all around. People say they care about privacy, but don’t do much to protect it. Network effects and other economies of scale make for fewer options in online services and social media, so there are fewer privacy options, much less bespoke privacy policies. And companies sometimes fail to understand or abide by their privacy policies.

Those privacy policies are contracts. They divide up property rights in personal information very subtly—so subtly, indeed, that it might be worth reviewing what property is: a bundle of rights to possess, use, subdivide, trade or sell, abandon, destroy, profit, and exclude others from the things in the world.

The typical privacy policy vests the right to possess data with the service provider—a bailment, in legal terminology. The service provider gets certain rights to use the data, the right to generate and use non-personal information from the data, and so on. But the consumer maintains most rights to exclude others from data about them, which is all-important privacy protection. That’s subject to certain exceptions, such as responding to emergencies, protecting the network or service, and complying with valid legal processes.

When companies violate their privacy promises, they’re at risk from public enforcement actions—from Attorneys General and the Federal Trade Commission in the United States, for example—and lawsuits, including class actions. Payouts to consumers aren’t typically great because individualized damages aren’t great. But there are economies of scale here, too. Paying a little bit to a lot of people is expensive.

A solution? Hardly. It’s more like an ongoing conversation, administered collectively and episodically through consumption trends, news reporting, public awareness, consumer advocacy, lawsuits, legislative pressure, and more. It’s not a satisfactory conversation, but it probably beats politics and elections for discovering what consumers really want in the multi-dimensional tug-of-war among privacy, convenience, low prices, social interaction, security, and more.

There is appeal in declaring privacy a human right and determining to give people more of it, but privacy itself fits poorly into a fundamental-rights framework. People protect privacy in the shelter of other rights—common law and constitutional rights in the United States. They routinely dispense with privacy in favor of other interests. Privacy is better thought of as an economic good. Some people want a lot of it. Some people want less. There are endless varieties and flavors.

In contrast to what’s already happening, most of the discussion about property rights in personal data assumes that such rights must come from legislative action—a property-rights system designed by legal and sociological experts. But experts, advocates, and energetic lawmakers lack the capacity to discern how things are supposed to come out, especially given ongoing changes in both technology and consumers’ information wants and needs.

An interesting objection to creating new property rights in personal data is that people might continue to trade personal data, as they do now, for other goods such as low- or no-cost services. That complaint—that consumers might get what they want—reveals that most proposals to bestow new property rights from above are really information regulations in disguise. Were any such proposal implemented, it would contend strongly in the metaphysical contest to be the most intrusive yet impotent regulatory regime yet devised. Just look at the planned property-rights system in intellectual property legislation. Highly arguable net benefits come with a congeries of dangers to many values the Internet holds dear.

The better property rights system is the one we’ve got. Through it, real consumers are roughly and unsatisfactorily pursuing privacy as they will. They often—but not always—cede privacy in favor of other things they want more, learning the ideal mix of privacy and other goods through trial and error. In the end, the “privacy problem” will no more be solved than the “price problem,” the “quality problem,” or the “features problem.” Consumers will always want more and better stuff at a lower cost, whether costs are denominated in dollars, effort, time, or privacy.

Jim Harper is a visiting fellow at the American Enterprise Institute and a senior research fellow at the University of Arizona James E. Rogers College of Law.

Filed Under: contracts, data, privacy, property rights

Can You Protect Privacy If There's No Real Enforcement Mechanism?

from the enforcement-matters dept

Privacy laws can have a lot of moving pieces from notices and disclosures, opt-in and opt-out consent requirements to privacy defaults and user controls. Over the past few years, there has been significant progress on these issues because privacy advocates, consumer groups, industry voices, and even lawmakers have been willing to dive into definitional weeds, put options on the table, and find middle ground. But this sort of thoughtful debate has not happened when it comes to how privacy laws should be enforced and what should happen when companies screw up, families are hurt, and individuals’ privacy is invaded.

Instead, when it comes to discussing private rights of action and agency enforcement, rigid red lines have been drawn. Consumer groups and privacy advocates say let individuals sue in court -- and call it a day. Business interests, when they talk about “strong enforcement,” often mean letting an underfunded Federal Trade Commission and equally-taxed state Attorneys General handle everything. Unfortunately, this binary, absolutist dispute over policing privacy rights threatens to sink any progress on privacy legislation.

It happened in Washington state, which failed to enact a comprehensive privacy framework in March because of a single sentence that could have let some consumers sue to enforce their rights under the state’s general Consumer Protection Act. Private rights of action have stymied state privacy task forces, and the issue is consuming efforts by the Uniform Law Commission to craft a model privacy bill. This is but a microcosm of what we’ve seen at the federal level, where lawmakers are at “loggerheads” over private rights of action.

This impasse is ridiculous. Advocacy groups share some blame here, but industry voices have failed to put any creativity into putting an alternative path forward. Company after company and trade association after trade association have come out in favor of privacy rules, but the response to any concern about how to ensure those rules are followed has been crickets. Few seem to have given much thought into what enforcement could look like beyond driving a Brinks truck full of money up to the FTC. That is not good enough. If industry is serious about working toward clear privacy rules, business interests have two obligations: (1) they should offer up some new ideas to boost enforcement and address legitimate concerns about regulatory limitations and capture; and (2) they need to explain why private rights of action should be a non-starter in areas where businesses already are misbehaving.

First, while we can acknowledge the good work that the FTC (and state Attorney Generals) has done, we should also concede that agencies cannot address every privacy problem and have competing consumer protection priorities. Commentators laud the FTC’s privacy work but have not suggested how an FTC with more resources will not just do more of what it’s already doing. There are outstanding considerations animating efforts to create an entirely new federal privacy agency (and that’s on top of a proposal in California to set up its own entirely new “Privacy Protection Agency”). Improving the FTC’s privacy posture will require more than more money and personnel.

Part of this will be creating mechanisms that ensure individuals can get redress. One idea would be to require the FTC to help facilitate complaint resolutions. The Consumer Financial Protection Bureau already does this to some extent with respect to financial products and services. The CFPB welcomes consumer complaints -- and then works with financial companies to get consumers a direct response about problems. These complaints also help the CFPB identify problems and prioritize work, and then CFPB publishes (privacy friendly) complaint data. This stands in contrast to the FTC’s Consumer Sentinel Network, which is a black box to the public.

Indeed, the FTC’s complaint system is opaque even to complainants themselves. The black box nature of the FTC is, fairly or not, a constant criticism by privacy advocates. A group of advocates began the Trump administration by calling for more transparency from the Commission about how it handles complaints and responds to public input. I can speak to this issue, submitting my own complaint to the FTC about the privacy and security practices of VPNs in 2017. Months later, the FTC put out a brief blog post on the issue, which I took to be the end of the matter on their end. Some sort of dualtrack informal and formal complaint process like the Federal Communications Commission could be one way to ensure the FTC better communicates with outsiders raising privacy concerns.

These are mostly tweaks to FTC process, however, and while they address some specific complaints about privacy enforcement, they don’t address concerns that regulators have been missing -- or avoiding -- some of the biggest privacy problems we face. This is where the rigid opposition to private rights of action and failure to acknowledge the larger concern is so frustrating.

Sensitive data types present a good example. Unrestrained collection and use of biometrics and geolocation data have become two of the biggest privacy fights of the moment. There has been a shocking lack of transparency or corporate accountability around how companies collect and use this information. Their use could be the key to combating the ongoing pandemic; their misuse a tool for discrimination, embarassment, and surveillance. If ever there were data practices where more oversight is needed, these would be it.

Yet, the rapid creep of facial recognition gives us a real-world test case for how agency enforcement can be lacking. While companies have been calling for discussions about responsible deployment of facial recognition even as they pitch this technology to every school, hospital, and retailer in the world, Clearview AI just up and ignored existing FTC guidance and state law. Washington state has an existing biometric privacy law, which the state Attorney General admitted has never been the basis of an enforcement action. To my knowledge, the Texas Attorney General also has never brought a case under that state’s law. Meanwhile, the Illinois Biometric Privacy Act (BIPA) may be the one legal tool that can be used to go after companies like Clearview.

BIPA’s private right of action has been a recurring thorn in the sides of major social media companies and theme parks rolling out biometrics technologies, but no one has really cogently argued that companies aren’t flagrantly violating the law. Let’s not forget that facial recognition settings were an underappreciated part of the FTC’s most recent settlement with Facebook, too. However, no one can actually discuss how to tweak or modernize BIPA because industry groups have had a single-minded focus on stripping the law of all its private enforcement components.

Industry has acted in lockstep to insist it is unfair for companies to be subject to limitless liability by the omnipresent plaintiffs bar for every minor or technical violation of the law. And that’s the rub!

There is no rule that says a private right of action must encompass the entirety of a privacy law. One of the compromises that led to the California Consumer Privacy Act was the inclusion of a private right of action for certain unreasonable data breaches. Lawmakers can take heed and go provision-by-provision and specify exactly what sorts of activities could be subject to private litigation, what the costs of the litigation might be, and what remedies can ultimately be obtained.

The U.S. Chamber of Commerce has been at the forefront of insisting that private rights of action are poor tools for addressing privacy issues, because they can “undermine appropriate agency enforcement” and hamper the ability of “expert regulators to shape and balance policy and protections.” But what’s the objection then in areas where that’s not true?

The sharing and selling of geolocation information has become especially pernicious, letting companies infer sensitive health conditions and facilitating stalking. Can any industry voice argue that companies have been well-behaved when it comes to how they use location information? The FTC clearly stated in 2012 that precise geolocation data was sensitive information warranting extra protections. Flash forward to 2018 and 2019, where The New York Times is engaged in annual exposés on the wild west of apps and services buying and selling “anonymous” location data. Meanwhile, the Communications Act requires carriers to protect geolocation data, and yet the FCC fined all four major wireless carriers a combined $200 million for sharing their subscribers’ geolocation data with bounty hunters and stalkers in February of this year.

Businesses do not need regulatory clarity when it comes to location data -- companies need to put in a penalty box for an extended timeout. Giving individuals the ability for private injunctive relief seems hardly objectionable given this track record. Permitting class actions for intentional violations of individuals’ geolocation privacy should be on the table, as well.

There should be more to discuss than a universe where trial attorneys sue every company for every privacy violation or a world where lawmakers hand the FTC a blank check. Unfortunately, no one has yet put forward a vision for what the optimum level of privacy enforcement should be. Privacy researchers, advocates, and vulnerable communities have forcefully said the status quo is not sufficient. If industry claims it understands the importance of protecting privacy but just needs more clarity about what the rules are, companies should begin by putting forward some plans for how they will help individuals, families, and communities when they fall short.

Joseph Jerome, CIPP/US, is a privacy and cybersecurity attorney based in Washington, D.C. He currently is the Director of Multistate Policy for Common Sense Media.

Filed Under: enforcement, ftc, privacy, privacy laws, private rights of action

Fighting The Free Speech Digital Divide Requires Interoperability and Privacy Protection

from the privacy-and-interoperability-go-hand-in-hand dept

When people mention the digital divide, often they’re referring to the divide between people who have access to the internet and those who do not. However, we can also visualize it as the divide between those who benefit from free expression on social media and other digital platforms—and those who don’t.

In order to get ahead of this burgeoning digital divide, policymakers will need to preserve the values of privacy and consumer choice in a way that one does not undermine the other.

This past February, the New York Times profiled Jalaiah Harmon, the creator of the viral TikTok dance, “The Renegade.” But Harmon didn’t create the dance on TikTok; she used a smaller app, Funimate, and crossed-posted her video to Instagram. Instagram is where other popular TikTok creators first learned of the dance. TikTok, like many platforms, doesn’t encourage posters to give credit to creators.

Instead of Jalaiah benefiting from the virality of her own dance, other TikTok users did. Those benefits include brand deals, media opportunities, and the chance to connect with the professional dance world. If Jalaiah had been able to easily cross-post from Funimate to TikTok, she may have been able to benefit from “The Renegade” right from the start.

Apps like Funimate, Dubsmash, and Likee offer smaller, vibrant communities, often popular with users of color and other marginalized communities. These smaller platforms may provide functionality that other apps don’t, or they may just foster community in a way that appeals more to users that are not considered mainstream who want to preserve their unique culture. Apps like TikTok may not provide that opportunity, and that is okay when consumers have choices in the marketplace.

However, because these communities are smaller, users have fewer opportunities to monetize their creativity. These smaller applications also have a harder time benefiting from the creativity of their users. In the case of Jalaiah, instead of new users flocking to Funimate to check out Jalaiah’s other videos, TikTok benefited from the dance and probably grew its user base because of it.

In Washington, conversations about interoperability (the technical capability of different platforms to communicate with each other and work together) have become one of several pro-competition, pro-consumer choice policy solutions to gain notice.

In the TikTok/Funimate case, interoperability would allow users to create videos on Funimate but have them viewable on TikTok. This functionality would also make it easier for TikTok users to leave TikTok if they thought another video sharing app would provide them with better content, better usability, or just a better community.

One of the most common excuses by tech companies to avoid engaging in interoperability, or even basic data sharing at the user’s request, is that doing so may violate concerns about preserving users’ privacy. This excuse is meant to force policymakers to give platforms a reprieve from either more stringent privacy protections, or, if Congress must pass comprehensive privacy rules, to lock in existing platforms and online companies with a competitive advantage. That is a false choice.

Most platforms get a lot of data from their users. Whether it’s for personalizing the user experience, targeting ads, or both, internet companies collect so much personal information that they know a lot about what the user wants, who their user is, what the user does, whom the user connects with, what the user likes, and where the user moves.

As a result, it is often hard to stop using a platform or leave for its competition. We call this concept the cost of exclusion. If leaving a platform equals leaving memories, artistic works, or friends behind, or even abandoning a digital-self that represents us in ways that we can’t offline, then very few people are going to do it. The social cost is too high.

Without a growing user base, newer platforms often can’t compete with older, dominant players. This is especially problematic for platforms that cater to marginalized groups like people of color, queer people, or people with disabilities.

Interoperability can help new platforms build up a store of data they can use to improve their services, because when they gain a new user, that user can also bring access to their data and portions of their social graph from the old service. This can increase the power of users “voting with their feet” by leaving one service to switch to another. If users’ data becomes shared across services, then the new service they’ve chosen can doubly benefit: It gets a new user and a new source of data.

But while sharing data can be useful to both users and platforms alike, how do we preserve users’ privacy? And how can we prevent the data from being exploited?

First, we need a comprehensive privacy law. A comprehensive law would set a baseline expectation for preserving user privacy, regardless of the size of an online service or platform. Baseline expectations between platforms give all users, regardless of what platform they choose, protection against data discrimination or other privacy violations.

Second, we need interoperability rules that govern internet platforms to be a part of the privacy conversation. These rules wouldn’t just govern how platforms are made interoperable, but would also give users additional privacy protections. As a baseline, interoperability rules could limit how platforms use the data they get from interoperable systems. The rules could also prevent platforms from using that data for advertising or any other purpose not explicitly requested by the user.

With combined privacy and interoperability protections, an individual user will remain protected and as their data moves from one platform to the next, with the freedom to share and benefit from their creativity without accepting weaker privacy or giving into the cost of exclusion from a dominant platform. If a user does decide to use an interoperable system, then that user’s friends’ or followers’ data could be available to the new platform if the consent is given by the users friends for interoperable sharing.

The internet is a powerful tool for free expression and, as such, we must preserve spaces where marginalized groups congregate, create, and interact as a community. Niche communities may not represent your individual viewpoint, and some may be outright hateful, but if we are to preserve consumer choices for free expression for some communities, we cannot deny it for others.

If larger platforms are essentially stealing the content, work, and ideas of users on smaller platforms, then that harms not only the individual who created the content, but the original platform that housed the content. Privacy-preserving interoperability could be the solution to preserving spaces for marginalized communities, while still allowing them to benefit from their work.

Christopher Lewis is President and CEO at Public Knowledge.

Filed Under: competition, digital divide, free speech, greenhouse, interoperability, privacy
Companies: funimate, tiktok

'Big Tech' Blinders Let Other Privacy Violators Off The Hook

from the look-around dept

After over a decade of largely uncritical admiration from journalists, policymakers, and the public, the United States' biggest tech companies have experienced a swift fall from grace.

Facebook, Google, and Amazon are the subject of long overdue scrutiny, investigations, and legal proceedings in jurisdictions around the world for their widespread and repeated violations of people's privacy, while their executives no longer enjoy the glowing reputations they once did. After Cambridge Analytica, YouTube’s record-breaking COPPA fine for illegally tracking children, and a nearly endless list of other privacy transgressions, the Silicon Valley companies deserve all the scrutiny they're getting and then some.

But Silicon Valley tech companies aren't the only ones violating our privacy with impunity, and focusing on them as the sole villains allows a whole host of co-conspirators to get off scot-free. These other companies aren't doing less objectionable things with your data, and they haven't demonstrated that they're more worthy of consumer trust, or less likely to be breaking the law.

Policymakers and tech journalists need to take off their "big tech" blinders and focus more energy on the lesser-known privacy violators benefiting from Facebook and Google's absorption of the critical oxygen. When we're talking about powerful companies surreptitiously creating information about you and using it to make important decisions about your life, threaten your safety, or violate your privacy, Facebook and Google shouldn't be the only companies we're talking about—because they're far from being the only source of the problem.

Take the telecom industry, for example. All of the biggest telecommunications companies have been caught violating their customers' privacy, often at the same scale and to the same degree of flagrancy as their Silicon Valley peers.

In 2016, Verizon was fined $1.35 million by the FCC for tracking the browsing history of users on its mobile network without their knowledge and consent. Two years later, a Verizon-owned ad tech company paid the then-highest COPPA fine to the New York state Attorney General for illegally tracking children. AT&T was fined $25 million by the FCC for failing to protect consumer data after AT&T employees stole the names and full or partial Social Security numbers of around 280,000 customers, then sold them to third parties.

More recently, an investigation by the Norwegian Consumer Protection Council found that an AT&T-owned ad tech company was among those receiving granular location information and information on users’ sexual orientation from dating apps like Grindr and Tinder. All the biggest carriers—Verizon, AT&T, T-Mobile and Sprint—were found to be illegally selling customers’ real-time location data to anyone who wanted to buy it.

Not only do the telecoms violate the privacy protections we have, they tirelessly lobby to make them weaker and worse. They fought the FCC's broadband privacy rules in 2016, then (successfully) convinced Congress to negate them in 2017, lied about the privacy implications of encrypting DNS queries, and are trying to pass a Trojan horse privacy law that would calcify an exploitative status quo. Criticisms of "big tech's" exploitation of people's privacy that ignore big telecom miss the forest for the ISPs.

Then there's the ad tech industry. Behavioral advertising, which targets people with ads based on information about their browsing history or offline behavior rather than their current online activity, is in many ways the internet’s original privacy sin. The profit motive it supplies for companies to track our every move and keep us scrolling and clicking for as long as possible is responsible for much of the toxicity, disinformation, and privacy violations that we've become inured to.

Behavioral advertisers have done everything they can to link the viability of innovative web services to highly profitable surveillance of users, while claiming that any attempts to weaken or sever that link will break the internet. Their business model is what makes so many online services inherently and unavoidably privacy-invasive when they don’t have to be.

Given their reversal of fortunes, one could say that Facebook, Google, and the other Silicon Valley giants have taken the whipping boy role in privacy policy discussions that data brokers used to occupy. Data brokers were a heavy focus of consumer protection-minded policymakers at the FTC and the White House for a number of years, and while the attention previously paid to them has shifted, the venality of their business model hasn’t. The core business of these companies is to collect and infer sensitive information about as many people as possible, and to share and sell those assessments to any company that wants to buy them, like advertisers, health insurance companies, educational institutions, hedge funds, and others.

These companies traffic in lists of sexual assault survivors, which students are undocumented or are using birth control, and which of us is most likely to be a vulnerable target for predatory loans, all while remaining staunchly contemptuous of the prerogative of legislators to reign them in. Nothing about data brokers’ exploitation of our data is less objectionable or malignant than what Facebook and Google are doing with it, but #DeleteLiveramp won’t get anyone’s attention.

This list of companies that rake in enormous profits for violating your privacy and deserve more notoriety for it isn’t short. There’s the app developers, location aggregators, the credit reporting agencies, and insurance companies. There’s also the brick-and-mortar companies that are falling all over themselves to build exactly the same kinds of tracking and analytic capabilities that Facebook and Google have weaponized, or contract out for them when they can’t. All of these companies actively, eagerly take part in the kinds of privacy violations that the Silicon Valley companies have grown notorious for, and a focus on the Silicon Valley companies alone minimizes the threat, and distorts the real problem.

There are some ways in which Facebook, Google, and Amazon present uniquely severe concerns by virtue of their size and ubiquity: it’s not as though their widespread notoriety wasn’t repeatedly earned. Moreover, examples cited here of transgressions by non-Silicon-Valley companies only exist because tech journalists or policymakers decided to focus on that not-Facebook and not-Google issue.

Nor does expanding the focus of tech critics to lesser-known privacy violators mean that regulators should exclusively focus on small companies at the expense of big ones, as the FTC has correctly been criticized for. Neither policymakers nor journalists should ignore the 400 pound gorillas in the room or the havoc they wreak. But there are other actors in the data collection ecosystem that deserve to be just as notorious as the Silicon Valley giants, and whose conduct deserves just as much attention.

For all the investigation and criticism that Amazon’s Rekognition deserves, policymakers and journalists shouldn’t ignore lesser-known facial recognition technology vendors like NEC or Idemia. As Clearview AI has demonstrated in dramatic fashion, a hitherto-unknown company can turn out to be engaged in practices as bleakly dystopian as you can imagine, as soon as it receives the kind of scrutiny that the biggest tech companies have been experiencing for years.

Don't let Mark or Sundar shrink into the shadows—just make Hans (Vestberg, Verizon), Brian (Cassin, Experian), and Scott (Howe, LiveRamp) household names alongside them. Conversations about privacy policy, investigations into violators, and blame for the exploitative wretchedness of the current ecosystem shouldn’t solely focus on Mountain View and Menlo Park at the expense of ignoring Dallas, Atlanta, and Bentonville.

At the end of the day, "big tech" means nothing if it excuses the identical privacy transgressions of big telecom, big ad tech, big data broker, and big, well, everything else.

Lindsey Barrett is a staff attorney and teaching fellow at the Communications and Technology Law Clinic at Georgetown Law.

Filed Under: big tech, greenhouse, privacy, tech, telcos

Ron Wyden: It's Time Congress Helped Americans Protect Their Privacy

from the mind-your-own-business dept

Americans today are faced with a dilemma – there is a vast universe of products to let us control everything in our lives with a voice command or touch of a button. We can unlock our doors, turn on the heat, track our exercise routines and our baby monitors and perform a million other tasks in ways that make life easier or more efficient.

But these conveniences carry with them the danger that the data generated will be used against us.

Far too often, information that a government or company can collect and retain, is being collected and retained, and then shared or sold with other companies, marketers or agencies in ways that Americans never consider when they decide to buy a new thermostat. When the government or private corporations can tap into the stacks of information, these smart devices that make our lives easier also amount to spies working against our interests.

There is no good reason that Americans should have to compromise on privacy to benefit from the digital age. Consumers want smart devices, but we also want companies and the government to mind their own business when it comes to our personal information.

Over the past decade, I’ve made protecting Americans’ privacy against unnecessary government surveillance one of my top priorities. And following the Cambridge Analytica scandal, I’ve spent a lot of time thinking about how to create a commonsense plan to secure our privacy from corporations that haven’t been good stewards of private information.

That’s why I wrote a draft privacy bill, and, after a year of soliciting feedback from experts, introduced the Mind Your Own Business Act last fall.

It’s based on three core principles: First, corporations should be required to provide full transparency, in easy-to-understand language, about how they collect, use and share their customers’ data — and they should be held to those commitments. There should never be another scandal like we saw with wireless carriers, when phone companies shared real-time location data with bounty hunters, scammers and creepy exes without their customers’ knowledge.

Second, users need far more control over how their data is shared. The Mind Your Own Business Act would put teeth back into the Do Not Track option that has become essentially useless today. Under my bill there would be a single website where consumers could click a button to say no company could share your information with a third party without your express permission.

Under my bill consumers can choose whether to allow sharing data with third parties and targeted ads, and companies would have to offer tracking-free versions of their products that don’t cost more than the average revenue generated from a user’s data. And it makes sure low-income families can get free privacy protection, so privacy isn’t a luxury good.

Third, there need to be real consequences for corporations that break the rules. My bill follows the European privacy law and California’s Consumer Privacy Act to add fines up to 4 percent of annual revenue and even the possibility of jail time for executives who lie to the Federal Trade Commission (FTC) about protecting users’ privacy.

Those are some key points, but my plan does a lot more as well. Because privacy is also about making sure companies protect the data they have, my bill directs the FTC to set baseline privacy and cybersecurity standards and beefs up the number of people and resources the agency enforce those rules. It requires companies to assess their algorithms to detect whether they result in biased results and to fix problems they find.

My bill will create a healthier internet economy in two separate ways: First, consumers can directly choose to pay for ironclad privacy, instead of data-scooping free services. But even users who don’t opt out will see major improvements in privacy from the baseline rules and new transparency requirements. Companies often have no choice but to terminate their shady deals with third party data dealers, once they become public. With my bill, companies will be forced to disclose exactly who sees your data, and they will face steep penalties for lying about it.

Americans are sick of being faced with a feeling of vague unease after clicking through pages of fine print. Congress needs to step up, add guardrails for our privacy and stop the endless series of Sophie’s choices between technological advances and personal privacy. We must also reform the legal treatment of “business records” so that information created to make technology work better for you and your family is treated like private, personal effects, not subject to government prying without a warrant.

It's time to level the playing field between consumers and the corporations who profit from our data, and force companies to finally take Americans’ privacy seriously.

Filed Under: control, greenhouse, liability, privacy, ron wyden, transparency

In Search Of A Grand Unified Theory Of Free Expression And Privacy

from the time-for-a-gut-check dept

Every time I ask anyone associated with Facebook’s new Oversight Board whether the nominally independent, separately endowed tribunal is going address misuse of private information, I get the same answer—that’s not the Board’s job. This means that the Oversight Board, in addition to having such an on-the-nose proper name, falls short in a more important way—its architects imagined that content issues can be tackled substantively without addressing privacy issues. Yet surely the recent scandals that have plagued Facebook and some other tech companies in recent years have shown us that private information issues and harmful-content problems have become intimately connected.

We can’t turn a blind eye to this connection anymore. We need the companies, and the governments of the world, and the communities of users, and the technologists, and the advocates, to unite behind a framework that emphasizes the deeper-than-ever connection between privacy problems and free-speech problems.

What we need most now, as we grapple more fiercely with the public-policy questions arising from digital tools and internet platforms, is a unified field theory—or, more properly—a “Grand Unified Theory” (a.k.a. “GUT”)—of free expression and privacy.

But the road to that theory is going to be hard. From the beginning three decades ago when digital civil-liberties emerged as a distinct set of issues that needed public-policy attention, the relationship between freedom of expression and personal privacy in the digital world has been a bit strained. Even the name of the first big conference to bring all the policy people, technologists, government officials, hackers, and computer cops reflected the tension. The first Computers, Freedom and Privacy conference was held in Burlingame California, in 1991, made sure that attendees knew that “Privacy” was not just a kind of “Freedom” but its own thing that deserved its own special attention.

The tensions emerged early on. It seemed self-evident to most of us back then that the relationship between freedom of expression (and freedom of assembly and freedom of inquiry) had to have some limits—including limits on what any of us could do with the private information about other people. But while it’s conceptually easy to define in fairly clear terms what counts as “freedom of expression,” the consensus about what counts as a privacy interest is murkier. Because I started out as a free-speech guy, I liked the law-school-endorsed framework of “privacy torts,” which carved out some fairly narrow privacy exceptions to the broad guarantees of expressive freedom. That “privacy torts” setup meant that, at least when we talked about “invasion of privacy,” I could say what counted as such an invasion and what didn’t. Privacy in the American system was narrow and easy to grasp.

But this wasn’t the universal view in the 1990s, and it’s certainly not the universal view in 2020. In the developed world, including the developed democracies of the European Union, the balance between privacy and free expression has been struck in a different way. The presumptions in the EU favor greater protection of personal information (and related interests like reputation) and somewhat less protection of what freedom of expression. Sure, the international human-rights source texts like the Universal Declaration of Human Rights (in Article 19) may protect “freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media regardless of frontiers.” But ranked above those informational rights (in both the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights) is the protection of private information, correspondence, “honor,” and reputation. This difference balance is reflected in European rules like the General Data Protection Regulation.

The emerging international balance, driven by the GDPR, has created new tensions between freedom of expression and what we loosely call “privacy.” (I use quotation marks because the GDPR regulates not just the use of private information but also the use of “personal” information that may not be private—like old newspaper reports of government actions to recover social-security debts. This was the issue in the leading “right to be forgotten” case prior to the GDPR.) Standing by themselves, the emerging international consensus doesn’t provide clear rules for resolving those tensions.

Don’t get me wrong: I think the idea of using international human rights instruments as guidance for content approaches on social-media platforms has its virtues. The advantage is that in international forums and tribunals it gives the companies as strong a defense as one might wish in the international environment for allowing some (presumptively protected) speech to stay up in the face of criticism and removing some (arguably illegal) speech. The disadvantages are harder to grapple with. Countries will differ on what kind of speech is protected, but the internet does not quite honor borders the way some governments would like. (Thailand's lèse-majesté is a good example.) In addition, some social-media platforms may want to create environments that are more civil, or child-friendly, or whatever, which will entail more content-moderation choices and policies than human-rights frameworks would normally allow. Do we want to say that Facebook or Google *can't* do this? That Twitter should simply be forbidden to tag a presidential tweet as “unsubstantiated”? Some governments and other stakeholders would disapprove.

If a human-rights framework doesn’t resolve the free-speech/privacy tensions, what could? Ultimately, I believe that the best remedial frameworks will involve multistakeholderism, but I think they also need to begin with a shared (consensus) ethical framework. I present the argument in condensed form here: "It’s Time to Reframe Our Relationship With Facebook.” (I also published a book last year that presents this argument in greater depth.)

Can a code of ethics be a GUT of free speech and privacy? I don’t think it can, but I do think it can be the seed of one. But it has to be bigger than a single company’s initiative—which more or less is the best we can reasonably hope Facebook’s Oversight Board (assuming it sets out ethical principles as a product of its work on content cases) will ever be. I try not to be cynical about Facebook, which has plenty of people working on these issues who genuinely mean well, and who are willing to forgo short-term profits to put better rules in place. While it's true at some sufficiently high level that the companies privilege profits over public interest, the fact is that once a company is market-dominant (as Facebook is), it may well trade off short-term profits as part of a grand bargain with governments and regulators. Facebook is rich enough to absorb the costs of compliance with whatever regimes the democratic governments come up with. (A more cynical read of Zuckerberg's public writings in the aftermath of the company’s various public writings, is that he wants the governments to get the rules in place, and then FB will comply, as it can afford to do better than most other companies, and then FB's compliance will be a defense against subsequent criticism.)

But the main reason I think reform has to come in part at the industry level rather than at the company level, is that company-level reforms, even if well-intended, tend to instantiate a public-policy version of Wittgenstein's "private language" problem. Put simply, if the ethical rules are internal to a company, the company can always change them. If they're external to a company, then there's a shared ethical framework we can use to criticize a company that transgresses the standards.

But we can’t stop at the industry level either—we need governments and users and other stakeholders to be able to step in and say to the tech industries that, hey, your industry-wide standards are still insufficient. You know that industry standards are more likely to be adequate and comprehensive when they’re buttressed both by public approval and by law. That’s what happened with medical ethics and legal ethics—the frameworks were crafted by the professions but then recognized as codes that deserve to be integrated into our legal system. There’s an international consensus that doctors have duties to patients (“First, do no harm”) and that lawyers and other professions have “fiduciary duties” to their clients. I outline how fiduciary approaches might address Big Tech’s consumer-trust problems in a series of Techdirt articles that begins here.

The “fiduciary” code-of-ethics approach to free-speech and privacy problems for Big Tech is the only way I see of harmonizing digital privacy and free-speech interests in a way that will leave most stakeholders satisfied (as most stakeholders are now satisfied with medical-ethics frameworks and with lawyers’ obligations to protect and serve their clients). Because lawyers and doctors are generally obligated to tell their clients the truth (or, if for some reason they can’t, end the relationship and refer the clients to other practitioners), and because they’re also obligated to “do no harm” (e.g., by allowing companies to use personal information in a manipulative way or to violate clients’ privacy or autonomy), these professions already have a Grand Unified Theory that protects both speech and privacy in the context of clients relationships with practitioners.

Big Tech has a better shot at resolving the contradictory demands on its speech and privacy practices if it aspires to do the same, and if it embraces an industry-wide code of ethics that is acceptable to users (who deserve client protections even if they’re not paying for the services in question). Ultimately, if the ethics code is backed by legislators and written into the law, you have something much closer to a Grand Unified Theory that harmonizes privacy, autonomy, and freedom of expression.

I’m a big booster of this GUT, and I’ve been making versions of this argument before now. (Please don’t call it “Godwin-Unified Theory”—having one “law” named after me is enough.) But here in 2020 we need to do more than argue about this approach—we need to convene and begin to hammer out a consensus about a systematic, harmonized approach that protects human needs for freedom of expression, for privacy, and for autonomy that’s reasonably free of psychological-warfare tactics of informational manipulation. The issue is not just false content, and it’s not just personal information—open societies have to incorporate a fairly high degree of tolerance for unintentionally false expression and for non-malicious or non-manipulative disclosure or use of personal information. But an open society also needs to promote supporting an ecosystem—a public sphere of discourse—in which neither the manipulative crafting of deceptive and destructive content nor the manipulative targeting of it based on our personal data is the norm. That’s an ecosystem that will require commitment from all stakeholders to build—a GUT based not on gut instincts but on critical rationalism, colloquy, and consensus.

Filed Under: data protection, facebook oversight board, fiduciary duty, free speech, grand unified theory, greenhouse, multi-stakeholder, oversight board, privacy

Our First Greenhouse Topic: Privacy

from the let's-try-something-new dept

For decades the internet has flourished on the back of innovation, creativity, adaptation, and hard work. But while this technological revolution spurred no limit of incredible inventions, services, and profit, a drumbeat of scandals have highlighted how privacy and security were often a distant afterthought — if they were thought about at all.

Years later and the real cost of this apathy has become clear. We now face a daily parade of deeply entrenched privacy headaches impacting a web of interconnected industries and institutions — for which there are no quick fixes or easy answers.

Enter the Tech Policy Greenhouse: a new policy forum we’re hopeful will bring more nuance, collaboration, and understanding to a privacy conversation frequently dominated by simplistic partisan bickering, bad faith arguments, and the kind of ideological ruts that can result in bad solutions, no solutions, or missing the forest for the trees entirely.

When it comes to privacy and security, the penalty for our collective failure couldn’t be more obvious.

The global internet of things sector routinely fails to adhere to even the most basic security and privacy standards, resulting in hackable internet-connected Barbies, refrigerators, and tea kettles. Experts note these devices collectively create a form of "invisible pollution" that is easily ignored, but that routinely puts consumers, businesses, and the health of the internet at risk.

Corporations and governments alike repeatedly leave sensitive data unencrypted and openly exposed in the cloud, often failing to implement basic security measures despite ample warning. Avoidable hacks, breaches, and leaks are now a weekly affair, as are "historic" but performative government penalties that neither compensate victims nor seriously deter further malpractice.

The monetization of every last shred of location, behavior, and data has become a multi-billion dollar industry where safeguards or meaningful oversight are often lacking. As a result, sensitive behavioral data is routinely abused by everyone from law enforcement,to those pretending to be law enforcement, with the first casualties often the most vulnerable among us.

All of these problems require intelligent, multi-stakeholder collaboration built on the understanding that every solution has immense ramifications, there is no shortage of bad actors eager to derail effective consensus, and each and every action routinely results in unforeseen consequences.

The country’s privacy issues are also inextricably linked to other problems that the United States has failed to address, from the rampant monopolization and consolidation caused by mindless merger mania, to the slow but steady erosion of meaningful antitrust oversight. The rise of one of the biggest global health threats in a century has only complicated the debate further, shining an even brighter spotlight on existing problems, while creating entirely new challenges in balancing public health and public privacy in the mass surveillance era.

As we stumble collectively in the right direction, the Tech Policy Greenhouse hopes to reboot a conversation in dire need of a constructive fresh start. Over the next few weeks, you'll be hearing from a diverse chorus of activists, scholars, executives, and experts who will be tackling what they deem the most essential issues of the day. Kicking things off tomorrow will be Oregon Senator Ron Wyden, historically and repeatedly one of the leading DC voices for meaningful privacy reform.

Intelligent privacy policies and solutions won’t be easy to come by, and perfect proposals are likely impossible. But we’re eager to create a platform that can help drive policy makers toward better decision making, and we’re hopeful you’ll be part of the conversation.

Filed Under: greenhouse, policy, privacy, tradeoffs

Introducing The Tech Policy Greenhouse: Let's Have Thoughtful Conversations About The Biggest Tech Policy Challenges

from the conversations-that-can-go-places dept

Today we're introducing something very new: the Tech Policy Greenhouse. This is a project that I've been working on for about two years now, and I'm both thrilled and relieved to finally be getting it out the door. It starts from this basic premise: many of the biggest issues facing technology and innovation today are significant challenges that have no easy answer. Every possible approach or solution (including doing nothing at all) has tradeoffs. And yet very few people seem willing to admit that, as admitting to tradeoffs in policy proposals is seen as a sign of weakness or giving in. But the issues facing innovation policy today are too big and too important to not have a truly open discussion.

And having a truly open discussion about difficult policy questions means a lot more than the way the media has traditionally held these conversations: pitting two sides against one another and letting them argue it out. That rarely brings enlightenment, and mostly seems to just involve everyone digging in to their previously held beliefs. Having an open discussion about big challenges with no easy answers means being willing to dive deep into details, exploring ideas that might make you uncomfortable, and testing hypotheses that sometimes seem absurd on first glance -- but then being open to the feedback, ideas, improvements, and critiques raised about the ideas.

The Tech Policy Greenhouse is an attempt to have those discussions. Think of it as something of an online symposium, where we will be bringing in a variety of experts to give their thoughts on these issues, but hopefully with the humility to recognize that what is being discussed is difficult, and understanding all of the variables at play is an impossibility. Part of this means that we'll be publishing stories that challenge us -- including some arguments that I personally disagree with -- but which we believe are being presented in good faith and for the purpose of open discussion and debate, in the hopes that whatever future policy proposals and decisions are made, they are better informed by understanding a variety of points of view, a variety of proposals, and a variety of ideas about what might work.

This does not mean that the Tech Policy Greenhouse will or should be a clearing house for nonsense or half-baked ideas. There are certainly plenty of those. Instead, the goal is to get the best minds out there, willing to discuss difficult-to-impossible problems in a way that allows for greater understanding and greater humility about the eventual policy choices that are made.

To help with this project, we are pleased that we have help from two excellent editors, whose names should be well recognized around here: Karl Bode and Mike Godwin. Karl, of course, has long been a writer for Techdirt, as well as a number of other tech, telco, and policy publications -- and has agreed to take on a more involved editorial role for Greenhouse. Godwin, of course, is so internet-famous that he has an entire "law" named after him. He was also the first lawyer EFF hired, as well as the General Counsel for the Wikimedia Foundation. His insights into all things related to tech policy are unmatched and always thought-provoking.

For readers of Techdirt, you will see the new Greenhouse posts directly in the main feed, though they will be visually distinct (you may notice they look a bit... greener). We will continue to post regular Techdirt posts and content in the regular format, but the green posts will be from various experts and will be based around a theme that we are exploring at the time. Our plan is to roll out a few themes each year (the exact pace we'll figure out along the way). There is also now a Greenhouse tab at the top, if you want to see only the Greenhouse posts.

There is one other change regarding the Greenhouse posts. While they will have our regular comment area, there will also be a separate "Featured Discussion" area, in which those who are participating in the Techdirt Greenhouse project will be encouraged to comment and discuss the other posts in the series. This is very much an experiment that might not work, but we're excited to test it out. If the panelist discussion is happening, you will see it between the post and the regular comment section.

Our inaugural topic is digital privacy, because we decided to jump right into the deep end of extremely important, but controversial, problems with no easy solutions. Karl will introduce the overall topic in another introductory post, followed by Godwin's introduction regarding his thoughts on why the privacy debate needs to be reframed. And then, starting tomorrow and over the next few weeks, you'll see a variety of Greenhouse posts from experts interspersed among the regular Techdirt content. We are also open to more such posts, so if you have expertise and would like to contribute, please feel free to contact us.

Also, I should address the elephant in the greenhouse: this project is currently sponsored by Google, Twitter, and Protocol Labs. For some, this will discredit the entire project. We set out to try to launch this project with only grants from foundations and without corporate sponsorship, but so far have not been able to find foundations willing to support it (if you know of any who might be interested, or if you happen to work for one, please also reach out and let us know). Given that unfortunate lack of interest from foundations so far, we were happy that these three companies were willing to step up and sponsor the launch of this effort which, again, is a few years in the making. From the beginning, we were upfront that the whole point of this project is to discuss challenging tech policy questions, and that if any company sponsored this project, they would probably disagree heavily with some of the content, but that we felt that enabling those open and thoughtful discussions was good for the future of innovation itself -- and all three sponsors seemed to recognize the value of the conversations, even when some of the content might go against the company's own interests (indeed, the interests of the three sponsors are not aligned with one another in many cases, and sometimes diametrically opposed).

Still, if this concerns you, I only ask that you judge the content on its own merits. The whole point of this project is to take us all out of our comfort zone. I hope that people everywhere, no matter how they feel about various tech policy questions, can at least recognize that thoughtful conversation and debate are important to coming up with better policy overall. I look forward to this inaugural discussion on privacy -- and I hope everyone here will welcome it.

Filed Under: greenhouse, tech policy